Menu
▾
▴
net-snmp-users — General discussion of the project (Please use this OR -coders, NOT both!)
You can subscribe to this list here.
| 2000 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(26) |
Nov
(262) |
Dec
(286) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2001 |
Jan
(416) |
Feb
(420) |
Mar
(638) |
Apr
(722) |
May
(478) |
Jun
(697) |
Jul
(559) |
Aug
(502) |
Sep
(482) |
Oct
(992) |
Nov
(452) |
Dec
(415) |
| 2002 |
Jan
(465) |
Feb
(593) |
Mar
(472) |
Apr
(696) |
May
(715) |
Jun
(544) |
Jul
(428) |
Aug
(552) |
Sep
(418) |
Oct
(429) |
Nov
(327) |
Dec
(255) |
| 2003 |
Jan
(531) |
Feb
(380) |
Mar
(394) |
Apr
(408) |
May
(541) |
Jun
(483) |
Jul
(310) |
Aug
(329) |
Sep
(275) |
Oct
(360) |
Nov
(351) |
Dec
(300) |
| 2004 |
Jan
(334) |
Feb
(468) |
Mar
(433) |
Apr
(433) |
May
(448) |
Jun
(472) |
Jul
(456) |
Aug
(565) |
Sep
(536) |
Oct
(567) |
Nov
(451) |
Dec
(435) |
| 2005 |
Jan
(296) |
Feb
(373) |
Mar
(335) |
Apr
(663) |
May
(456) |
Jun
(537) |
Jul
(268) |
Aug
(364) |
Sep
(284) |
Oct
(395) |
Nov
(387) |
Dec
(391) |
| 2006 |
Jan
(464) |
Feb
(465) |
Mar
(556) |
Apr
(242) |
May
(202) |
Jun
(158) |
Jul
(314) |
Aug
(397) |
Sep
(379) |
Oct
(456) |
Nov
(381) |
Dec
(308) |
| 2007 |
Jan
(380) |
Feb
(438) |
Mar
(337) |
Apr
(344) |
May
(379) |
Jun
(316) |
Jul
(392) |
Aug
(287) |
Sep
(301) |
Oct
(413) |
Nov
(265) |
Dec
(325) |
| 2008 |
Jan
(468) |
Feb
(500) |
Mar
(367) |
Apr
(547) |
May
(316) |
Jun
(289) |
Jul
(383) |
Aug
(167) |
Sep
(190) |
Oct
(162) |
Nov
(152) |
Dec
(236) |
| 2009 |
Jan
(371) |
Feb
(384) |
Mar
(370) |
Apr
(368) |
May
(347) |
Jun
(319) |
Jul
(235) |
Aug
(354) |
Sep
(211) |
Oct
(155) |
Nov
(235) |
Dec
(227) |
| 2010 |
Jan
(326) |
Feb
(250) |
Mar
(336) |
Apr
(318) |
May
(269) |
Jun
(281) |
Jul
(324) |
Aug
(257) |
Sep
(299) |
Oct
(181) |
Nov
(182) |
Dec
(148) |
| 2011 |
Jan
(176) |
Feb
(240) |
Mar
(351) |
Apr
(177) |
May
(100) |
Jun
(131) |
Jul
(168) |
Aug
(228) |
Sep
(122) |
Oct
(115) |
Nov
(116) |
Dec
(88) |
| 2012 |
Jan
(127) |
Feb
(108) |
Mar
(117) |
Apr
(149) |
May
(166) |
Jun
(135) |
Jul
(205) |
Aug
(112) |
Sep
(63) |
Oct
(142) |
Nov
(67) |
Dec
(69) |
| 2013 |
Jan
(140) |
Feb
(62) |
Mar
(56) |
Apr
(38) |
May
(35) |
Jun
(30) |
Jul
(57) |
Aug
(35) |
Sep
(24) |
Oct
(32) |
Nov
(59) |
Dec
(41) |
| 2014 |
Jan
(47) |
Feb
(37) |
Mar
(46) |
Apr
(51) |
May
(36) |
Jun
(31) |
Jul
(49) |
Aug
(50) |
Sep
(38) |
Oct
(67) |
Nov
(47) |
Dec
(55) |
| 2015 |
Jan
(38) |
Feb
(47) |
Mar
(20) |
Apr
(30) |
May
(19) |
Jun
(27) |
Jul
(80) |
Aug
(48) |
Sep
(27) |
Oct
(23) |
Nov
(42) |
Dec
(32) |
| 2016 |
Jan
(34) |
Feb
(15) |
Mar
(46) |
Apr
(44) |
May
(49) |
Jun
(22) |
Jul
(36) |
Aug
(24) |
Sep
(6) |
Oct
(14) |
Nov
(13) |
Dec
(13) |
| 2017 |
Jan
(22) |
Feb
(19) |
Mar
(10) |
Apr
(9) |
May
(30) |
Jun
(48) |
Jul
(20) |
Aug
(21) |
Sep
(17) |
Oct
(11) |
Nov
(22) |
Dec
(16) |
| 2018 |
Jan
(25) |
Feb
(3) |
Mar
(19) |
Apr
(22) |
May
(20) |
Jun
(5) |
Jul
(17) |
Aug
(33) |
Sep
(9) |
Oct
(27) |
Nov
(9) |
Dec
(7) |
| 2019 |
Jan
(18) |
Feb
(23) |
Mar
(12) |
Apr
(22) |
May
(29) |
Jun
(23) |
Jul
(17) |
Aug
(15) |
Sep
(28) |
Oct
(12) |
Nov
(26) |
Dec
(22) |
| 2020 |
Jan
(7) |
Feb
(3) |
Mar
(12) |
Apr
(16) |
May
(24) |
Jun
(20) |
Jul
(43) |
Aug
(10) |
Sep
(5) |
Oct
(10) |
Nov
(6) |
Dec
(20) |
| 2021 |
Jan
(21) |
Feb
(10) |
Mar
(20) |
Apr
(17) |
May
(31) |
Jun
(16) |
Jul
(21) |
Aug
(5) |
Sep
(15) |
Oct
