Skip to content

Fix: os6: hide snmp-server community strings when remove_secret is set - #3870

Open
Jurgen1994 wants to merge 2 commits into
ytti:masterfrom
Jurgen1994:Jurgen1994-patch-1
Open

Fix: os6: hide snmp-server community strings when remove_secret is set#3870
Jurgen1994 wants to merge 2 commits into
ytti:masterfrom
Jurgen1994:Jurgen1994-patch-1

Conversation

@Jurgen1994

Copy link
Copy Markdown

Pre-Request Checklist

  • Passes rubocop code analysis (try rubocop --auto-correct)
  • Tests added or adapted (try rake test)
  • Changes are reflected in the documentation
  • User-visible changes appended to CHANGELOG.md

Description

With remove_secret: true, the os6 model (Dell EMC Networking OS6 / N-Series, e.g. N1548) only masks password <hash> lines in its secret filter. SNMP community strings pass through unmodified, so a line like

  snmp-server community "public" rw

is committed to the output repo in plaintext — and an rw community is effectively a write credential for the switch.

This adds one substitution to the existing cmd :secret block:

  cfg.gsub! /^(snmp-server community )\S+(.*)/, '\1<secret hidden>\2'

matching how powerconnect and procurve already treat snmp-server community lines.

Tested against a Dell N1548 running config:

  snmp-server community "public" rw
  → snmp-server community <secret hidden> rw

Non-secret lines are unaffected, and behavior is unchanged when remove_secret is not set (the :secret block doesn't run then).

The os6 secret filter only masked `password <hash>` lines; SNMP                                                                                                                                   
    community strings in `snmp-server community <string> ro|rw` were                                                                                                                                  
    committed to the output repo in plaintext even with remove_secret                                                                                                                                 
    enabled.
@Jurgen1994 Jurgen1994 changed the title Jurgen1994 patch 1 Fix: hide snmp community in os6 Jul 24, 2026
@Jurgen1994 Jurgen1994 changed the title Fix: hide snmp community in os6 Fix: os6: hide snmp-server community strings when remove_secret is set Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant