RE: Limiting ip addresses which have access to SNMP agent

Okay, as I thought. /etc/hosts isn't going to help because it's for an embedded product.

Thanks (again) Dave. 

Adam.
> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of Dave Shield
> Sent: Tuesday, April 12, 2011 5:21 PM
> To: Lewis Adam-VNQM87
> Cc: [email protected]
> Subject: Re: Limiting ip addresses which have access to SNMP agent
> 
> On 12 April 2011 16:57, Lewis Adam-VNQM87 
> <[email protected]> wrote:
> >  does anyone know if there is a standard MIB which allows you to 
> > configure the list of IP addresses which have access to an agent?
> 
> No.
> 
> That's probably the major difference between the Net-SNMP  
> "com2sec" token, and the official COMMUNITY-MIB framework, 
> for SNMPv1/v2c
> SNMPv3 has no mechanism for limiting queries by address.
> 
> This is normally handled by /etc/hosts.{allow,deny}
> 
> You could look at crafting a MIB to manage these files, I suppose.
> That would allow you to control/configure access to *all* 
> network services, not just SNMP.
> 
> 
> 
> > I'm guessing there isn't because we should probably be relying on 
> > either the community string or the auth/priv combination to control 
> > access
> 
> That's the SNMP model - yes.
> It's probably one of the most asked-for omissions!
> 
> Dave
> 

------------------------------------------------------------------------------
Forrester Wave Report - Recovery time is now measured in hours and minutes
not days. Key insights are discussed in the 2010 Forrester Wave Report as
part of an in-depth evaluation of disaster recovery service providers.
Forrester found the best-in-class provider in terms of services and vision.
Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users