(13) |
Nov
(3) |
Dec
(10) |
| 2022 |
Jan
(10) |
Feb
(16) |
Mar
(14) |
Apr
(5) |
May
(8) |
Jun
(8) |
Jul
(12) |
Aug
(23) |
Sep
(4) |
Oct
(3) |
Nov
(5) |
Dec
|
| 2023 |
Jan
(3) |
Feb
(2) |
Mar
(1) |
Apr
(3) |
May
(3) |
Jun
|
Jul
|
Aug
(8) |
Sep
|
Oct
(3) |
Nov
(2) |
Dec
(3) |
| 2024 |
Jan
(4) |
Feb
(3) |
Mar
(5) |
Apr
(4) |
May
(3) |
Jun
(4) |
Jul
(11) |
Aug
(5) |
Sep
(1) |
Oct
(1) |
Nov
(17) |
Dec
(5) |
| 2025 |
Jan
(3) |
Feb
|
Mar
(2) |
Apr
(7) |
May
(2) |
Jun
(1) |
Jul
(3) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Lokesh C. <lve...@gm...> - 2025-07-14 10:34:42
|
Hello, I want to extend snmp with one command. I added one line to /etc/snmp/snmpd.configuration ============================================================================ root@officelaptop:~# tail /etc/snmp/snmpd.conf # # rouser: a SNMPv3 read-only access username # arguments: username [noauth|auth|priv [OID | -V VIEW [CONTEXT]]] rouser authPrivUser authpriv -V systemonly # include a all *.conf files in a directory rocommunity public extend my_own_cmd /usr/bin/echo Hello Lokesh includeDir /etc/snmp/snmpd.conf.d root@officelaptop:~# ============================================================================ After that, I did sudo systemctl restart snmpd snmpd started and is active If I try to execute the command my_own_cmd, I'm seeing the following error. ============================================================================ root@officelaptop:~# sudo snmpwalk -v2c -c public localhost NET-SNMP-EXTEND-MIB::nsExtendOutput1Line."my_own_cmd" NET-SNMP-EXTEND-MIB::nsExtendOutput1Line.my_own_cmd: Unknown Object Identifier (Index out of range: my_own_cmd (nsExtendToken)) ============================================================================ Can someone help me understand how to fix the issue ? Thanks & Regards -- Lokesh Chakka. |
|
From: Bart V. A. <bva...@ac...> - 2025-07-06 01:40:14
|
On 7/3/25 12:22 PM, Carl Jacobs via Net-snmp-users wrote: > Are there plans to upgrade python3-netsnmp to support SHA-2 algorithms > and AES-256 encryption? Net-SNMP is maintained by a team of volunteers. If a patch is submitted that adds this functionality we can help with reviewing that patch. Bart. |
|
From: Carl J. <cd...@us...> - 2025-07-03 20:34:59
|
Are there plans to upgrade python3-netsnmp to support SHA-2 algorithms and AES-256 encryption? -- Carl D. Jacobs IBM Infrastructure cd...@us...<mailto:cd...@us...> (845) 435-1908 https://w3.ibm.com/w3publisher/oneit |
|
From: Turritopsis D. T. En M. <teo...@pr...> - 2025-06-07 11:41:23
|
Subject: Simple Gallery Pro gallery / album app for Oppo Reno10 Pro 5G Android Phone Good day from Singapore, Developer email: he...@si... Developers: Aga-C, AlbertoPellitteri, Alfavio, connyduck, correia55, dagkalis, DaPa, ForgottenUmbrella, KryptKode, Naveen3Singh, qertyfinger Facebook: Simple Mobile Tools GitHub: SimpleMobileTools Reddit: SimpleMobileTools Version 6.28.1 Pro Made in Slovakia App Settings ================= Manage included folders ======================== /storage/emulated/0/DCIM/Camera Manage excluded folders ========================= /storage/emulated/0/Download /storage/emulated/0/Android/media/org.telegram.messenger /storage/emulated/0/DCIM/MyAlbums /storage/emulated/0/Pictures /storage/emulated/0/Android/media/com.whatsapp Oppo Photos is the stock gallery / album app for Oppo Reno10 Pro 5G Android phone. Regards, Mr. Turritopsis Dohrnii Teo En Ming Targeted Individuals in Singapore GIMP = Government-Induced Medical Problems 7 June 2025 Saturday 7.32 PM Singapore Time |
