Skip to content

Rotate the SNMP communities on all four devices #9

Description

@Gerrrt

The previous SNMP community was committed to this public repository in plaintext and shared across pfSense, iLO, the MokerLink switch and the APC UPS. It must be treated as public — a single read credential for every piece of network gear at once.

Needs physical/admin access to each device, so it cannot be done from the repo side.

Runbook: docs/runbooks/rotate-snmp-community.md

Steps

  • Generate four distinct communities, one per device — not a new shared string
  • Rotate on pfSense
  • Rotate on iLO
  • Rotate on the MokerLink switch
  • Rotate on the APC UPS
  • make secrets-edit to update secrets/observability.sops.yaml
  • make up and confirm all four SNMP targets are up in Prometheus

Notes

The repo side is already prepared: the community is a SOPS-encrypted value rendered into snmp.yaml at deploy time by scripts/render-config.sh, and never written to disk in the working tree. Rotation is an edit to the encrypted file plus a redeploy.

Related: moving to SNMPv3 authPriv is tracked separately in docs/roadmap.md. pfSense, the APC and iLO all support it; the MokerLink switch does not, which is what blocks doing it uniformly.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions