Dell Remote Access : Security warning

Dell.iDRAC7.SNMPTrap.2386 (Rule)

Knowledge Base article:

Summary

Security warning

Causes

Cause	Resolution
The default username and password is currently in use and unauthorized access to the iDRAC may occur because the default values are widely known. This is a severe security risk.	To change the credentials using RACADM command, run the following at the command line interface (CLI): "racadm set iDRAC.Users.<index> .Password <new password="" string="">". Alternately, to disable the default credential in use message, run "racadm config -g cfgractuning -o cfgRacTuneDefCredentialWarningEnable 0".

Resolutions

Additional information on this issue may be available. Launch the IDRAC/DRAC Console to debug further.

Element properties:

Target

Dell.RemoteAccess.iDRAC7

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

Dell Remote Access : Security warning

Event Description: {0}

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	System.NetworkManagement.SnmpTrapEventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Dell.iDRAC7.SNMPTrap.2386" Enabled="true" Target="DAD!Dell.RemoteAccess.iDRAC7" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>AvailabilityHealth</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Node!System.NetworkManagement.SnmpTrapEventProvider">

      <IP>$Target/Property[Type="DAD!Dell.RemoteAccess.RAC"]/IPAddress$</IP>

      <OIDProps>

        <OIDProp>.1.3.6.1.4.1.674.10892.5.3.2.1.0.2386</OIDProp>

      </OIDProps>

      <EventOriginId>$Target/Id$</EventOriginId>

      <PublisherId>$Target/Id$</PublisherId>

      <PublisherName>iDRAC</PublisherName>

      <Channel>SnmpEvent</Channel>

      <LoggingComputer/>

      <EventNumber>2386</EventNumber>

      <EventCategory>5</EventCategory>

      <EventLevel>10</EventLevel>

      <UserName/>

      <Params/>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Dell.iDRAC7.SNMPTrap.2386.Rule"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[4]/Value$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/Channel$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventCategory$</SuppressionValue>

        <SuppressionValue>$Data/EventLevel$</SuppressionValue>

        <SuppressionValue>$Data/UserName$</SuppressionValue>

        <SuppressionValue>$Data/EventNumber$</SuppressionValue>

        <SuppressionValue>$Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[3]/Value$</SuppressionValue>

        <SuppressionValue>$Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[4]/Value$</SuppressionValue>

        <SuppressionValue>$Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[6]/Value$</SuppressionValue>

        <SuppressionValue>$Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[8]/Value$</SuppressionValue>

      </Suppression>

      <Custom1>Alert Message ID = $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[3]/Value$ </Custom1>

      <Custom2>Alert Message = $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[4]/Value$ </Custom2>

      <Custom3>Alert Status = $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[5]/Value$ </Custom3>

      <Custom4>Alert Service Tag = $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[6]/Value$ </Custom4>

      <Custom5>Alert FQDN = $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[7]/Value$ </Custom5>

      <Custom6>Alert FQDD = $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[8]/Value$ </Custom6>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>