VACM Configurations Not Working
Bakshi Gulam <[email protected]>
| Newsgroups | gmane.network.net-snmp.user |
|---|---|
| Message-ID | <CA+P_w0zpCV_m6kFOTbEFC=2k6fu7J_rA9smGK9KaD81OQm-GbA@mail.gmail.com> |
Hi All, I've some problem with configuring VACM. My VACM configurations in snmpd.conf seems to be not working. Any help on this would be really appreciated. Below are my VACM configurations in snmpd.conf. (whole snmpd.conf is attached with this mail) # User Creation createUser noAuthUser createUser MD5User MD5 "demo-password" createUser MD5DESUser MD5 "demo-password" DES # # Group Specification # group-name sec.model sec.name group ro_group usm noAuthUser # SNMPv3 username == sec.name group ro_group usm MD5User group rw_group usm MD5DESUser # # View Specification # view-name incl/excl subtree mask view all included .1 # default-view which includes the whole MIB tree view system_view excluded .1 view system_view included system view system_view excluded sysLocation.0 view if_view excluded .1 view if_view included system view if_view included ifTable # # Access Specification # group-name context sec.model sec.level match read write notif access ro_group "" usm noauth exact system_view none none access ro_group "" usm auth exact if_view none none access rw_group "" usm priv exact all if_view none I expect noAuthUser to have read access only to system_view (which has only system sub-tree). But I'm able to read everything (for example, some object from ifMIB; sysLocation.0 which is excluded; etc) from whole MIB tree via noAuthUser. Access control restrictions seems to have no effect. Am I missing anything? -- ///////////////////////// // Bakshi Gulam // // http://www.gulam.in // ///////////////////////// ------------------------------------------------------------------------------ Comprehensive Server Monitoring with Site24x7. Monitor 10 servers for $9/Month. Get alerted through email, SMS, voice calls or mobile push notifications. Take corrective actions from your mobile device. http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk _______________________________________________ Net-snmp-users mailing list [email protected] Please see the following page to unsubscribe or change other options: https://lists.sourceforge.net/lists/listinfo/net-snmp-users
snmpd.conf
(application/octet-stream, 2.8 KB)
########################################################################### # # snmpd.conf # # - created by the snmpconf configuration program # ########################################################################### # SECTION: Agent Operating Mode # # This section defines how the agent will operate when it # is running. # agentaddress: The IP address and port number that the agent will listen on. # By default the agent listens to any and all traffic from any # interface on the default SNMP port (161). This allows you to # specify which address, interface, transport type and port(s) that you # want the agent to listen on. Multiple definitions of this token # are concatenated together (using ':'s). # arguments: [transport:]port[@interface/address],... agentaddress udp:161 ########################################################################### # SECTION: Access Control Setup # # This section defines who is allowed to talk to your running # snmp agent. # rwuser: a SNMPv3 read-write user # arguments: user [noauth|auth|priv] [restriction_oid] rwuser MD5DESUser priv # rouser: a SNMPv3 read-only user # arguments: user [noauth|auth|priv] [restriction_oid] rouser noAuthUser noauth rouser MD5User auth # rocommunity: a SNMPv1/SNMPv2c read-only access community name # arguments: community [default|hostname|network/bits] [oid] rocommunity public # rwcommunity: a SNMPv1/SNMPv2c read-write access community name # arguments: community [default|hostname|network/bits] [oid] rwcommunity private # # Unknown directives read in from other files by snmpconf # # User Creation createUser noAuthUser createUser MD5User MD5 "demo-password" createUser MD5DESUser MD5 "demo-password" DES # # Group Specification # group-name sec.model sec.name group ro_group usm noAuthUser # SNMPv3 username == sec.name group ro_group usm MD5User group rw_group usm MD5DESUser # # View Specification # view-name incl/excl subtree mask view all included .1 # default-view which includes the whole MIB tree view system_view excluded .1 view system_view included system view system_view excluded sysLocation.0 view if_view excluded .1 view if_view included system view if_view included ifTable # # Access Specification # group-name context sec.model sec.level match read write notif access ro_group "" usm noauth exact system_view none none access ro_group "" usm auth exact if_view none none access rw_group "" usm priv exact all if_view none