Re: Local MIB access - accessing MIB localy without UDP, and without authentication.

On Tue, 2006-01-03 at 17:05 +0200, Makavy, Erez (Erez) wrote:
> I'd like to know if and how it is possible to use net-snmp for
> retrieving MIB variable values, without actually sending a UDP packet,

Yes.  Use a 'callback' transport.

Usually the "netsnmp_pdu" data structure will be converted into a
BER-encoded packet, sent over the network, and then re-parsed back
into a PDU data structure.  The callback transport takes this data
structure and processes it directly, without encoding/decoding it.
 
> and without the overhead of USM/VACM authentication and authorization.

No.  These access checks are applied regardless.  I don't think
there's any way to avoid them.


> 1) It doesn't seems like 'netsnmp_query_get' does that, or does it?
> 	1a) I see that 'netsnmp_query_get' eventually uses
> 'snmp_synch_response_cb',
> 	     Does that send an SNMP request (via UDP packet) to the peer
> mentioned in the given session?

Not necessarily.
It sends an SNMP request over the specified session - true.
But that won't involve a UDP packet *unless* the session is a
UDP-based session.  If this is a callback-based session (which
is the usual approach), then the PDU will be processed directly.



> 2) can I pass some parameter in session, which indicates to bypass the
> whole USM, VACM verification process?

No.  See above.

>     (accept from defining and using a user which needs not
> authentication , and has a full view)

That would be the way to do it.



> 3) If I must use a user, can I restrict the peer names (IP address) who
> can use that user?

No - SNMPv3 doesn't take account of source addresses.
SNMPv1 and SNMPv2c can be configured to do so, but not SNMPv3.

You can use /etc/hosts.allow (and the libwrap mechanisms) to
restrict which systems can contact the agent, but this will
be applied globally - not for a particular SNMPv3 user.

Dave


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users