SNMP configuration on NMIS server
- Arnulfo Garcia
This document considers the following variables that should be replaced by real values:
- 192.168.10.0/24 : Network IP address and subnet mask in CIDR format corresponding to the local area network.
- password : Any password good enough.
- nmis.support.latam.lab : Host name of the system where the service is being configured.
- nmis-support-latam-lab@some-domain.net : Server administrator email account.
- 192.168.10.254 : IP address of the server.
Configuration file /etc/snmp/snmpd.conf.
Access control lists.
You should create access control lists ( ACLs or A ccess C ontrol L ist) corresponding to the file /etc/snmp/snmpd.conf , which serve to define what you will have access to the service snmpd . One of these lists will be granted read and write access permission, for whatever is necessary in relation to administration, and the other will be given read-only. For security reasons only interface 127.0.0.1 will be in the read write list. Read-only access permission will be granted to a network or an IP address in the other access control list.
Considering the above, a couple of lines could be added like the following:
com2sec local 127.0.0.1/32 password com2sec MyLocalNetwork 192.168.10.0/24 password #### # First, map the community name "public" into a "security name" # sec.name source community com2sec notConfigUser default public
snmp community configuration definition
# This community string has full SNMP view to access all the goodness com2sec trustedUser default nmisGig8 ####
Definition of groups.
At least two groups are created: MyRWGroup and MyROGroup . The first will be a group that will be assigned read-write permissions later, and the second will be a group that will later be assigned read-only permissions . For each group, three lines are assigned that specify the type of access that will be allowed at any given time to a particular group. That is, MyRWGroup is associated with local and MyROGroup to MyLocalRed .
# Second, map the security name into a group name: # groupName securityModel securityName group notConfigGroup v1 notConfigUser group notConfigGroup v2c notConfigUser group trustedGroup v2c trustedUser #### #A assigned to the group writing reading group MiGrupoRW v1 Local group MiGrupoRW v2c Local group MiGrupoRW usm Local #A assigns MiRedLocal to the group read - only group MiGrupoRO v1 MiRedLocal group MiGrupoRO v2c MiRedLocal group MiGrupoRO usm MiRedLocal
Branches allowed.
The branches to be allowed to see through the service are specified. The most common, for example to be used with MRTG , is the following:
# Make at least snmpwalk -v 1 localhost -c public system fast again. # name incl/excl subtree mask(optional) view systemview included .1.3.6.1.2.1.1 view systemview included .1.3.6.1.2.1.25.1.1 view fullview included .1 ## name incl/excl subtree mask(optional) view all included .1 80
Assigning permissions to groups.
You must specify what permissions the two groups, MyGroupRO and MyGroupRW, will have . The last columns are of special interest.
# Finally, grant the group read-only access to the systemview view. # group context sec.model sec.level prefix read write notif access notConfigGroup "" any noauth exact systemview none none access trustedGroup "" any noauth exact fullview none none access MiGrupoRO "" any noauth exact all none none access MiGrupoRW "" any noauth exact all all all
Informational options.
Two informational options are defined so that when using client applications such as MRTG , some information is included about which system is being accessed
syslocation Linux server on CDMX LATAM syscontact Administrator support@opmantek.com latam@opmantek.com
A working configuration example.
The example shown below is used on all computers owned by the author at home and in the office. You just have to replace the value redlocal with whatever you consider appropriate and replace the value 192.168.10.0/24 with the value of the network or the IP address from which access is required with a snmp client , such as NMIS8 or NMIS9.
###### # Access Control Lists (ACLs) # First, map the community name "public" into a "security name" # sec.name source community com2sec notConfigUser default public com2sec local 127.0.0.1/32 password com2sec MyLocalNetwork 192.168.10.0/24 password ###### # This community string has full SNMP view to access all the goodness com2sec trustedUser default nmisGig8 ###### # ACL is assigned to group read write # Second, map the security name into a group name: # groupName securityModel securityName group notConfigGroup v1 notConfigUser group notConfigGroup v2c notConfigUser group trustedGroup v2c trustedUser ###### # Third, create a view for us to let the group have rights to: # Make at least snmpwalk -v 1 localhost -c public system fast again. # name incl/excl subtree mask(optional) view systemview included .1.3.6.1.2.1.1 view systemview included .1.3.6.1.2.1.25.1.1 view fullview included .1 view all included .1 80 ###### # Finally, grant the group read-only access to the systemview view. # group context sec.model sec.level prefix read write notif access notConfigGroup "" any noauth exact systemview none none access trustedGroup "" any noauth exact fullview none none access MiGrupoRO "" any noauth exact all none none access MiGrupoRW "" any noauth exact all all all ###### # System contact information # It is also possible to set the sysContact and sysLocation system # variables through the snmpd.conf file: syslocation Linux server on CDMX LATAM syscontact Administrator support@opmantek.com latam@opmantek.com
Activate, start, stop and restart the service.
Run the following to activate the service at all runlevels:
chkconfig snmpd on
Run the following to run the service for the first time:
service snmpd start
Run the following to restart the service and apply changes made to the configuration:
service snmpd restart
Run the following to stop the service:
service snmpd stop
Checks.
Considering, as an example , to be sign as password password on a system whose IP address is 192.168.1.254 , to test whether the configuration works, you just have to run the following two commands to verify that return information about the queried system.
## V1 snmpwalk -v 1 <ip_device> -c <community_SNMP> system ## V2 snmpwalk -v2c -c <community_SNMP> <ip_device> system ## V3 snmpwalk -v3 -l <noAuthNoPriv|authNoPriv|authPriv> -u <username> [-a <MD5|SHA>] [-A <authphrase>] [-x DES] [-X <privaphrase>] <ipaddress>[:<dest_port>] [oid] system