Re: Why do I have to start snmpd twice to get USM to work?

Mike Ayers wrote:
>> If I have a manually generated snmpd.conf but no 
>> automatically generated
>> snmpd.conf (with the modified usmUser records)
>>     
>
> 	I think you meann that you have an snmpd conf file (/usr/local/snmp/etc/snmpd.conf) but no persistent data file (/var/snmp/snmpd.conf).
>   
Yes.
>> when I start snmpd all
>> requests to the server that use USM authentication timeout. If I stop
>> snmpd & restart it without changing a thing the requests now complete
>> successfully. The only difference is that the second time around the
>> automatically generated snmpd.conf exists.
>>     
>
> 	How are you configuring your USM user?  Dollars to donuts you're putting createUser commands in the snmpd conf file instead of the persistent data file.
>
>   
Yes. I only had a snmpd.conf file, so I put my createUser commands there.
>> Is there a good reason for this, or is this a bug? (I think 
>> it's a bug,
>> but I'm really struggling to get my head around USM authentication).
>>     
>
> 	I suspect misconfiguration.  From the manual concerning createUser:
>
> [SNIP]
>               Instead of figuring out how to use this directive and  where  to
>               put   it   (see  below),  just  run  "net-snmp-config  --create-
>               snmpv3-user" instead, which will add one of these lines  to  the
>               right place.
> [/SNIP]
>   
This doesn't work for me in two ways, firstly it's much simpler for me
to provide simple configuration files rather than run a pontentially
complex series of commands, and secondly I want to be able to provide an
engineID which I don't think I can do through net-snmp-config. I had a
look at the code in net-snmp-config and all it does is generate
identical createUser entries in snmpd.conf and the persistent snmpd.conf
effectively identical to the ones I've created myself. I tried
replicating the createUser entries into the persistent snmpd.conf just
to see if it would work, but I get exactly the same results as before.

I also discovered something else that may shed some lighton this. My
createUser entries have engineIDs (specified with -e). If I remove the
engineIDs from the createUser entries and modify the snmpwalk command
accordingly, then the problem goes away. So there is only a problem if I
use engineIDs on the createUser entries.

thanks,

Anthony Wright.


------------------------------------------------------------------------------
Stay on top of everything new and different, both inside and 
around Java (TM) technology - register by April 22, and save
$200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco.
300 plus technical and hands-on sessions. Register today. 
Use priority code J9JMT32. http://p.sf.net/sfu/p
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users