Re: Netsnmpv5.8 possible security flaw
Robert Story <[email protected]>
| Newsgroups | gmane.network.net-snmp.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi Madhusudhana, Did you go back and confirm Wes' theory? Did you see an authPriv request which failed, followed by and auth request that succeeded? Robert On Wed, 9 Jan 2019 04:19:28 +0000 Madhusudhana wrote: MR> Thanks Wes. MR> MR> -----Original Message----- MR> From: Wes Hardaker [mailto:[email protected]] MR> Sent: Tuesday, January 08, 2019 10:08 PM MR> MR> Madhusudhana R <[email protected]> writes: MR> MR> > Can you please let me know whether this feature is added MR> > newly in v5.8 or it was an existing feature in v5.7.3 ? MR> > If it is a new feature in v5.8, is there a way to toggle some MR> > MACRO value to make sure an user with authpriv protocol will MR> > always responds in encrypted way? MR> MR> It's not new at all; that behavior has been around since the MR> creation of the SNMPv3 code within Net-SNMP (which at the time MR> was called UCD-SNMP, showing how old this concept is). At the MR> time, encryption wasn't even possible for everyone deploying MR> the code (and the only encryption supported was DES). The MR> world tended to also believe that authentication (ensuring MR> packets weren't modified) was a "must have" but encryption was MR> merely a "would be nice if you could, but it's not critical".