SNMP v3 Support for Image Services

Transcription

1 Table of Contents Ensure SNMP v3 is enabled:... 2 SNMP v1 Communities configuration within SNMP v3:... 3 SNMP v1 User Authentication configuration within SNMP v3:... 4 SNMP v3 User Authentication configuration NonEncrypted:... 5 SNMP v3 User Authentication configuration with Encryption:... 6 Page 1 of 7

2 SNMP v3 support has been tested on AIX 5.3 and 6.1 over IPv4. This document contains the configuration details that were used for each of the available SNMP v3 configuration options. After making any changes to the SNMP v3 config files, you must do the following: Shutdown Image Services Run stopsrc s snmpd Run startsrc s snmpd Bring up Image Services Ensure SNMP v3 is enabled: Run ps e grep snmp to see the version of SNMP that is running. snmpd64v1 snmpdv3ne snmpdv3e SNMP v1 SNMP v3 NonEncryption SNMP v3 Encryption (AIX Encryption Pack must be installed) To change SNMP versions, use the snmpv3_ssw command: snmpv3_ssw e Switch to encrypted version of snmpdv3 agent snmpv3_ssw n Switch to nonencrypted version of snmpdv3 agent snmpv3_ssw l Switch to snmpdv1 agent Page 2 of 7

3 SNMP v1 Communities configuration within SNMP v3: It is possible to configure the legacy SNMP v1 Communities from within the SNMP v3 environment. Below is an example of how this is configured in the /etc/snmpdv3 file: For read/write add defaultview to the VACM_ACCESS line For a Poll Trap target, put the target system s IPv4 IP address in the TARGET_ADDRESS line Add the SMUX line for the fnpd_password at the bottom of the file. This line is automatically installed in the \etc\snmpd.conf file when Image Services is installed, but it is not added to the snmpdv3.conf file. VACM_GROUP group1 SNMPv1 public VACM_VIEW defaultview internet included # exclude snmpv3 related MIBs from the default view VACM_VIEW defaultview snmpmodules excluded VACM_VIEW defaultview included VACM_VIEW defaultview included # exclude aixmibd managed MIBs from the default view VACM_VIEW defaultview excluded VACM_ACCESS group1 noauthnopriv SNMPv1 defaultview defaultview defaultview NOTIFY notify1 traptag trap TARGET_ADDRESS Target1 UDP traptag trapparms1 TARGET_PARAMETERS trapparms1 SNMPv1 SNMPv1 public noauthnopriv COMMUNITY public public noauthnopriv DEFAULT_SECURITY noaccess smux gated_password # gated These settings provide for fully functional SNMPv1 capabilities, including the ability to MIB browse and set Image Services Poll Traps using the public community. Page 3 of 7

4 SNMP v1 User Authentication configuration within SNMP v3: It is possible to configure SNMP v1 using SNMP v3 User Authentication. The following configuration entries in the /etc/snmpdv3.conf file provide an example: VACM_GROUP group1 SNMPv1 verone VACM_VIEW group1view internet included VACM_ACCESS group1 noauthnopriv SNMPv1 group1view group1view group1view NOTIFY notify1 traptag trap TARGET_ADDRESS Target1 UDP traptag trapparms1 TARGET_PARAMETERS trapparms1 SNMPv1 SNMPv1 verone noauthnopriv COMMUNITY verone verone noauthnopriv DEFAULT_SECURITY noaccess smux gated_password # gated These settings provide for a community called verone and a group called group1 to have privileges to MIB browse and set Image Services Poll Traps. Page 4 of 7

5 SNMP v3 User Authentication configuration Nonencrypted: It is possible to configure SNMP v3 User Authentication without encryption. The following configuration entries in the /etc/snmpdv3.conf file provide an example: USM_USER u1 HMACMD5 1a4b5ea9746e247dc2ac0ec8ccf43b7d L VACM_GROUP group1 USM u1 VACM_VIEW group1view internet included # Include Image Services MIB VACM_VIEW group1view included VACM_ACCESS group1 AuthNoPriv USM group1view group1view group1view NOTIFY notify1 traptag trap TARGET_ADDRESS Target1 UDP traptag trapparms1 TARGET_PARAMETERS trapparms1 SNMPv3 USM u1 AuthNoPriv DEFAULT_SECURITY noaccess smux gated_password # gated It is also necessary to configure the /etc/clsnmp.conf file: user snmpv3 u1 AuthNoPriv HMACMD5 8b70fe477f eeb702ebe05e535 Use the pwtokey command to generate the Authentication keys which are used in the snmpdv3.conf and clsnmp.conf files. This example provides for a user called u1 and a group called group1 which have privileges to MIB browse and set Image Services Poll Traps. Page 5 of 7

6 SNMP v3 User Authentication configuration with Encryption: It is possible to configure SNMP v3 User Authentication with encryption. The following configuration entries in the /etc/snmpdv3.conf file provide an example: USM_USER u1 HMACMD5 739ebd ab189d23a3a7b1e4 DES 739ebd ab189d23a3a7b1e4 L VACM_GROUP group1 USM u1 VACM_GROUP group2 SNMPv1 verone VACM_VIEW group1view internet included # Include Image Services MIB VACM_VIEW group1view included VACM_VIEW group2view internet included # exclude snmpv3 related MIBs from the default view VACM_VIEW defaultview snmpmodules excluded VACM_VIEW defaultview included VACM_VIEW defaultview included # exclude aixmibd managed MIBs from the default view VACM_VIEW defaultview excluded VACM_ACCESS group1 AuthPriv USM group1view group1view group1view VACM_ACCESS group2 noauthnopriv SNMPv1 group2view group2view NOTIFY notify1 traptag trap TARGET_ADDRESS Target1 UDP traptag trapparms1 TARGET_ADDRESS Target2 UDP traptag trapparms2 TARGET_PARAMETERS trapparms1 SNMPv3 USM u1 AuthPriv TARGET_PARAMETERS trapparms2 SNMPv1 SNMPv1 verone noauthnopriv COMMUNITY verone verone noauthnopriv DEFAULT_SECURITY noaccess smux gated_password # gated The /etc/clsnmp.conf file must also be configured: user snmpv3 u1 AuthPriv HMACMD5 8b70fe477f eeb702ebe05e535 DES 8b70fe477f eeb702ebe05e535 Page 6 of 7

7 After generating the Authentication Keys and Privacy Keys with the pwtokey command, you may need to do the following steps: stopsrc s snmpd mv /etc/snmpd.boots /etc/snmpd.boots.backup startsrc s snmpd In the example of the /etc/snmpdv3.conf file, above, the result is both SNMP v1 and SNMP v3 functionality. This provides for an SNMP v3 user called u1 and a group called group1 with privileges to MIB browse and set Poll Traps. The Poll Traps will be encrypted (unreadable text) and will be sent to IPv4 IP address This configuration also provides for an SNMP v1 community called verone and a group called group2 with privileges to MIB browse and get Poll Traps (no set rights). Poll Traps will be encrypted and will be sent to IPv4 IP address Page 7 of 7