Re: Integrating net-SNMP agent into my application

Yes, that did it. But there are still some lingering security concerns:

1) Default agentx configuration (master agentx) is TCP:705 from anywhere. 
This is not the default Unix socket as told in th man pages. It should be 
restricted in the configuration and not let as is.
2) Permissions can be restricted to localhost only. That is good, but still 
any local user can hijack root snmp sessions (application, server, etc.). 
Permissions on the unix socket affect the permissions on the file itself, 
i.e. noone can inject snmp commands from the file system, which is a good 
thing. Still any local user can use a subagent and without any 
authentication can exploit the whole snmp server tree.

Unfortunately sockets, unix or TCP, do not support permissions in their 
protocol. Propably a good thing since they run on transport layer 4 and any 
aaa is layer 7. I still feel strongly that authentication should be 
implemented at the agentx client, encrypted for snmp v3, and with a very 
short timeout, as applicable to applications.

Many thanx,
Nikos
----- Original Message ----- 
From: "Vincent Bernat" <[email protected]>
To: <[email protected]>
Sent: Sunday, January 04, 2009 1:59 PM
Subject: Re: Integrating net-SNMP agent into my application


> OoO Pendant le temps de midi du dimanche 04 janvier 2009, vers 12:58, je
> disais:
>
>> Since   you  are   on  Unix,   unix   socket  should   be  the   default
>> (/var/agentx/master).  With just "master  agentx" in  your configuration
>> file, don't you  get a socket at /var/agentx/master? If  not, do you run
>> snmpd with "-x" option?
>
> Otherwise, the problem may be because /var/agentx does not exist. Create 
> it.
> -- 
> Make sure your code "does nothing" gracefully.
>            - The Elements of Programming Style (Kernighan & Plauger)
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Net-snmp-users mailing list
> [email protected]
> Please see the following page to unsubscribe or change other options:
> https://lists.sourceforge.net/lists/listinfo/net-snmp-users 


------------------------------------------------------------------------------
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users