Re: FW: How can I bypass USM+VACM?

Wes Hardaker <[email protected]>
Newsgroups gmane.network.net-snmp.user
Organization Sparta
Message-ID <[email protected]>
>>>>> On Tue, 25 Apr 2006 14:21:43 +0300, "Makavy, Erez (Erez)" <[email protected]> said:

Erez> I got a master agent running on my system.  I got also an SNMP
Erez> client running on the same system (different process), and I'd
Erez> like the client to be able to query the master agent without USM
Erez> authentication or VACM authorization limitations.  The reason
Erez> is, that the client performance should be independent of the USM
Erez> and VACM tables which may be changed.

To get by USM, use SNMPv2c instead ;-)

There is no way to get by the VACM checks though (by design).
 
Erez> I guess I just need to find the function that calls the USM
Erez> authentication and the VACM authorization, and make it return possitive
Erez> permission when the PDU's IP is a local one (127.0.0.1).
Erez> Which are these functions?

The VACM actually registers a function to check permissions for an
incoming OID.  however, if another ACM model is going to be added to
the list they both must check out, so you can't do what you're talking
about.
 
Erez> I recall that net-snmp 5.3 has some kind of local security module,
Erez> what's that all aobut?

That allows a transport (say one based on ssh which already has
authentication built in) to tell the SNMP stack "trust me; this really
is coming from user 'bob'".  The results of that passed information
are then trusted without doing any authentication checks (assuming it
came over a trusted transport).  However, the VACM is still called on
the results to make sure the local security identity still has access
to the objects they're requesting to twiddle.
-- 
Wes Hardaker
Sparta, Inc.


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.