Skip to main content
emisar

Dell iDRAC / IPMI (ipmitool)

v0.1.5

Out-of-band BMC monitoring and power control over IPMI 2.0 (RMCP+/lanplus) with ipmitool — sensor data records, full sensor readings with thresholds, the System Event Log (SEL) and its summary, chassis + power state, FRU inventory, BMC firmware (mc info) and self-test, LAN config, and DCMI power draw. Plus gated mutators: chassis power control, one-time boot device, and SEL clear. Targets a Dell iDRAC or any IPMI-over-LAN baseboard controller by hostname/IP; credentials come from the runner environment. Reads are read-only.

12 allowed by default 2 need approval by default 1 denied by default
Pack ID
dell-ipmi
Vendor
emisar
OS
linux
Actions
15
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
ipmitool

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install dell-ipmi --hash sha256:994ef0e18b201da5df5723e4f0f5e4fe4a92f7ce1d7f1d35c1c604f6a7107972

Setup

Every action runs ipmitool against the {{ args.host }} BMC you pass, over an encrypted IPMI 2.0 (lanplus) session. The target must be listed exactly in IPMI_ALLOWED_HOSTS . The account name is read from IPMI_USER and the password from IPMI_PASSWORD (via ipmitool's -E, so it never appears in the process arguments or the audit log).

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • IPMI_ALLOWED_HOSTS required

    Comma-separated exact BMC hostnames or IPv4 addresses that actions may target. Hostname matching is ASCII case-insensitive; entries do not accept wildcards, CIDRs, URLs, or spaces.

  • IPMI_USER required

    BMC account name (ipmitool -U). Provision a dedicated, least-privilege monitoring account; OPERATOR privilege covers every read plus chassis power control.

  • IPMI_PASSWORD required

    BMC account password. Read by ipmitool's -E straight from the environment, so it never lands in argv, a ps listing, or the audit log. We never pass -P.

  • IPMI_CIPHER default 3

    RMCP+ cipher suite (-C). Default 3 (RAKP-HMAC-SHA1 + AES-128-CBC), the reliable Dell baseline; ipmitool's own default changed 3->17 in 1.8.19, so the pack always sets it. Suite 0 is refused (it disables wire authentication — CVE-2013-4783). Set 17 for HMAC-SHA256 if the BMC supports it.

  • IPMI_PRIVLEVEL default OPERATOR

    Requested privilege level (-L: USER, OPERATOR, or ADMINISTRATOR). Default OPERATOR — enough for every read plus chassis power control, and less than ipmitool's own ADMINISTRATOR default. Drop to USER for a read-only account.

Notes

  • Create the BMC account in the iDRAC web UI under iDRAC Settings → Users → Local Users, and grant it the OPERATOR privilege IPMI_PRIVLEVEL defaults to. The same account needs its IPMI LAN privilege set, which is configured on that user's page.
  • IPMI_ALLOWED_HOSTS , IPMI_USER , IPMI_PASSWORD , and any IPMI_CIPHER / IPMI_PRIVLEVEL overrides must also be allowlisted in the runner's execution.inherit_env — the action env is scrubbed to PATH/LANG/LC_ALL/TERM by default, so a variable present on the host but not inherited is silently dropped and the call is refused or fails to authenticate.
  • IPMI Over LAN ships DISABLED on iDRAC9. Enable it first: iDRAC web UI -> iDRAC Settings -> Connectivity -> Network -> IPMI Settings -> Enable IPMI Over LAN; or racadm set iDRAC.IPMILan.Enable 1 . iDRAC9 is IPMI 2.0 / RMCP+ only (the legacy lan interface is unsupported), which is why the pack uses lanplus.
  • ipmitool historically exits 0 even when the session fails (bad credential, unreachable BMC, or IPMI Over LAN disabled all surface only on stderr with empty stdout). The pack's wrapper turns an empty result into a real non-zero exit so a failure is loud, not a misleading empty success.
  • IPMI 2.0 has unfixable protocol weaknesses (RAKP hash disclosure, CVE-2013-4786). Isolate BMCs on a dedicated management VLAN with no internet path (NSA/CISA BMC-hardening guidance), use strong unique BMC passwords, and never enable cipher suite 0.

Verify it works

Runs ipmi.chassis_status, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify dell-ipmi

Install and configure a pack walks through the whole sequence on a host.

Actions 15 total

View on GitHub
  • ipmi.bootdev script high High — service-affecting

    Set next-boot device

    Set the device the server boots from on its NEXT boot — `ipmitool chassis bootdev <device>`. One-time by default (the BIOS reverts to its normal boot order afterward); it does not reboot the host, so pair it with a power action. Common use: "boot to PXE once" to re-image, or "bios" to drop into setup on the next restart.

    View source on GitHub
  • ipmi.chassis_status script low Low — read-only or trivially reversible

    Chassis status (power, intrusion, faults)

    Show the BMC chassis status — `ipmitool chassis status`. Returns System Power (on/off), Power Restore Policy and Last Power Event, plus the Chassis Intrusion, Drive Fault, and Cooling/Fan Fault flags. The fastest power + health snapshot, and the action to verify the pack can reach and authenticate to a BMC.

