RE: access control

Hi Mike, 
Thanks for putting your time to this.

The whole idea in our implementation is to use both default context for the
standard MIBS which we are supporting and also new context which will be
used to add our interface MIBS to the standard MIBs without any modification
of net-snmp. Where can I find the default configuration which will be used
for snmpv3? 
We want to have support for both view-based and user-based implementation.
Can we put the configurations for both of them in the same config file? Is
it snmp itself which create the other read only config file, or should we
also create that? If net-snmp  is creating it, where does it put this file
and is the name of the file same as the writeable config file? If we should
create it; then where should we placed the file and what name should we use
for this file? Can both of them have same name? (snmpd.conf).

If we have following configuration in a file called snmpd.conf for our
view-based case and use the flag -c to use it as our configuration file and
use flag -C to not use the default configuration, should it work the?


com2sec local     localhost       secret42
com2sec custom_sec 192.168.1.0/24  public

group custom_grp v1         custom_sec
group custom_grp v2c        custom_sec
group incremental usm       myuser      # SNMPv3 username == sec.name

view all    included  .1
view custom_v excluded  .1
view custom_v included  sysUpTime.0
view custom_v included  interfaces.ifTable

view mini_view excluded .1 80
view mini_view included  sysUpTime.0

view if_view excluded .1 80
view if_view included  sysUpTime.0
view if_view included  ifTable


access MyRWGroup ""      any       noauth    exact  all      all    none
access custom_grp ""     any       noauth    exact  custom_v  none   none

access incremental ""    usm       noauth    exact  mini_view none  none
access incremental ""    usm       auth      exact  if_view   none  none
access incremental ""    usm       priv      exact  all_view  none  none

would this work? Or are we missing something?

And how should it looks like when we want to add support for user-based
case:(should we just add following lines?

 rocommunity COMMUNITY SOURCE -V VIEW
 rwcommunity COMMUNITY SOURCE -V VIEW
 rocommunity6 COMMUNITY SOURCE -V VIEW
 rwcommunity6 COMMUNITY SOURCE -V VIEW

 rouser USER noauth|auth|priv -V NAME
 rwuser USER noauth|auth|priv -V NAME


Thanks again.

/Masoud

-----Original Message-----
From: Mike Ayers [mailto:[email protected]] 
Sent: den 20 februari 2008 00:54
To: [email protected]; [email protected];
[email protected]
Subject: RE: access control


> From: Masoud Fatollahy [mailto:[email protected]] 
> Sent: Tuesday, February 19, 2008 1:09 PM


>> From: [email protected]
>> [mailto:[email protected]] On 
>> Behalf Of Mike Ayers
>> Sent: den 19 februari 2008 21:37

>> > From: [email protected] 
>> > [mailto:[email protected]] On 
>> > Behalf Of Masoud Fatollahy
>> > Sent: Friday, February 15, 2008 2:14 PM

>> > Now when we are 
>> > trying to use
>> > snmpv3 context, we have problem with access control 
>> > configuration files.
>> 
>> 	What problem?  Specifics, please.
> [m] the problem is when we are using a mib-browser to fetch data from
> snmp-agent with username without any password or with defined 
> password we
> never get it work.
> and we don't really know which snmpd.conf is used, when we 
> are not doing
> make install. Or where we should put our snmpd.conf 

	A couple of issues:

	(1)  Please explain "snmpv3 context" - are you trying to use a
non-default context?

	(2)  If possible, please use net-snmp's snmpgetnext command as
opposed to a MIB browser or other tool when bringing up the agent.  This way
you are not trying to solve browser issues by changing the agent
configuration.  Also, you can post the command and its output here and we
will have a good chance of spooting the problem.

> [m] we are planning to include the configuration of snmp to 
> our cli, and
> from there can generate a config file for snmp. Is it the 
> right way to go?

	Right? <shrug>  It's not a bad idea, though, and you should be able
to get it to do pretty much what you want.

>> > If so, 
>> > where can we set
>> > the path to our snmpd.conf and snmp.conf.
>> 
>> 	By default, $sysconfdir ($prefix/etc), but you can use 
>> -C/-c flags
>> to access them anywhere.  Don't forget 
>> $localstatedir/snmpd.conf, which is
>> where you would put your createUser statements.
> 
> [m] we have used -C and -c flags and just put a user nothing 
> more, but we
> found out that net-snmp is using two two different files in 
> two different
> locations, one is used to define the users and another to put 
> the password
> and etc. is this currect? why?

	This is correct.  There is a read-only snmpd.conf, in which most of
the configuration directives will be put, and a "persistent", or writable,
snmpd.conf, in which you will put the user creation directives, which will
disappear and be replaced by similar looking lines which contain the
generated key.  This allows you to do keychanges, since the user is stored
ina writable file.

> [m] yes, I understand, but it is very nice to have a working 
> example which
> everyone can use test their implementation of mibs and mibs 
> access, in this
> way we can understand the concept. Do have any working 
> example for this? 

	None that I know of.  I'll try to get something posted if/when I
can, but my current project is trying to get a fully working config on
cygwin, and I'm getting my butt handed to me in the perl department.


	HTH,

Mike



-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users