RE: Using /etc/hosts.deny and /etc/hosts.allow

Thank you,

Our situation is different.
1. If we don't have any entries in either /etc/hosts.deny or
/etc/hosts.allow everything works fine.
2. If /etc/hosts.deny has "snmpd:ALL", and /etc/hosts.allow has no
entries there is no response to any query.
3. If /etc/hosts.deny has "snmpd:ALL", and /etc/hosts.allow has
"snmpd:ALL" everything works fine.
4. If /etc/hosts.deny has "snmpd:ALL", and /etc/hosts.allow has
"snmpd:192.168.121.133" query on sysUpTime (and any other MIB-II) works
fine but query on our Enterprise MIB doesn't even hit the agentX
subagent that handles this request. 'snmpd.log' does say "Sending 256
bytes to Local IPC:" just as before but I don't see the "Received 172
bytes from Local IPC: /var/agentx/master" in this case.
"192.168.121.133" is the IP Address of the SNMP Manager that makes
queries.

We are using net-snmp-5.1.2. I noticed that net-snmp-5.1.3 is doing the
following in snmp_agent.c and the one in net-snmp-5.1.2 doesn't
(checking if it's a callback function):

#ifdef  USE_LIBWRAP
    if (addr_string != NULL) {
      if ( strncmp(addr_string, "callback", 8) != 0 ) {
.......

I was thinking may be this is the fix for the problem I am seeing but I
don't know what all I need to fix to make it work. I did see some
postings in the archive that mentioned about the patch but couldn't see
where to get the patch.

Regards,

Kalyan

-----Original Message-----
From: [email protected] [mailto:[email protected]] On
Behalf Of Dave Shield
Sent: Wednesday, May 02, 2007 5:36 PM
To: Kalyan Kumar
Cc: [email protected]
Subject: Re: Using /etc/hosts.deny and /etc/hosts.allow

On 01/05/07, Kalyan Kumar <[email protected]> wrote:
>                                We would
> like to use /etc/hosts.deny and /etc/hosts.allow for access control.
This
> access control DOES work when the query is made on standard MIBs (say,
> RFC1213 'sysDescr') but doesn't work when the query is made on
enterprise
> MIBs.

I doubt this is due to hosts.{allow,deny}
These files are purely concerned with where requests are coming from.
They do not look at the content of a particular request, so cannot
distinguish between standard and enterprise OIDs.

It's much more likely that you've got some access control settings
in the snmpd.conf file, which are blocking access to the enterprise
subtrees.

Have a look at the FAQ entry
     I can see the system group, but nothing else. Why?
         (http://www.net-snmp.org/wiki/index.php/FAQ:Applications_05)

Dave

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users