RE: SNMP-COMMUNITY-MIB security question

#1 (**permalink**) 04-21-2008

This is a multi-part message in MIME format.

--===============0394796993==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C8A3CE.2502B0A4"

This is a multi-part message in MIME format.

------_=_NextPart_001_01C8A3CE.2502B0A4
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

Dave,

=20

After I added a view to exclude snmpCommunitTable, read-only community
"public" cannot populate any object even sysUpTime.=20

=20

Here is the snmpd.conf access control lines:

=20

com2sec SecNameAllRO default public

group GroupAllRO v2c SecNameAllRO

view ViewRO excluded .1.3.6.1.6.3.18.1.1 =20

access GroupAllRO "" any noauth exact ViewRO none none

=20

Did I miss anything for ViewRO? I wonder do I need to include .1 and
then exclude .1.3.6.1.6.3.18.1.1? What the mask value should be for
ViewRO?

=20

Thanks

Emi

=20

-----Original Message-----
From: dave.shield@googlemail.com [mailto:dave.shield@googlemail.com] On
Behalf Of Dave Shield
Sent: Friday, April 18, 2008 4:56 PM
To: Emi Yanagi
Cc: net-snmp-coders@lists.sourceforge.net
Subject: Re: SNMP-COMMUNITY-MIB security question

=20

On 18/04/2008, Emi Yanagi <Emi.Yanagi@radisys.com> wrote:

> What data structure(s) or field(s) I should look into?

> Or are you talking about snmpd.conf configuration?

=20

Yes - I'm talking about the snmpd.conf access control settings.

=20

Define a view that excludes the snmpCommunityTable.

Then configure "public" to have access to this view.

=20

See snmpd.conf(5) or the relevant FAQ entry for details

about how to configure access control.

=20

Alternatively, use an agent that doesn't implement this table.

Like (for example), the standard Net-SNMP agent :-)

=20

Dave

------_=_NextPart_001_01C8A3CE.2502B0A4
Content-Type: text/html;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

Dave,<o:p></o:p>

<o:p> </o:p>

After I added a view to exclude snmpCommunitTable, read-only =
community
"public" cannot populate any object even sysUpTime. =
<o:p></o:p>

<o:p> </o:p>

Here is the snmpd.conf access control =
lines:<o:p></o:p>

<o:p> </o:p>

com2sec       &nb=
sp;
SecNameAllRO    default  =
public<o:p></o:p>

group GroupAllRO   
v2c        =
SecNameAllRO<o:p></o:p>

view ViewRO     =
excluded 
..1.3.6.1.6.3.18.1.1          =
    
<o:p></o:p>

access GroupAllRO    =
""  
any   noauth exact ViewRO none =
none<o:p></o:p>

<o:p> </o:p>

Did I miss anything for ViewRO? I wonder do I need to include .1 =
and
then exclude .1.3.6.1.6.3.18.1.1? What the mask value should be for =
ViewRO?<o:p></o:p>

<o:p> </o:p>

Thanks<o:p></o:p>

Emi<o:p></o:p>

<o:p> </o:p>

-----Original Message----- 
From: dave.shield@googlemail.com [mailto:dave.shield@googlemail.com] On =
Behalf
Of Dave Shield 
Sent: Friday, April 18, 2008 4:56 PM 
To: Emi Yanagi 
Cc: net-snmp-coders@lists.sourceforge.net 
Subject: Re: SNMP-COMMUNITY-MIB security question

<o:p> </o:p>

On 18/04/2008, Emi Yanagi <Emi.Yanagi@radisys.com> =
wrote:<o:p></o:p>

>  What data structure(s) or field(s) I should look =
into?<o:p></o:p>

>  Or are you talking about snmpd.conf =
configuration?<o:p></o:p>

<o:p> </o:p>

Yes - I'm talking about the snmpd.conf access control =
settings.<o:p></o:p>

<o:p> </o:p>

Define a view that excludes the =
snmpCommunityTable.<o:p></o:p>

Then configure "public" to have access to this =
view.<o:p></o:p>

<o:p> </o:p>

See snmpd.conf(5) or the relevant FAQ entry for =
details<o:p></o:p>

about how to configure access =
control.<o:p></o:p>

<o:p> </o:p>

Alternatively, use an agent that doesn't implement this =
table.<o:p></o:p>

Like (for example), the standard Net-SNMP agent =
:-)<o:p></o:p>

<o:p> </o:p>

Dave<o:p></o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C8A3CE.2502B0A4--

--===============0394796993==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
--===============0394796993==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Net-snmp-coders mailing list
Net-snmp-coders@lists.sourceforge.net
https://lists.sourceforge.net/lists/...et-snmp-coders

--===============0394796993==--

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode