A baseboard management controller (BMC) is a small, separate computer built into the main board of every server. It lets an administrator switch the server on and off, watch its health and see its screen from far away, even when the server has crashed or is switched off. A server's main board is called the baseboard, which gives the BMC its name.
The BMC has its own processor, its own memory, its own firmware and its own network port. This port connects to a separate management network, kept apart from the network that carries the server's normal traffic. The BMC keeps running as long as the server is plugged in, even when the server itself is switched off. It reads sensors for temperature, fan speed, voltage and power use, and it keeps a log of every fault.
Consider an administrator in Kochi who looks after servers in a data centre in Kolkata, nearly 2,000 km away. At 2 a.m., one database server stops answering. She opens the BMC's web page over the management network. The BMC shows that fan 3 failed, that the CPU then reached 98°C, and that the operating system froze. She tells the BMC to restart the server. On the BMC's remote console, she watches the screen as the server starts again, exactly as if she were sitting in front of it. She then raises a ticket asking the data centre's staff to replace fan 3 in the morning. Nobody had to travel.
The BMC also lets an administrator install an operating system remotely. It can make a file on the administrator's laptop appear to the server as a disk, so that the server starts from that file. Software reaches the BMC through two common standards: IPMI, the older one, and Redfish, the newer one. Through them, server fleet management software can control thousands of BMCs at once. Some server makers, such as Dell and Hewlett Packard Enterprise, write their own BMC firmware for most of their servers. Many other makers buy BMC firmware from a specialist firmware company, such as American Megatrends. An open-source version, called OpenBMC, is used by many large cloud companies.
Because the BMC can control the whole server, attackers value it. A BMC left on the ordinary network with its factory password is a serious risk. So the management network is kept separate, and on many new servers a hardware root of trust checks the BMC's firmware before the BMC is allowed to start. A server without a working BMC can be repaired only by someone standing in front of it.