snmpv3 createUser with engineid

Hi,

Problem:
-----------

snmpd is not considering user provided engined id in createUser directive.

Background:
----------

- I am developing snmp subagent in order to report SNMP v3 traps to remote systems.
- Remote systems are not in my control. Once they receive traps, application team can use it as they wish
- Now there should be a seamless way to integrate traps into application something like, pre-agreed engineid. I should be able to send traps with pre-agreed engineid, so that application does not have to access actual hw ( why not to access actual hw is explained below in step 5). In some cases, application teams are not provided ssh access to actual hardware. Only webui access, via which they will be able to add / modify snmp v3 users and able to specify trap destination and so on.


Working method:
--------------

1) stop snmpd

2)
In /var/net-snmp/snmpd.conf add,

createUser admin SHA CHANGEME AES
group incremental usm admin
view new_view included .1
view new_view excluded .1.3.6.1.2.1.1.1
view new_view excluded .1.3.6.1.2.1.25.4.2.1.2
access incremental "" usm priv exact new_view none none
rwuser admin priv
master agentx
trapsess -v 3 -l authpriv -u admin ip_add_remote_machine

3) restart netsnmp

4) stop snmptrapd

5) whatever engineid is available in snmpd.conf ( login to actual hw and grep for engineid from snmpd.conf), use the same in remote machine snmptrapd.conf

disableAuthorization yes
createUser -e enginedid_same_as_snmpdconf admin SHA CHANGEME AES CHANGEME

6) restart snmptrapd

Now I am able to receive traps on remote machine.


Non-working method:
------------------

1) same as above
2) same as above except

createUser -e 0x0102030405060504030201 admin SHA CHANGEME AES

3) restart snmpd

snmpd throws error,

snmpd: send_trap: USM unknown security name (no such user exists)


4) stop snmptrapd
5) Now no need to grep from snmpd.conf. As engined id is pre-agreed, simply use that
disableAuthorization yes
createUser -e 0x0102030405060504030201 admin SHA CHANGEME AES CHANGEME
6) restart snmptrapd

Not able to receive traps on remote machine


My requirement is, user should decide on what engineid to use on both snmpd ( actual hw ) and on snmptrapd ( remote machine ). By configuring this in appropriate configuration files, user should be able to receive traps without any need to access actual hw where traps are being generated.



Regards,

Mukunth

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users