[Info-vax] Temperature information via OpenVMS

[Stephen Hoffman]

On 2018-05-08 12:02:58 +0000, Jairo Alves said:

> I'm able to retrieve Temperature from rx2660 using two different methods.
> 
> 1 - Install HP SMH software and query temperature from SNMP on oid 
> 1.3.6.1.4.1.232.6.2.6.8.1.4.3.3
> 
> 2 - Enable IPMI protocol on iLO and query temperature from sensor id 2880

Both of which are known to be insecure on OpenVMS.  SMH on OpenVMS — 
which is the source of SNMP MIBs for OpenVMS  — has had numerous 
security flaws that have been patched on Linux and Windows, and one or 
two of which I've been able to replicate on OpenVMS when exploits were 
available, and the SMNP implementation is SNMPv2 which is insecure.  
The iLO IPMI service can be queried for hashed passwords, and the hash 
uses a format that can be easily brute-forced.   Isolate these 
services, if planning to use them.


-- 
Pure Personal Opinion | HoffmanLabs LLC