Oracle SuperCluster M7 Hardware
 
Oracle Exadata Hardware
 
Oracle Exadata Storage Server Software
 
Oracle SuperCluster T5-8 Hardware
 

PLA-Support>Eng Systems>Exadata/ODA/SSC>Oracle Exadata>DB: Exadata_EST
 

This documents provides instructions on how to change the SNMP community string on Engineered Systems such as SuperCluster and Exadata.

Applies to:

Goal

The goal of this document is to explain how to change the SNMP community string on compute nodes, cell nodes and their associated ILOMs within an Engineered system.  This is particularly useful when needing to change the string from the default "public" to meet security requirements.

Solution

I. For a database node:

    Linux-based (Exadata, Oracle Database Appliance, etc)

     1. Change the community string by editing /etc/snmp/snmpd.conf and replacing all occurrences of the current string (for example, public) with your preferred string.

     2. Restart the snmp service via

    Solaris-based (SuperCluster, Exadata SL6, etc)

     1. Change the community string by editing /etc/net-snmp/snmp/snmpd.conf and replacing all occurrences of the current string (for example, public) with your preferred string.

     2. Restart the snmp service via

II. For a cell node:

Applies to Linux-based storage on Exadata and SuperCluster.  Not applicable to ODA.

     1. Get a list of subscribers who use snmp.

     2. Change the community string by editing /etc/snmp/snmpd.conf and replacing all occurrences of the current string (for example, public) with your preferred string.

     3. Restart the snmp service.

     4. For any subscribers found in step 1, change the community string that they use. Take special care not to overwrite settings for any existing snmpSubsriber. If there are existing subscribers, then append the agent subscriptions.

         For example, if the cellcli -e list cell attributes snmpSubscriber command returned:

         Then you must append the Agent subscriptions:

         For example:              

III.  For an ILOM:

Applies to all Engineered Systems (Exadata, SuperCluster and ODA)

     1. Via the GUI, create the new community.

     2. Delete the public community.

 Further details on managing SNMP in an ILOM can be found in the "Configuring SNMP Settings in Oracle ILOM" section of the "Oracle ILOM Protocol Management Reference for SNMP and IPMI Firmware Release 3.2.x" document.

IV.  For an IB Switch

Applies to Exadata and SuperCluster.  Does not apply to ODA.

The default community strings "public", "private" and "ocadmin" may cause a scan to identify the IB switch as vulnerable to various exploits.  Resolve this by removing the community name(s) at fault.

     1.  Login to the switch ILOM.

     2.  At the SP console prompt, create a new SNMP community with the desired name.

     3.  Delete the offending community string.

      If more than one offending community string exists, delete each of them.

     Further details on managing SNMP in an IB switch can be found in the "Managing SNMP Services (CLI)" section of the "Sun Datacenter InfiniBand Switch 36 HTML Document Collection for Firmware Version 2.1" document.

V.  For a PDU

Applies to Exadata and SuperCluster. Does not apply to ODA.

     The PDU does not have a community string.  It pushes alerts to designated SNMP servers.  To update the servers that alerts are sent to, see section VII below.

     To change the SNMP servers that a PDU will send alerts to, refer to the "Enabling and Configuring SNMP (Original PDU)" or "Enabling and Configuring SNMP (Enhanced PDU)" section of the PDU User's Guide.

VI. For a Cisco 4948 Switch

Applies to Exadata and SuperCluster. Does not apply to ODA.

To change the community name:

     1.  Log in to the switch.

     2.  Enter Enable mode.

     3.  Enter Configuration mode.

     4.  Remove the offending community string.

     5.  Create a new SNMP community string with the desired name.

     6.  Exit Configuration mode

     7.  Save the change.

Further details on managing SNMP in a Cisco 4948 switch can be found at this Cisco support page.

VII.  Post-Change Actions

Applies to all Engineered Systems (Exadata, SuperCluster and ODA)

     If using Enterprise Manager, follow Doc ID 1968674.1 to make EM aware of the new community names.

     If using ASR and/or Platinum Services, contact your ACS representative to file a change request.

References

This solution has no attachment