topic Re: privelege problem in Server Management (Insight Manager 7)

privelege problem

DEL PI?O — Mon, 26 Jan 2004 09:40:11 GMT

Hi

I use an HP insight 7 SP2 on a HP ML330
when I acced at the insight agent web home page
I log into with the administrator account

But I can't move any threshold or deleting events in the log

I have the following message on the botom of the window

"Setting Thresholds: Thresholds cannot be set due to access limitations."

some ideas ??

fred

Re: privelege problem

Rob Buxton — Mon, 26 Jan 2004 16:18:29 GMT

You need to have a suitable SNMP community name set up on both ends.
At the Server you're tring to change the settings, go into SNMP Settings and add a new community name (e.g InsightManager) and give this Read/Write access.
Update IM to use this new community name.

Retry the connection.

You could just update the public SNMP Community name to have Read/Write to test that it is an SNMP connectivity issue. I would advise against leaving it like this as it's not a great security feature.

Re: privelege problem

DEL PI?O — Tue, 27 Jan 2004 03:27:15 GMT

HI

thanks for your response.

is there a way to have a more secure connection than SNMP community

fred

Re: privelege problem

Rob Buxton — Tue, 27 Jan 2004 14:23:10 GMT

Not really, SNMP is the backbone for device identification and then to be able to action things on the remote Server.

You can tighten up SNMP by:
Using new Community names and removing the public and private community names.
On W2000 Servers change the Accept SNMP Request from All Hosts to Selected Servers. This is the default on 2003.
If you do this you must add an address for the local host (127.0.0.1) plus the IP Address of the IM Server and any other Servers that will use SNMP to get information.

Re: privelege problem

David Claypool — Tue, 27 Jan 2004 14:47:45 GMT

While SNMP has been much maligned because of a perceived lack of security due to plain text communications, in practice that is not really the case, particularly as it relates to IM7/hpSIM and the Insight agents. In fact, since most systems are placed within firewall protected corporate networks, if you have users sniffing your network, you have a bigger problem than SNMP.

Communications need to be secure when you have the potential to do harm. The only "harm" that is possible with the Insight agents (and this is disabled by default) is the remote reboot option. Other than that, SNMP is used for status polling, data collection and used internal to the agents to clear logs and manipulate thresholds. Every "transaction" that is performed (group configuration, software distribution) is done through HTTPS and not SNMP.

Yes, the presence of SNMP on a system introduces another point for potential attack, but SNMP is no more intrinsically vulverable than DCOM, file sharing, HTTP, FTP and so forth.