|
From: sacawulu <cyu...@gm...> - 2025-05-17 14:20:27
|
Hi, We are running alma9 linux, and have problems with snmp network ifindexes that change between reboots. I am told by our network technicians that this causes an issue for them, with their Whatsup Gold network monitoring tool. This is alma9, and comes with: > net-snmp.x86_64 1:5.9.1-17.el9 @appstream > net-snmp-agent-libs.x86_64 1:5.9.1-17.el9 @appstream > net-snmp-libs.x86_64 1:5.9.1-17.el9 @appstream > net-snmp-utils.x86_64 1:5.9.1-17.el9 @appstream We know on cisco you can use > snmp ifindex persist to keep indexes consistent. Is there a way to achieve the same behaviour on linux? (and if this is not the proper place to ask...just let me know) Thanks! MJ |
|
From: Sreenivasulu A. <sre...@gm...> - 2025-05-14 17:27:53
|
Hi Team, We upgraded the Net-Snmp to 5.9.1 and we are observing the SEGFAULT in __snmp_xs_cb when we use SNMPv3. The below back trace, #0 0x00007f93ffd2be38 in Perl_hv_common () from /etc/httpd/modules/mod_perl.so #1 <https://github.com/net-snmp/net-snmp/issues/1> 0x00007f93ffd2d1be in Perl_hv_common_key_len () from /etc/httpd/modules/mod_perl.so #2 <https://github.com/net-snmp/net-snmp/issues/2> 0x00007f93f1c54053 in __snmp_xs_cb () from /opt/XXXX/lib64/perl5/x86_64-linux-thread-multi//x86_64-linux-thread-multi/auto/SNMP/SNMP.so #3 <https://github.com/net-snmp/net-snmp/issues/3> 0x00007f93f1eb3543 in _sess_process_packet () from /opt/XXXX/lib64/libnetsnmp.so.40 #4 <https://github.com/net-snmp/net-snmp/issues/4> 0x00007f93f1eb4526 in _sess_read () from /opt/XXXX/lib64/libnetsnmp.so.40 #5 <https://github.com/net-snmp/net-snmp/pull/5> 0x00007f93f1eb505d in snmp_sess_read2 () from /opt/XXXX/lib64/libnetsnmp.so.40 #6 <https://github.com/net-snmp/net-snmp/issues/6> 0x00007f93f1eb50ab in snmp_read2 () from /opt/XXXX/lib64/libnetsnmp.so.40 #7 <https://github.com/net-snmp/net-snmp/pull/7> 0x00007f93f1eb5108 in snmp_read () from /opt/XXXX/lib64/libnetsnmp.so.40 #8 <https://github.com/net-snmp/net-snmp/issues/8> 0x00007f93f1c4b7b8 in XS_SNMP__read_on_fd () from /opt/XXXX/lib64/perl5/x86_64-linux-thread-multi//x86_64-linux-thread-multi/auto/SNMP/SNMP.so #9 <https://github.com/net-snmp/net-snmp/issues/9> 0x00007f93ffd38daf in Perl_pp_entersub () from /etc/httpd/modules/mod_perl.so #10 <https://github.com/net-snmp/net-snmp/issues/10> 0x00007f93ffd30b40 in Perl_runops_standard () from /etc/httpd/modules/mod_perl.so #11 <https://github.com/net-snmp/net-snmp/issues/11> 0x00007f93ffcda6cc in Perl_eval_sv () from /etc/httpd/modules/mod_perl.so #12 <https://github.com/net-snmp/net-snmp/issues/12> 0x00007f93ffcdc608 in Perl_require_pv () from /etc/httpd/modules/mod_perl.so #13 <https://github.com/net-snmp/net-snmp/pull/13> 0x00007f93ffcb4e2e in modperl_require_file () from /etc/httpd/modules/mod_perl.so #14 <https://github.com/net-snmp/net-snmp/pull/14> 0x00007f93ffcaf4ee in modperl_config_apply_PerlRequire () from /etc/httpd/modules/mod_perl.so #15 <https://github.com/net-snmp/net-snmp/issues/15> 0x00007f93ffcad068 in modperl_startup () from /etc/httpd/modules/mod_perl.so #16 <https://github.com/net-snmp/net-snmp/issues/16> 