Recently I came into the possession of a HP Microserver (from 2012) type N40L (not the N54L unfortunately). Fandom as a nice overview of the specifications (as well as tips etc.). This server came with a Remote Access Card which is a somewhat simpler version of HP’s ILO (which is basically IPMI). Looking for documentation on the web for a system which is almost a decade old is, well, challenging. Search results will not be plentiful and those who seem to be useful, could turn out to contain dead links etc. Unfortunately I didn’t know the credentials of the Remote Access Card webinterface and so I started my journey to reset it.

IPMI webinterface

Setting the IP address of the Remote Access Card was easily done via the BIOS, but nothing could be set there with regards to user management.

First I tried accessing the IPMI webinterface with the default username “admin” and default password “password”. Of course this did not work.

Eventually I found the manual online which noted a method to reset the password of an IPMI user. Splendid!

IPMI tool

The server is running Debian 10 (buster), so installing the required ipmitool is quickly done:

apt-get install ipmitool

The broken bits

The manual shows a method to check if the BMC firmware is functioning correctly:

# ipmitool raw 0x6 0x4
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory

Hmmm, this seems to indicate that IPMI tool will not work at all, since the ipmi device does not even exist. That is strange. The journal agrees:

kernel: ipmi_si: Trying SMBIOS-specified kcs state machine at i/o address 0xca8, slave address 0x20, irq 0
kernel: ipmi_si dmi-ipmi-si.0: Interface detection failed

Luck was on my side, since Bodgit & Scarper also had this issue and had solved it by reading a manual which stated the correct IPMI I/O address (which is not ‘‘‘0xca8’’’). The only thing I had to do was to pass the correct address to the kernel module:

echo 'options ipmi_si type=kcs ports=0xca2' >/etc/modprobe.d/ipmi.conf
modprobe -r ipmi_si
modprobe ipmi_si

Looking at the journal, it show the change was successful:

kernel: ipmi_si: Trying hardcoded-specified kcs state machine at i/o address 0xca2, slave address 0x20, irq 0
kernel: ipmi_si hardcode-ipmi-si.0: IPMI message handler: Found new BMC (man_id: 0x000001, prod_id: 0x3431, dev_id: 0x20)
kernel: ipmi_si hardcode-ipmi-si.0: IPMI kcs interface initialized

Success!

Now the BMC firmware check replies that all self tests were successful (‘‘‘55 00’’’):

# ipmitool raw 0x6 0x4
 55 00

User ID 2 (‘‘‘0x02’’’ in the ipmi command below) is usually the default admin account. Check the username of ID 2 and convert it from HEX to ASCII to make it human readable:

# ipmitool raw 0x6 0x46 0x02
 61 64 6d 69 6e 00 00 00 00 00 00 00 00 00 00 00
# echo "61 64 6d 69 6e 00 00 00 00 00 00 00 00 00 00 00" | xxd -p -r
admin

Now the password can finally be reset. First let us create a password. Then convert it from ASCII to HEX and apply it. I use the default password “password” in the commands below. According to the documentation the ipmi command must start with ‘‘‘0x06 0x47 0x02 0x2’’’ and then a 16 byte ASCII password must be provided. Not using the 16 bytes will throw the error below. You should also omit the dot at the end of the xxd conversion.

# echo "password" | xxd
00000000: 7061 7373 776f 7264 0a                   password.
# ipmitool raw 0x06 0x47 0x02 0x2 0x70 0x61 0x73 0x73 0x77 0x6f 0x72 0x64 
Unable to send RAW command (channel=0x0 netfn=0x6 lun=0x0 cmd=0x47 rsp=0xc7): Request data length invalid
# ipmitool raw 0x06 0x47 0x02 0x2 0x70 0x61 0x73 0x73 0x77 0x6f 0x72 0x64 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0
.