Well, you could just shut it down and wait for the phone to ring......
I don't remember ever having to set up SNMP for anything but a Nagios server
in the past, so I doubt that Mimix uses it.
--
Jim Oberholtzer
Agile Technology Architects
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rob
Berendt
Sent: Tuesday, April 19, 2016 2:55 PM
To: midrange-l@xxxxxxxxxxxx
Subject: IBM i and SNMP
We had this issue on a recent security scan:
<snip>
3.1.4. Default or Guessable SNMP community names: public (snmp-read-0001)
Description:
The Simple Network Management Protocol (SNMP) is a commonly used network
service. Its primary function is to provide network administrators with
information about all kinds of network connected devices. SNMP can be used
to get and change system settings on a wide variety of devices, from network
servers, to routers and printers. The drawback to this service is the
authentication is an unencrypted "community string". In addition many SNMP
servers provide very simple default community strings. The community string
"public" is a default on a number of SNMP servers.
This community string can allow attackers to gain a large amount of
information about the SNMP server and the network it monitors.
Attackers may even reconfigure or shut down devices remotely.
Running SNMP serviceSuccessfully authenticated to the SNMP service with
credentials: uid[] pw[public] realm[]
</snip>
Recently I would assume that the GUI "IBM Navigator for i" would have more
options than a comparable 5250 command, (in this example CHGSNMPA). This
doesn't seem to be the case in this example. The only property available
via the GUI is autostart yes/no.
I was trying to compare the lpar mentioned on this security report with
another lpar not on the report. The only difference I found was, while both
lpars have this set to autostart yes, only one was actually running.
I checked for the server jobs but not even their joblogs, nor any qhst
DSPLOG JOB(such and such) information was still hanging around.
So we have these possible action plans:
- Ensure that all lpars are set to autostart no.
- Look at some enhanced snmp capabilities which tighten this up. Perhaps
ALWSNMPV3(*YES) or some such thing.
Funny thing is the lpar with no snmp jobs is AUTOSTART(*YES)
ALWSNMPV3(*YES).
The lpar with snmp jobs is AUTOSTART(*YES) ALWSNMPV3(*NO) Perhaps there is
an issue with SNMPV3?
Should I just AUTOSTART(*NO), and shutdown any active snmp, on all lpars?
I don't "think" we're using this.
If it was something critical I would think it would be hitting our main
production lpar. That's the one where there are no active SNMP server jobs.
It's Mimix partner is the one with the active SNMP server jobs.
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at
http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
midrange.com
