Scan Redfish BMCs with cnspec

Query and inventory your servers using cnspec and Redfish, the DMTF standard REST API exposed by modern baseboard management controllers (BMCs). Like IPMI, Redfish operates out-of-band: it runs independently of the host system's CPU, firmware (BIOS or UEFI), and operating system, so you can audit hardware whether or not it is powered on.

Redfish is the successor to IPMI, and most server vendors expose it through their own BMC products:

• HPE Integrated Lights-Out (iLO)
• Dell Integrated Dell Remote Access Controller (iDRAC)
• Supermicro BMCs

cnspec connects to the Redfish service and scans the managed systems, management controllers, chassis, user accounts, account and session policies, exposed management protocols, TLS certificates, and firmware inventory against your security and compliance best practices, without installing anything on the server. Use the Redfish provider inside your own policies to check firmware levels, UEFI Secure Boot status, BMC accounts, and controller hygiene.

Prefer the older Intelligent Platform Management Interface? See Scan IPMI BMCs with cnspec. New to cnspec? Start with the quickstart.

PrerequisitesCopy Anchor Link

To scan Redfish BMCs with cnspec, you must have:

• cnspec installed on your workstation
• Network access to the BMC's management interface (typically on a dedicated management port)
• BMC credentials (username and password) with permission to read the Redfish service

The Redfish provider works with any BMC that implements the DMTF Redfish standard, including HPE iLO, Dell iDRAC, and Supermicro controllers.

Connect to a Redfish BMCCopy Anchor Link

To query a Redfish BMC, provide the username and host address:

cnspec shell redfish USER@HOST

For example:

cnspec shell redfish admin@192.168.1.100 --ask-pass
Enter password:

You can also provide the password directly:

cnspec shell redfish admin@192.168.1.100 --password YOUR_PASSWORD

BMCs ship with self-signed TLS certificates by default. If cnspec rejects the controller's certificate, add --insecure to skip verification:

cnspec shell redfish admin@192.168.1.100 --ask-pass --insecure

To scan a Redfish BMC against a policy instead of opening an interactive shell, use cnspec scan:

cnspec scan redfish admin@192.168.1.100 --ask-pass

Example queriesCopy Anchor Link

Once connected, you can query Redfish resources. cnspec normalizes the data model across vendors, so the same queries work against HPE iLO, Dell iDRAC, and Supermicro hardware.

Inventory the managed systemCopy Anchor Link

cnspec> redfish.systems[0] { model manufacturer serialNumber powerState biosVersion }
systems[0]: {
  manufacturer: "HPE"
  model: "ProLiant DL380 Gen11"
  serialNumber: "SGH123ABCD"
  powerState: "On"
  biosVersion: "U54 v2.10"
}

Check the management controller firmwareCopy Anchor Link

cnspec> redfish.managers[0] { model firmwareVersion managerType }
managers[0]: {
  model: "iLO 6"
  firmwareVersion: "1.55"
  managerType: "BMC"
}

Confirm UEFI Secure Boot is enabledCopy Anchor Link

cnspec> redfish.systems[0].secureBootEnabled
systems[0].secureBootEnabled: true

Audit the local BMC accountsCopy Anchor Link

cnspec> redfish.accounts { userName roleId enabled }
accounts: [
  0: {
    userName: "admin"
    roleId: "Administrator"
    enabled: true
  }
]

Review the firmware inventoryCopy Anchor Link

cnspec> redfish.firmware { name version }
firmware: [
  0: {
    name: "BIOS"
    version: "U54 v2.10"
  }
  1: {
    name: "iLO"
    version: "1.55"
  }
]

Query vendor-specific extensionsCopy Anchor Link

When you connect to hardware from a specific vendor, cnspec populates the matching extension resource. These resources are empty on hardware from other vendors.

Read the HPE iLO license edition:

cnspec> redfish.hpe { licenseLabel licenseType }
redfish.hpe: {
  licenseLabel: "iLO Advanced"
  licenseType: "Perpetual"
}

Read the Dell iDRAC hardware generation and BIOS release date:

cnspec> redfish.dell { generation biosReleaseDate }
redfish.dell: {
  generation: "16G"
  biosReleaseDate: "2025-03-14"
}

Check whether Supermicro BMC system lockdown is engaged:

cnspec> redfish.supermicro.systemLockdownEnabled
redfish.supermicro.systemLockdownEnabled: true

Example security checksCopy Anchor Link

The Redfish provider also reports the security state of the BMC itself: its password and lockout policy, the management protocols it exposes, the certificates it presents, and whether it answers without credentials.

Ensure the service root requires authenticationCopy Anchor Link

cnspec> redfish.serviceRootUnauthenticated == false

Ensure telnet and IPMI over LAN are disabledCopy Anchor Link

Telnet carries credentials in cleartext, and IPMI over LAN bypasses the account controls that apply to Redfish:

cnspec> redfish.networkProtocols.none(telnetEnabled == true || ipmiEnabled == true)

Ensure failed logins lock the accountCopy Anchor Link

A threshold of zero leaves every local account open to unlimited password guessing:

cnspec> redfish.accountService.accountLockoutThreshold > 0

Ensure vendor default accounts are disabledCopy Anchor Link

cnspec> redfish.accounts.where(defaultVendorAccount == true).none(enabled == true)

Ensure the controller doesn't present a self-signed certificateCopy Anchor Link

cnspec> redfish.certificates.none(selfSigned == true)

Learn moreCopy Anchor Link

• To learn more about how the MQL query language works, read Write Effective MQL.

• For a list of all the Redfish resources and fields you can query, read the Redfish Resource Pack Reference.