Re: high-security SNMPv3 setup?

On 12 July 2012 03:14, Chris Bartram <[email protected]> wrote:
> add to /var/net-snmp/snmpd.conf:
>     createUser remotereadonly SHA randompass DES "really secure passphrase"
>
> stop and restart snmpd

Close.

Stop the agent,  *then* add the line to /var/net-snmp/snmpd.conf,
and restart the agent.
   You can't safely manipulate the persistent config file whilst the agent
is running.


> Do I really need to create a dummy user first; then clone the one user I need?

Not if you're creating a user via the config file, no.
The point of having (one or more) dummy users is for when
you want to be able to create SNMPv3 users dynamically
(i.e. via SET requests).



> If I send SNMPv3 traps; on the receiving system does the userid need RO or RW?

Neither.
According to the basic SNMPv3 access control framework, the receiver
needs "notify" permission (rather than "read" or "write").
   If you're using the Net-SNMP snmptrapd receiver, then the access control
configuration is based on how those traps will be processed (log to file,
passed to a handler script, or forwarded to another receiver).

See the section "Access Control" in the snmptrapd.conf(5) man page.
In particular, the description of the "authuser" directive.

Dave

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users