Re: snmpusm and security of the initial user

On Thu, Oct 14, 2010 at 4:46 PM, slowpoison <[email protected]>wrote:

> On Thu, Oct 14, 2010 at 12:51 PM, Wes Hardaker
> <[email protected]> wrote:
> > That really means that in the agent in order to create a new SNMPv3/USM
> > user you need to have an existing one to "clone" from.  It's a boot
> > strapping issue mostly (you have to authenticate with something ("a
> > user") in order to create a new one), but it's also because of the way
> > keys are handled in the protocol: you never send a raw key to the
> > server.  It's always based on a delta from a previous key (and this was
> > done in part because it gets around some export restrictions that really
> > don't matter as much that it's 10 years later).
>
> Right. I understand that to create a user via snmpusm, one would
> always need an "initial" user. I'm asking if there is a non-snmpusm
> way to create the users. I know I can write "createUser" tokens into
> snmpd.conf, but that would mean re-starting snmpd every time a user is
> added. I'm trying to avoid the restart.
>
> What I'm loosely looking for is something of a locally root-only
> accessible socket (unix socket, may be) from where I can talk to snmpd
> to create/delete users. This requirement arises because of the
> password hard-coding issue described below.
>
> > I'm not sure why you need to hard-code passwords in things so I can't
> > answer that aspect for you.  Your description of your scenario isn't
> > clear enough for me to understand what you want to accomplish.
>
> I'm writing a CLI for creating SNMPv3 users. The way it works is that
> the administrator logs into the CLI and creates SNMPv3 users. I don't
> want the admin to enter a password for the "initial" user ever time he
> attempts to create an SNMPv3 user. This means that I'll have to
> hard-code the password for "initial" user into the CLI, so that it can
> call snmpusm.
>
>
I think there may be something missing from your perspective on "initial
user".  Yes, use a CLI to create an "initial user".  That's what I've done
as well....now you can add an additional user via SNMPv3 message exchanges
using the "initial user" as a "clone from".  and __now__ you can delete the
"initial user" via SNMPv3 message exchanges using the "additional user" to
authenticate and encrypt your message exchanges.

With the above approach, you have an initial user just to bootstrap your
first additional user...now the initial user can be deleted and subsequent
users can be added via SNMPv3 message exchanges using the first additional
user as the "clone from" and to authenticate and encrypt your message
exchanges.

You really just need some known SNMPv3 principal (user) configured at any
given time in order to add another one.  If you want, you can change this
user each month, week, or day by adding a new user and then deleting the old
user.

Hopefully, this provides an insight that helps resolve this issue?

Regards,

Mark
http://EllisonSoftware.com

------------------------------------------------------------------------------
Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store 
http://p.sf.net/sfu/nokia-dev2dev

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users