RE: SNMPv3 UCD and router (CISCO)

Hmm. Thanks this confirms at least some things for me. However, the way
I understood it EngineID is of the authoritative end which is the system
that does Get for my purposes ie. Not the router but the client? Am I
wrong? Are you saying engineID is not set but rather is something that
is figured by both UCD library for me and the router on the other end?
The only user settings are the algorithm used, USER and passphrases? To
clarify all this lets say I am writing a UI for an API that will
internally use UCD SNMP to do a GET against CISCO router. 
On router 2 passphrases are set for AUTH and PRIV. Methods are SET. USER
is set
On the app UI must provide entry fields for user, passphrases, and of
course method and the OID it needs. Everything else would be
done/generated for me by the UCD library and router SNMP agent.
Thanks

-----Original Message-----
From: Dave Shield [mailto:[email protected]] 
Sent: Monday, October 10, 2005 5:40 AM
To: Kostia Grebelsky
Cc: [email protected]
Subject: Re: SNMPv3 UCD and router (CISCO)


On Fri, 2005-10-07 at 13:29 -0400, Kostia Grebelsky wrote:

> The way I understand things the keys for authentication and privacy 
> both need to be set up on the router (they may be generated by the 
> router not sure), but they also need to be set in the code  to both 
> session.securityAuthKey and session.securityPrivKey could be assigned 
> keys that would be the same as on the router?

Yes.
The same key is required at both ends, so that the two processes can
communicate successfully.  (SNMP uses a single-key system, rather than
the more flexible, but higher-overhead public/private mechanism).

> Or do these get generated based on the passphrases passed in to 
> generate_KU?

Yes.
That's how the keys are typically generated.
Or strictly (as you've spotted) from a combination of the pass phrase
and the authoritative Engine ID.

>  but then how is CISCO router supposed to decrypt it?

The router generates the same key from the same pass phrase and
authoritative Engine ID.


>  However CISCO documentation suggests "The security keys used for 
> authenticating and encrypting SNMPv3 packets are generated as a 
> function of the authoritative SNMP engine's engine ID and user 
> passwords."

Yup.

> DO I understand this correctly that UCD library will generate 
> msgAuthoritativeEngineID for me?

It will *discover* the authoritative engine ID for you.
(It's actually the engine ID of the router, in most cases).

>  So at the end of the day the only things that I should care about as 
> paramters to UCD APIs are keys, and user name as well as the target 
> and things I am inquiring about?

What you need to be concerned with is the username  (which specifies the
authenication and encryption algorithms to use), and the pass phrases.
You should never need to use the localised keys directly.

Dave


-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users