Re: sending V3 traps with trapsess

On 09/04/2008, Josh Bers <jbers@bbn.com> wrote:
> I am concerned that there is a security risk involved with adding such
> trapsess commands into the world readable /etc/snmp/snmpd.conf file. Is
> there a way to suppress the printing of the passwords in this file

The "snmpcmd(1)" man page implies that you should be able to
use the -3[mMkK] options to set hex keys instead of text-based
passwords.
I haven't tried this, but it should work with trapsess as well.
And particularly with localized keys, the hex value will be
of no use whatsoever on another system.

> or to include it in the /var/net-snmp location instead...

Ummm... pass.
That would certainly work, but I'm not sure what would happen
when you stop/restart the agent.

Suck it and see.


> or should we just make
> the /etc/snmp/snmpd.conf readable only by root?

That's probably the simplest approach!

Dave

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
_______________________________________________
Net-snmp-users mailing list
Net-snmp-users@lists.sourceforge.net
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/...net-snmp-users