snmpd.conf & MC/SG

[Matthew Ghofrani]

HP has done a preliminary security survey of our 4 clustered servers. One of the recommendations is to either disable or secure the SNMP service. Are there any "gotchas" I should be aware of in editing snmpd.conf to restrict "get-community-name"? If I only want SNMP for cluster purposes, is listing the four servers in the "get" restriction sufficient?

[Sridhar Bhaskarla]

cmsnmpd, snmp subagent for cluster registers with the master snmp daemon snmpdm. So, restricting the community in /etc/SnmpAgent.d/snmpd.conf would restrict cmsnmpd also.

Now about restricting access to systems, you don't want to specify anything other than your network management server in the snmpd.conf file. You would give access to your NMS server to query MIB objects of the cluster. What is your Network Management server?.

You need to set the get-community-name to anything other than 'public' and restrict access to the IP address of your network management server (or whatever that you use to query snmp MIBs of these servers).
An example configuration is like this

get-community-name some_string_here
get-community-name operator IP:IP_addr_of_nms
trap-dest: IP_addr_of_nms


-Sri

[Rainer von Bongartz · Accepted solution]

Jerry,

You said you want to use snmp only for 'cluster purposes'. In a high available environement it should make sense to use Event monitoring Services (EMS) from HP to check the status of your HW and certain conditions in your system before they might leasd to a problem.
Parts of EMS depend on snmp and changing community name leads to problems with EMS, which has to be reconfigured also using a different community name.

Just a thought as this has happended to me

Regards
Rainer

[Matthew Ghofrani]

Thanks