    View source on GitHub
  • ipmi.dcmi_power script low Low — read-only or trivially reversible

    Show DCMI power reading (watts)

    Show real-time power draw via DCMI — `ipmitool dcmi power reading`. Returns the instantaneous, minimum, maximum, and average power consumption in watts over the BMC's sampling period, plus the sampling timestamp. The direct answer to "how much is this server drawing right now?" on BMCs that support DCMI.

    View source on GitHub
  • ipmi.fru script low Low — read-only or trivially reversible

    Show FRU inventory

    Show field-replaceable-unit inventory — `ipmitool fru print`. Returns board and product manufacturer, name, part number, and serial for the chassis and each FRU device (PSUs appear as their own devices). The Serial fields carry the Dell service tag. Inventory and asset data; no live readings.

    View source on GitHub
  • ipmi.lan_print script low Low — read-only or trivially reversible

    Show BMC LAN configuration

    Show the BMC LAN channel configuration — `ipmitool lan print <channel>`. Returns the BMC IP source (static/DHCP), address, netmask, MAC, default gateway, VLAN id, and the per-cipher-suite privilege map. Useful for confirming BMC network settings and which cipher suites are enabled. The SNMP community string in this output is redacted before it leaves the host.

    View source on GitHub
  • ipmi.mc_info script low Low — read-only or trivially reversible

    Show BMC info (firmware, capabilities)

    Show management-controller identity — `ipmitool mc info`. Returns the BMC device id, firmware revision, IPMI version, manufacturer (Dell = 674) and product ids, and the list of supported capabilities (SDR repo, SEL, FRU, chassis, …). Confirms the BMC firmware level and what it can do.

    View source on GitHub
  • ipmi.mc_selftest script low Low — read-only or trivially reversible

    Run BMC self-test

    Get the BMC self-test result — `ipmitool mc selftest`. A passing controller prints "Selftest: passed"; a failure reports the specific fault (SDR repo empty, FRU corrupt, …). A quick "is the management controller itself healthy?" check. Reads the controller's own diagnostics; changes nothing.

    View source on GitHub
  • ipmi.power_control script critical Critical — data loss or irreversible

    Control chassis power

    Change the server's power state — `ipmitool chassis power <op>`. Only "soft" is graceful (it sends an ACPI shutdown the OS can act on); "off", "cycle", "reset", and "diag" are abrupt and can lose in-flight data — treat them like pulling the plug. Prefer an OS-level shutdown or the iDRAC graceful path when one is available; reach for this when the host is unresponsive. Confirm the current state with power_status first.

    View source on GitHub
  • ipmi.power_status script low Low — read-only or trivially reversible

    Chassis power state (on/off)

    Show whether the server is powered on or off — `ipmitool chassis power status`. Returns a single line, "Chassis Power is on" or "... off". The cheapest check before or after a power action.

    View source on GitHub
  • ipmi.sdr script low Low — read-only or trivially reversible

    List all sensors (SDR)

    List every sensor with its current reading and state — `ipmitool sdr elist`. One row per sensor data record: name, reading, status (ok / nc / cr), plus the sensor number and entity id. Covers temperatures, fans, voltages, currents, power supplies, and discrete state sensors in a single call — the workhorse health read.

    View source on GitHub
  • ipmi.sdr_type script low Low — read-only or trivially reversible

    List sensors of one type

    List only the sensors of a chosen type — `ipmitool sdr type <type>`. Narrows the SDR read to Temperature, Fan, Voltage, Current, or Power Supply so you get just the readings you care about (e.g. all inlet/exhaust temps, or all PSU sensors) without scanning the full repository.

    View source on GitHub
  • ipmi.sel script low Low — read-only or trivially reversible

    List System Event Log entries

    List the BMC System Event Log — `ipmitool sel elist`. One row per event: record id, date/time, sensor, decoded description, and asserted/deasserted. The authoritative history of hardware faults (ECC errors, PSU loss, thermal trips, intrusion). The iDRAC SEL is bounded and circular (512-1024 entries), so a full log can be large.

    View source on GitHub
  • ipmi.sel_clear script high High — service-affecting

    Clear the System Event Log

    Erase the BMC System Event Log — `ipmitool sel clear`. IRREVERSIBLE: every recorded hardware event is wiped and cannot be recovered. Pull the log with sel first if you need a record. Routine after addressing the faults a server logged (e.g. to reset a full SEL), but destroys forensic history, so it is gated.

    View source on GitHub
  • ipmi.sel_info script low Low — read-only or trivially reversible

    Show SEL summary (count, capacity)

    Show the System Event Log summary — `ipmitool sel info`. Returns the entry count, free space, percent used, last-add and last-erase timestamps, and the overflow flag, without dumping every entry. Use it to decide whether the SEL is filling up or has new events before pulling the full log.

    View source on GitHub
  • ipmi.sensor script low Low — read-only or trivially reversible

    List sensors with thresholds

    List sensors with their full threshold set — `ipmitool sensor list`. Like the SDR read but wider: each row adds the lower/upper non-critical, critical, and non-recoverable thresholds alongside the reading and unit. Use when you need to see how close a reading is to tripping, not just its current state. Larger output than sdr.

    View source on GitHub
← Back to registry
Pack reference  Publish your own