Repository navigation
Rotate neo's current SNMP community, now that the overwrite route exists #232
Description
SECURITY.md records that the MokerLink SNMP community turned up in a local
Claude Code session transcript on 2026-08-20, and that it was deliberately not
rotated:
The switch community deliberately was not: rotating it means the
neo
residual above all over again.
That justification was correct at the time. Rotating neo would have added a
second stuck community row, because its firmware will not persist a deletion.
#231 removes the blocker: the
runbook now carries an overwrite-in-place route for this switch
(§2.5),
so a row can be retired without deleting it.
Why this is lower priority than #84
Deliberately filed separately rather than folded into #84, because the two
exposures are not comparable:
- Retire the MokerLink switch's previous SNMP community #84 is the previous community — the shared string that was committed to
a public repository. It must be treated as public. - This one was found in a local transcript under
~/.claude/projects/,
mode 600, redacted in place, never committed and never synced off the host.
When to do it
The same window as #84, and only after #84's overwrite has been proven to
persist across a reboot. If the technique does not work, this issue goes away
again with it.
Sequenced after #84, this becomes: overwrite the second row with a fresh value,
set SNMP_COMMUNITY_MOKERLINK in SOPS, make render && make reload, then
./scripts/snmp-verify.sh --device neo and --old. Unlike #84, this one does
touch the repository and does have a window where monitoring is wrong, which is
another reason not to bundle it.
Activity
Gerrrt commentedon Sep 1, 2026
Duplicate of #84 — closing, and folding the substance back into it rather than losing it.
The distinction this issue drew: #84 is
neo's previous community, the shared string that was committed to a public repository. This one was the current community, found 2026-08-20 in a local Claude Code transcript under~/.claude/projects/, mode 600, redacted in place, never committed and never synced off the host.SECURITY.mddeliberately left it unrotated because rotating it would have added a second stuck community row.Treating both as #84 means #84's window covers both rows on the switch, in this order:
neoanswers exactly one string and nothing in the repo changes.SNMP_COMMUNITY_MOKERLINKin SOPS, thenmake render && make reload.Step 2 is the part that was filed here. It is strictly lower priority than step 1 — a 600-mode local file is not a public repository — and unlike step 1 it touches the repository and has a window where monitoring is wrong. If the overwrite turns out not to persist, step 2 goes away with it.
The procedure for both is §2.5's MokerLink route, added in #231.