From bab5e4dc4d555bc4a6657e5aa16a86955cb0f9d8 Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 19 Aug 2026 00:06:51 +0000 Subject: [PATCH] docs: stop claiming neo has never answered SNMP MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It has. #23 wrote "never answered an SNMP poll at all" into four files on the strength of max_over_time(up{instance="10.7.7.2"}[30d]) == 0. That measured Prometheus retention, not the device: all four SNMP series carry ~23,127 samples and begin together when the current stack was built, so the TSDB holds no SNMP data from before that point and the window cannot speak to it. The switch last polled successfully in November 2025, under a hand-tuned minimal module. What is true is narrower and still enough to keep #9 open: neo is not answering now, and has not for the whole span of available data. Also records the sharper reading of the ICMP/TCP-pass, UDP-fail split — that is what a wedged SNMP agent looks like, not a dead device. Refs #9, #22 Co-Authored-By: Claude Opus 5 --- README.md | 4 ++-- SECURITY.md | 14 ++++++++------ docs/roadmap.md | 6 +++--- docs/security.md | 4 ++-- 4 files changed, 15 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 05ab2a1..0ccfc91 100644 --- a/README.md +++ b/README.md @@ -201,8 +201,8 @@ enforces it, and `make pin-digests` re-resolves them. Open work is tracked in [`docs/roadmap.md`](docs/roadmap.md). The current top items: finish the SNMP rotation on the switch, purge the old communities from git history, replace the UPS battery, and get 64-bit interface counters off the -switch. The first and last of those share a blocker — the switch has never -answered an SNMP poll at all. +switch. The first and last of those share a blocker — the switch is not +currently answering SNMP. ## License diff --git a/SECURITY.md b/SECURITY.md index 9016e08..650a646 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -38,16 +38,18 @@ is a very different thing from an overlooked one. Full detail in | What | Status | | --- | --- | -| SNMP community committed in plaintext, shared across firewall, switch, UPS and BMC | Removed from `HEAD` and replaced with four distinct per-device SOPS-encrypted values. Rotated and verified on the firewall, the UPS and the BMC: each answers to its own new community and refuses the old one. **Not rotated on the switch**, which has never answered an SNMP poll at all — so whether it still accepts the old community is unknown, not proven clean. **Still present in git history.** Treat the old string as public. | +| SNMP community committed in plaintext, shared across firewall, switch, UPS and BMC | Removed from `HEAD` and replaced with four distinct per-device SOPS-encrypted values. Rotated and verified on the firewall, the UPS and the BMC: each answers to its own new community and refuses the old one. **Not rotated on the switch**, which is not answering SNMP — so whether it still accepts the old community is unknown, not proven clean. **Still present in git history.** Treat the old string as public. | | Grafana `admin`/`admin` with anonymous Admin access enabled | Fixed — anonymous auth off, password from SOPS | | Passphrase-encrypted TLS private keys under `certificates/` | Removed from `HEAD`, still reachable in history. Purge tooling and a runbook are provided; not yet run. | The switch is the honest gap. `10.7.7.2` has returned `up == 0` for every scrape -in the 30-day retention window, which predates the rotation — the target has -never worked, so its failure is not evidence that the rotation broke anything, -and its silence is not evidence that the old community was removed. It is -reachable at layer 3 from the monitoring host on ICMP and TCP/80; only UDP/161 -fails. Tracked separately in [#22](https://github.com/Gerrrt/HomeLab/issues/22). +the monitoring stack has ever taken — all four SNMP series begin together when +the stack was rebuilt, so the failure predates the rotation and is not evidence +that the rotation broke anything. Nor is its silence evidence that the old +community was removed. It is reachable at layer 3 on ICMP and TCP/80; only +UDP/161 fails, which is the signature of a wedged SNMP agent rather than a dead +device. Tracked separately in +[#22](https://github.com/Gerrrt/HomeLab/issues/22). Remediation is tracked in [`docs/roadmap.md`](docs/roadmap.md), with procedures in [`docs/runbooks/rotate-snmp-community.md`](docs/runbooks/rotate-snmp-community.md) diff --git a/docs/roadmap.md b/docs/roadmap.md index f59e9fc..c2e0935 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -8,9 +8,9 @@ inventory. Ordered roughly by how much it matters. - [ ] **Finish the SNMP rotation on the MokerLink switch (`neo`, 10.7.7.2).** pfSense, the APC and iLO are done — each answers to its own new community and refuses the old one. The switch is not, and cannot be verified, - because it has never answered SNMP at all: `up{job="snmp"}` for - `10.7.7.2` has been `0` for the full 30-day retention window, so the - failure predates the rotation rather than being caused by it. Blocked on + because it is not answering SNMP: `up{job="snmp"}` for `10.7.7.2` has + been `0` for every scrape the current stack has taken, so the failure + predates the rotation rather than being caused by it. Blocked on [#22](https://github.com/Gerrrt/HomeLab/issues/22). → [runbook](runbooks/rotate-snmp-community.md) - [ ] **Purge `certificates/` and the old community string from git history**, diff --git a/docs/security.md b/docs/security.md index e24be13..7fea25d 100644 --- a/docs/security.md +++ b/docs/security.md @@ -82,8 +82,8 @@ packet. Two mitigations are in place, one only partly, and one is not: - **Done, with one exception:** each device has its own community, so one captured packet no longer grants read access to the whole fleet. Three are confirmed live on the hardware. The switch's exists only in SOPS — it has - never been proven on the device, because `10.7.7.2` has never answered a poll - ([#22](https://github.com/Gerrrt/HomeLab/issues/22)). + never been proven on the device, because `10.7.7.2` is not currently answering + polls ([#22](https://github.com/Gerrrt/HomeLab/issues/22)). - **Done:** SNMP is reachable only on the management VLAN and the switch-management LAN, neither of which anything but specific trusted hosts can enter.