Re: about rouser internal ?

On 21/09/06, Leo Lei <[email protected]> wrote:
>         rwcommunity     nssrw

> i can snmpwak the snmpUsmMIB and snmpVacmMIB using the following command:
>         snmpwalk -v 2c -c nssrw localhost snmpUsmMIB

That's because of the the "rwcommunity" directive above.



>         createUser      nssro   MD5     authpass
>         view   myiso   included        .1
>         group  mygrp   usm     private

Where did "private" come from?

>         access mygrp   ""      usm     auth    prefix  myiso   myiso   myiso

> # snmpwalk -v 3 -u nssro -l authNoPriv -a MD5 -A authpass localhost snmpUsmMIB
> Error in packet.
> Reason: authorizationError (access denied to that object)

Because you haven't defined the user "nssro" as part of the group "mygrp".
You've included a (non-existent?) user "private", but not "nssro"


> and other questions:
>         com2sec is necessary for SNMPv3 VACM configuration?

No.  Not for SNMPv3 requests.
This directive is only relevant to SNMPv1 and SNMPv2c access control.


>         why use COMMUNITY in the com2sec directive? it means that:
>                 for     security model v1/v2c,  community string;

should be mapped into a particular security name - which is then used
for the VACM checks.


>                 for security model usm, SNMPv3 user
>         right ?

com2sec has *nothing* to do with USM.  It's purely concerned with
community-based requests.  (Hence the name - "com" means "community").
SNMPv3/USM is a completely different administrative structure.

Both SNMPv1/2c and SNMPv3/USM map the local admin information into a
security name
(SNMPv1/2c via com2sec, and SNMPv3/USM via the identity mapping on the
username).
It's this security name that is then used in the group/access configuration.

Dave

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users