Re: snmpusm and security of the initial user

On Thu, Oct 14, 2010 at 12:51 PM, Wes Hardaker
<[email protected]> wrote:
> That really means that in the agent in order to create a new SNMPv3/USM
> user you need to have an existing one to "clone" from.  It's a boot
> strapping issue mostly (you have to authenticate with something ("a
> user") in order to create a new one), but it's also because of the way
> keys are handled in the protocol: you never send a raw key to the
> server.  It's always based on a delta from a previous key (and this was
> done in part because it gets around some export restrictions that really
> don't matter as much that it's 10 years later).

Right. I understand that to create a user via snmpusm, one would
always need an "initial" user. I'm asking if there is a non-snmpusm
way to create the users. I know I can write "createUser" tokens into
snmpd.conf, but that would mean re-starting snmpd every time a user is
added. I'm trying to avoid the restart.

What I'm loosely looking for is something of a locally root-only
accessible socket (unix socket, may be) from where I can talk to snmpd
to create/delete users. This requirement arises because of the
password hard-coding issue described below.

> I'm not sure why you need to hard-code passwords in things so I can't
> answer that aspect for you.  Your description of your scenario isn't
> clear enough for me to understand what you want to accomplish.

I'm writing a CLI for creating SNMPv3 users. The way it works is that
the administrator logs into the CLI and creates SNMPv3 users. I don't
want the admin to enter a password for the "initial" user ever time he
attempts to create an SNMPv3 user. This means that I'll have to
hard-code the password for "initial" user into the CLI, so that it can
call snmpusm.

------------------------------------------------------------------------------
Download new Adobe(R) Flash(R) Builder(TM) 4
The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly 
Flex(R) Builder(TM)) enable the development of rich applications that run
across multiple browsers and platforms. Download your free trials today!
http://p.sf.net/sfu/adobe-dev2dev
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users