Re: 5.4.2.1: IP address filtering for SNMPv3

ok, thank you.
-pete

Dave Shield <[email protected]> wrote on 03/19/2011 06:06:03 AM:

> On 19 March 2011 02:11, Bill Fenner <[email protected]> wrote:
> >> Is it possible to configure Net-SNMP 5.4.2.1 to filter IP address(es) 
when
> >> using SNMPv3 the way com2sec directive does it for SNMPv1/2c ?
> >
> > No.  I think the assumption is that you need to be able to limit v1/2c
> > because of the weakness of the community string, and there is no need 
to
> > limit access using v3 because of its strength.
> > I don't think it's an unreasonable feature request, though.
> 
> 
> Two comments:
>    -  the IP filtering of community-based SNMP is actually a
> by-product of the non-standard way that we handle community-to-group
> mapping.   The official mechanism (SNMP-COMMNITY-MIB) doesn't include
> this element, which is one of the reason's we've never really
> supported this MIB.
>    We didn't need to define our own v3user-to-group mapping, as we
> used the SNMPv3 mechanism right from the start.   Which is why there's
> no equivalent source-based filtering for such requests.
> 
> 
>   -  there *is* a source-filter mechanism available via the TCP
> wrappers functionality.  So you can restrict access to solely from
> known addresses  (or block known problem hosts), via
> /etc/hosts.{allow,deny}.   And of course, local firewalls can do
> something similar.   But all of this works on an all-or-nothing basis.
>  It's not possible to restrict certain SNMPv3 users to come from
> selected addresses, and allow other SNMPv3 users more widely.
> 
> Dave
> 
> 
------------------------------------------------------------------------------
> Colocation vs. Managed Hosting
> A question and answer guide to determining the best fit
> for your organization - today and in the future.
> http://p.sf.net/sfu/internap-sfd2d
> _______________________________________________
> Net-snmp-users mailing list
> [email protected]
> Please see the following page to unsubscribe or change other options:
> https://lists.sourceforge.net/lists/listinfo/net-snmp-users
> 
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> ______________________________________________________________________

------------------------------------------------------------------------------
Enable your software for Intel(R) Active Management Technology to meet the
growing manageability and security demands of your customers. Businesses
are taking advantage of Intel(R) vPro (TM) technology - will your software 
be a part of the solution? Download the Intel(R) Manageability Checker 
today! http://p.sf.net/sfu/intel-dev2devmar

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users