eduardo:linux:snmp
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| eduardo:linux:snmp [2010/07/29 05:49] – eduardo | eduardo:linux:snmp [2024/02/23 08:20] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====== SNMP ====== | ||
| + | - SNMP Version 1: The first version of SNMP to be implemented, | ||
| + | - SNMP Version 2: The second version of SNMP, often referred to as v2c, expanded the number of supported error codes, increased the size of counters used to track data, and had the ability to do bulk queries that more efficiently loaded response packets with data. SNMP v2c is backward compatible with version 1. | ||
| + | - SNMP Version 3: This version provides greater security and remote configuration capabilities than its predecessors. Access isn't limited to a single community string for read-only and read/write access, as | ||
| + | usernames and passwords have been introduced. Views of OIDs in a MIB can also be limited on a per-user basis. Support for encrypted SNMP data transfer and transfer error detection is also provided. | ||
| + | ===== SNMP Utils ===== | ||
| + | * If you intend to use your Linux box to query your network devices, other servers or even itself using MRTG or any other tool, you need to have the SNMP utility tools package net-snmp-utils installed. | ||
| + | * Utilities | ||
| + | * snmpget | ||
| + | * snmpwalk | ||
| + | |||
| + | ==== Install (Ubuntu) ==== | ||
| + | < | ||
| + | sudo apt-get install snmp | ||
| + | </ | ||
| + | |||
| + | ==== Usage ==== | ||
| + | * snmpwalk | ||
| + | * The example below gets all the value in the interface MIB of the local server using SNMP v1 | ||
| + | < | ||
| + | snmpwalk -v 1 -c iptel 147.10.17.96 | ||
| + | snmpwalk -v 1 -c craz33guy localhost interface | ||
| + | </ | ||
| + | |||
| + | * snmptrap | ||
| + | < | ||
| + | snmptrap -v 2c -c iptel -d 10.80.100.38 1002 1.3.6.1.4.1.161.1.1.0 | ||
| + | </ | ||
| + | |||
| + | ===== SNMP Server ===== | ||
| + | |||
| + | ==== Install ==== | ||
| + | * Install snmpd package | ||
| + | < | ||
| + | sudo apt-get install snmpd | ||
| + | </ | ||
| + | |||
| + | ==== Configuration ==== | ||
| + | |||
| + | === SNMP === | ||
| + | * Move existing / | ||
| + | < | ||
| + | mv / | ||
| + | </ | ||
| + | |||
| + | * Create a new / | ||
| + | < | ||
| + | rocommunity | ||
| + | syslocation | ||
| + | syscontact | ||
| + | </ | ||
| + | |||
| + | * Edit / | ||
| + | * Configure the IP address that snmpd listens on | ||
| + | * Enable snmptrapd which is disabled by default as of net-snmp version# 5.0 | ||
| + | * Leave the other setting as the default | ||
| + | < | ||
| + | # snmpd options (use syslog, close stdin/ | ||
| + | # replace 204.x.y.z with your public IP | ||
| + | # SNMPDOPTS=' | ||
| + | SNMPDOPTS=' | ||
| + | |||
| + | # snmptrapd control (yes means start daemon). | ||
| + | # 5.0, master agentx support must be enabled in snmpd before snmptrapd | ||
| + | # can be run. See snmpd.conf(5) for how to do this. | ||
| + | TRAPDRUN=yes | ||
| + | </ | ||
| + | |||
| + | * Configure SNMP trap to go to syslog facilities 2 | ||
| + | * Edit / | ||
| + | < | ||
| + | # For Community String iptel | ||
| + | authCommunity log, | ||
| + | |||
| + | # Log to syslog with facility level 2 | ||
| + | logOption s 2 | ||
| + | </ | ||
| + | |||
| + | * Restart SNMP | ||
| + | < | ||
| + | sudo / | ||
| + | </ | ||
| + | |||
| + | === SNMPv3 === | ||
| + | * Stop SNMP | ||
| + | < | ||
| + | sudo / | ||
| + | </ | ||
| + | |||
| + | * Create SNMPv3 user | ||
| + | * In this example the authentication password of " | ||
| + | < | ||
| + | server:/$ sudo net-snmp-config --create-snmpv3-user -ro -a MD5 -A pocketmonster iptel | ||
| + | |||
| + | adding the following line to / | ||
| + | | ||
| + | adding the following line to / | ||
| + | | ||
| + | |||
| + | server:/$ | ||
| + | </ | ||
| + | |||
| + | * Create SNMPv3 user | ||
| + | * To encrypt the data received we use the net-snmp-config command again to create a username just for this purpose. A new read only username " | ||
| + | < | ||
| + | server:/$ sudo net-snmp-config --create-snmpv3-user -ro -a MD5 -A pocketmonster -x DES -X pocketmonster iptel | ||
| + | |||
| + | adding the following line to / | ||
| + | | ||
| + | adding the following line to / | ||
| + | | ||
| + | |||
| + | server:/$ | ||
| + | </ | ||
| + | |||
| + | * Restart SNMP | ||
| + | < | ||
| + | sudo / | ||
| + | </ | ||
| + | |||
| + | * Your password and privilege information are stored in / | ||
| + | < | ||
| + | createUser securev3user MD5 " | ||
| + | createUser username4snmpv3 MD5 " | ||
| + | </ | ||
| + | |||
| + | * The snmpd daemon will completely encrypt the SNMP password data in this file when it restarts which helps to further increase security. We can see an example of this configuration here. | ||
| + | < | ||
| + | usmUser 1 3 0x80001f88780711168720eb1e745 | ||
| + | 0x73656375626576337573657200 | ||
| + | 0x73656375726576337573657200 | ||
| + | NULL .1.3.6.1.6.3.10.1.1.2 0xd951 | ||
| + | ac1d95033f4afgf31243eb6907df .1.3.6.1.6.3.10.1.2.2 | ||
| + | 0xf1f4bb00452211d27b50c273c09031ac 0x00 | ||
| + | usmUser 1 3 0x80001f8880711168720eb1e745 | ||
| + | 0x757365726e61657534736e6d70763300 | ||
| + | 0x757365726e616d6534736e6d70763300 | ||
| + | NULL .1.3.6.1.6.3.10. | ||
| + | 1.1.2 0x5e35c9f5352519aa4f53eded09bbdddd | ||
| + | .1.3.6.1.6.3.10.1.2.2 0x5e35c9f5122519aa4f53eded09bbdddd "" | ||
| + | setserialno 1464593474 | ||
| + | </ | ||
| + | |||
| + | * To test non-encrypted SNMPv3 data | ||
| + | * We specify the authentication password and authentication encryption method, and we also use the -l flag to indicate that authentication will be used, but that data privacy will be disabled (the authNoPriv option). | ||
| + | < | ||
| + | [root@server ~]# snmpget -v 3 -u iptel -l authNoPriv -a MD5 -A pocketmonster 147.10.33.67 SNMPv2-MIB:: | ||
| + | SNMPv2-MIB:: | ||
| + | [root@server ~]# | ||
| + | </ | ||
| + | |||
| + | * To test encrypted SNMPv3 data | ||
| + | < | ||
| + | [root@server ~]# snmpget -v 3 -u iptel -l authPriv -a MD5 -A pocketmonster -x DES -X pocketmonster 147.10.33.67 SNMPv2-MIB:: | ||
| + | SNMPv2-MIB:: | ||
| + | [root@server ~]# | ||
| + | </ | ||