Re: Reconfigure snmpd listening ports

--===============4207546494645082198==
Content-Type: multipart/alternative; boundary="0000000000008a2c9006228e8dda"

--0000000000008a2c9006228e8dda
Content-Type: text/plain; charset="UTF-8"

On Wed, 18 Sept 2024 at 14:35, Craig Small <[email protected]> wrote:
[...]

Hello,

Thank you lots for confirming what I already feared would be the case.

I like the idea of putting something in front of the SNMP daemon that will
manage ports opening and closing, I never thought of this, but when
thinking about it, it seems like a good solution. I guess that something
controlling iptables on the fly would do this well.

Thanks again,

Regards,

Teus Benschop




On Mon, 16 Sept 2024 at 22:44, Teus Benschop <[email protected]> wrote:
>
>> The daemon kept the same ports open as before editing the snmpd.conf even
>> in case some agentaddress entries were removed from snmpd.conf.
>>
> Some changes to the configuration file can be enabled with a reload or HUP
> and some things need a complete restart.
>
> Changing ports is one of those complete restart things.
>
> There might be many reasons for it, but one of them would be that binding
> to low ports needs root (or capabilities)
> but you can also change to a different user after binding the ports. Once
> you're non root, there's no going back
> so binding to ports could fail.
>
> Interestingly enough, that "snmpd restarted" message is in
> snmpd_reconfig(). Technically it's not restarting.
>
> The port bindings happen in init_master_agent() with the repeated calls in
> netsnmp_agent_listen_on()
> In theory you could do a bunch of nsap_unregisters then copy that do-while
> loop into snmpd_reconfig() but I think the end-result
> is something that sort of does what you want but breaks in new interesting
> random ways because I'm sure something somewhere
> in snmpd assumes the NSAPs (the sockets effectively) remain the same.
>
> If I needed to shift ports around dynamically, I'd approach it from
> restarting the daemon and saving the state somehow
> or do some funky DNAT/load balancer type thing that moved the ports for me
> and left snmpd alone.
>

--0000000000008a2c9006228e8dda
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"fon=
t-size:small">On Wed, 18 Sept 2024 at 14:35, Craig Small &lt;<a href=3D"mai=
lto:[email protected]">[email protected]</a>&gt; wrote:<br></div><div c=
lass=3D"gmail_default" style=3D"font-size:small">[...]</div><div class=3D"g=
mail_default" style=3D"font-size:small"><br></div><div class=3D"gmail_defau=
lt" style=3D"font-size:small">Hello,</div><div class=3D"gmail_default" styl=
e=3D"font-size:small"><br></div><div class=3D"gmail_default" style=3D"font-=
size:small">Thank you lots for confirming what I already feared would be th=
e case.</div><div class=3D"gmail_default" style=3D"font-size:small"><br></d=
iv><div class=3D"gmail_default" style=3D"font-size:small">I like the idea o=
f putting something in front of the SNMP daemon that will manage ports open=
ing and closing, I never thought of this, but when thinking about it, it se=
ems like=C2=A0a good solution. I guess that something controlling iptables =
on the fly would do this well.</div><div class=3D"gmail_default" style=3D"f=
ont-size:small"><br></div><div class=3D"gmail_default" style=3D"font-size:s=
mall">Thanks again,</div><div class=3D"gmail_default" style=3D"font-size:sm=
all"><br></div><div class=3D"gmail_default" style=3D"font-size:small">Regar=
ds,</div><div class=3D"gmail_default" style=3D"font-size:small"><br></div><=
div class=3D"gmail_default" style=3D"font-size:small">Teus Benschop</div><d=
iv class=3D"gmail_default" style=3D"font-size:small"><br></div><div class=
=3D"gmail_default" style=3D"font-size:small"><br></div><div class=3D"gmail_=
default" style=3D"font-size:small"><br></div><div class=3D"gmail_default" s=
tyle=3D"font-size:small"><br></div></div><div class=3D"gmail_quote"><blockq=
uote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-wi=
dth:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-=
left:1ex"><div dir=3D"auto"><div dir=3D"ltr"><div dir=3D"ltr">On Mon, 16 Se=
pt 2024 at 22:44, Teus Benschop &lt;<a href=3D"mailto:[email protected]=
m" rel=3D"noreferrer" target=3D"_blank">[email protected]</a>&gt; wrot=
e:</div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;=
border-left-color:rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">The d=
aemon kept the same ports open as before editing the snmpd.conf even in cas=
e some agentaddress entries were removed from snmpd.conf.</div></blockquote=
><div>Some changes to the configuration file can be enabled with a reload o=
r HUP and some things need a complete restart.</div><div><br></div><div>Cha=
nging ports is one of those complete restart things.</div><div><br></div><d=
iv>There might be many reasons for it, but one of them would be that bindin=
g to low ports needs root (or capabilities)</div><div>but you can also chan=
ge to a different user after binding the ports. Once you&#39;re non root, t=
here&#39;s no going back</div><div>so binding to ports could fail.<br></div=
><div><br></div><div>Interestingly enough, that &quot;snmpd restarted&quot;=
 message is in snmpd_reconfig(). Technically it&#39;s not restarting.</div>=
<div><br></div><div>The port bindings happen in init_master_agent() with th=
e repeated calls in netsnmp_agent_listen_on()</div><div>In theory you could=
 do a bunch of nsap_unregisters then copy that do-while loop into snmpd_rec=
onfig() but I think the end-result</div><div>is something that sort of does=
 what you want but breaks in new interesting random ways because I&#39;m su=
re something somewhere</div><div>in snmpd assumes the NSAPs (the sockets ef=
fectively) remain the same.</div><div><br></div><div>If I needed to shift p=
orts around dynamically, I&#39;d approach it from restarting the daemon and=
 saving the state somehow</div><div>or do some funky DNAT/load balancer typ=
e thing that moved the ports for me and left snmpd alone.</div></div></div>=
</div>
</blockquote></div></div>

--0000000000008a2c9006228e8dda--


--===============4207546494645082198==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============4207546494645082198==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Net-snmp-coders mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/net-snmp-coders

--===============4207546494645082198==--