Redfish / BMC Setup
How to enrol an enterprise server BMC — Dell iDRAC, HPE iLO, Supermicro, Lenovo XCC, or any other Redfish-capable BMC — into KVM Fleet.
Unlike an IP-KVM device (PiKVM and friends, which run our agent), a BMC is enrolled directly with credentials. Nothing is installed on the BMC itself — KVM Fleet reaches it over Redfish/IPMI.
Prerequisites
- A Redfish-capable BMC: Dell iDRAC 8/9, HPE iLO 5/6, Supermicro (X11/X12 with Redfish), Lenovo XClarity Controller, or a generic Redfish/OpenBMC BMC
- A dedicated service-account credential on the BMC (read-only or operator, per your policy — avoid using the default
admin) - The BMC reachable from the platform, or a KVM Fleet site agent on the same LAN for BMCs on a private VLAN
How reachability works
KVM Fleet connects to the BMC's Redfish API. Two options:
- Direct: open the BMC's firewall to the platform's egress IP (shown on the Add device screen) so the platform can reach
https://<bmc>/redfish/v1. - Via a site agent: for BMCs on an isolated management VLAN, run the KVM Fleet agent on a host on that LAN. The agent's outbound tunnel reaches the BMCs locally — no inbound ports, no exposing the BMC to the internet.
Enrol
- In the dashboard, click Add device → Redfish / BMC.
- Choose the vendor (or Auto-detect, which probes
/redfish/v1Oem markers and sets the vendor for you). - Paste the BMC URL (e.g.
https://idrac01.example.com) and the service-account username + password. - Optionally enable Verify BMC TLS certificate — required by ISO 27001 A.13 / SOC 2 CC6 when the BMC serves a CA-signed cert. Most BMCs ship a self-signed cert; leave it off until you've installed a real one.
- KVM Fleet runs a probe before saving — if the BMC can't be reached, the device is not created. Credentials are encrypted at rest (Fernet).
What you get
Once enrolled, the BMC appears in your fleet with:
- Console launch — open the BMC's own HTML5 KVM console, with the action recorded in the audit chain
- Power control — on / off / cycle / reboot via Redfish, audit-logged
- Inventory & sensors — model, power state, thermal/health readings
- Just-in-time access — grant time-limited, approved access instead of sharing the BMC admin password
- Tamper-evident audit — every action lands in the SHA-256 hash-chained, offline-verifiable audit log
Supported vendors
| Vendor | Detected as | Notes |
|---|---|---|
| Dell | idrac |
iDRAC 8/9 (Redfish) |
| HPE | ilo |
iLO 5/6 |
| Supermicro | supermicro |
Redfish-enabled boards |
| Lenovo | lenovo-xcc |
XClarity Controller |
| Generic | redfish-generic |
Any Redfish/OpenBMC BMC |
The open-source bmc-adapters library (Apache 2.0) is the same Redfish/IPMI layer KVM Fleet uses, if you want to script against your BMCs directly.
Troubleshooting
| Symptom | Fix |
|---|---|
| "BMC unreachable" on enrol | Confirm the platform's egress IP (or your site agent) can reach https://<bmc>/redfish/v1; check the BMC firewall/allow-list |
| TLS probe fails | The BMC is serving a self-signed cert — leave "Verify BMC TLS certificate" off, or install a CA-signed cert on the BMC |
| Auto-detect picks the wrong vendor | Select the vendor explicitly in the Add device form |