0x00007f93ffcace50 in modperl_startup () from /etc/httpd/modules/mod_perl.so #17 <https://github.com/net-snmp/net-snmp/issues/17> 0x00007f93ffcad2d6 in modperl_init () from /etc/httpd/modules/mod_perl.so #18 <https://github.com/net-snmp/net-snmp/pull/18> 0x00007f93ffcad436 in modperl_hook_init () from /etc/httpd/modules/mod_perl.so #19 <https://github.com/net-snmp/net-snmp/issues/19> 0x00005592a6791ff3 in test_run_open_logs () #20 <https://github.com/net-snmp/net-snmp/pull/20> 0x00005592a676c6fe in main () Could you please check and provide the patch for the same? -- Thanks & Regards *Sreenivasulu Alapaka* |
|
From: Lee <le...@gm...> - 2025-04-24 19:24:53
|
On Tue, Apr 22, 2025 at 8:28 AM Ari Rabinowitz wrote: > > Hi Lee, > > Thanks for the confirmation of what I've been seeing. I've even tried adding "disableSNMPv3 yes" to the host.conf files for the hosts which don't do SNMPv3, but it still doesn't work. > This is a sample of the host.conf files I've been trying: > defVersion 2c > defCommunity REDACTED > disableSNMPv3 yes > disableSNMPv2c no > > I have the feeling that once the configuration code sees any SNMPv3 parameters it can't reset them all and stop looking for SNMPv3, but I haven't looked at the source code to see. I'm afraid that this will end up being a large change for the developers, if anyone has the time to look into it and try to fix it. I haven't looked at the code either but I can't imagine why putting defVersion 2c in a host.conf file would fail yet putting '-v 2c' on the command line would work. Other than a bug.. assuming the man page is correct.. Regards, Lee > On Mon, Apr 21, 2025 at 5:57 PM Lee wrote: >> >> On Mon, Apr 21, 2025 at 4: 09 PM Ari Rabinowitz wrote: > > Hi, > > I'm trying to set up SNMP monitoring of many of our devices. Since most of them support SNMPv3 I've set up the following in my /etc/snmp/snmp. conf: > defVersion >> ZjQcmQRYFpfptBannerStart >> This Message Is From an External Sender >> This message came from outside your organization. >> >> ZjQcmQRYFpfptBannerEnd >> >> On Mon, Apr 21, 2025 at 4:09 PM Ari Rabinowitz wrote: >> > >> > Hi, >> > >> > I'm trying to set up SNMP monitoring of many of our devices. Since most of them support SNMPv3 I've set up the following in my /etc/snmp/snmp.conf: >> > defVersion 3 >> > defSecurityLevel authPriv >> > defAuthType SHA >> > defPrivType AES >> > defAuthPassphrase REDACTED >> > defPrivPassphrase REDACTED >> > defSecurityName USER >> > >> > I'm able to override the Version 3 parameters such as defSecurityLevel, defAuthType and the passphrases for the devices which support SNMPv3 in host specific configuration files in /etc/snmp/hosts/, but I can't find any way to specify in a host-specific configuration that the host uses version 2c or version 1. Is there any way to do that, if the general default is version 3? >> >> There's supposed to be a way - man snmp.conf says >> For example, if you wanted a particular host to use SNMPv2c by default >> you could create a ˜/.snmp/hosts/NAME.conf file and in it put: >> >> defVersion 2c >> >> but it doesn't work for me >> >> $ cat ~/.snmp/librarysw.conf >> defVersion 2c >> >> $ head -1 ~/.snmp/snmp.conf >> defVersion 3 >> >> $ snmpwalk librarysw system >> snmpwalk: Unknown user name (Sub-id not found: (top) -> system) >> >> $ snmpwalk -v 2c librarysw system >> RFC1213-MIB::sysDescr.0 = STRING: "JetStream 24-Port Gigabit L2+ >> Managed Switch with 4 SFP Slots" >> RFC1213-MIB::sysObjectID.0 = OID: TPLINK-MIB::tplinkProducts.122 >> RFC1213-MIB::sysUpTime.0 = Timeticks: (1501667371) 173 days, 19:17:53.71 >> RFC1213-MIB::sysContact.0 = STRING: "https://urldefense.proofpoint.com/v2/url?u=http-3A__www.tp-2Dlink.com&d=DwIFaQ&c=009klHSCxuh5AI1vNQzSO0KGjl4nbi2Q0M1QLJX9BeE&r=7VDP4N-fj98QvYr9AY4iLJh3GBO-d7Oa-o-8TLGIA7c&m=MYTKeSiGnacxnJ8w3AdGzcCgA2JLnsgcQuQPMWbIKhdCvra1_bSjV7RkureXLW2s&s=vK-iWeKK8GncVMQdwBeD57n_nPEBXBcsmJztBro84so&e=" >> RFC1213-MIB::sysName.0 = STRING: "librarysw" >> RFC1213-MIB::sysLocation.0 = STRING: "Hong Kong" >> RFC1213-MIB::sysServices.0 = INTEGER: 3 >> >> hrmmm.. the man page says ˜/.snmp/hosts/NAME.conf so let's move the >> librarysw.conf file to .snmp/hosts/ and try again >> >> $ cat ~/.snmp/hosts/librarysw.conf >> defVersion 2c >> >> $ snmpwalk librarysw system >> snmpwalk: Unknown user name (Sub-id not found: (top) -> system) >> >> still no :( >> >> Regards >> Lee |
|
From: Hamilton, A. <ham...@dy...> - 2025-04-23 21:34:45
|
Hi everyone, I'm very new to SNMP, Net-SNMP, and the field in general, so please have patience if there is an obvious fix to this. I'm trying to configure an extend directive in the net-snmp/27/snmpd.conf file; I've set it up thus: extend classmonitor /tmp/classmonitor.sh I'm just having the script be a simple echo at this point to rule out any script errors. It looks like: #!/bin/bash echo Test After restarting the daemon with a sudo snap restart net-snmp, the output of the snmpwalk for 1.3.6.1.4.1.8072.1.3.2 has the nsExtendOutFull line show an empty string, and nsExtendResult gives an exit code of 1. The nsExtendCommand line, however, points correctly to /tmp/classmonitor.sh. It seems like the daemon is somehow not able to get to the file or its output, but the permissions for reading/executing the file and directory align with what I have set for the user. Doing a su with the user running the daemon also shows that the script outputs fine into the terminal when run by itself. Any troubleshooting would be much appreciated. Thanks! -AH D'YOUVILLE CONFIDENTIALITY NOTICE: This communication, including any attachments, may contain sensitive and/or confidential information and is intended only for the individual or entity to which it is addressed. Any unauthorized review, dissemination, distribution, or copying of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and delete and destroy all copies of the original message. |
|
From: Ari R. <ar...@cs...> - 2025-04-22 12:28:52
|
Hi Lee, Thanks for the confirmation of what I've been seeing. I've even tried adding "disableSNMPv3 yes" to the host.conf files for the hosts which don't do SNMPv3, but it still doesn't work. This is a sample of the host.conf files I've been trying: defVersion 2c defCommunity REDACTED disableSNMPv3 yes disableSNMPv2c no I have the feeling that once the configuration code sees any SNMPv3 parameters it can't reset them all and stop looking for SNMPv3, but I haven't looked at the source code to see. I'm afraid that this will end up being a large change for the developers, if anyone has the time to look into it and try to fix it. Thanks, Ari On Mon, Apr 21, 2025 at 5:57 PM Lee <le...@gm...> wrote: > On Mon, Apr 21, 2025 at 4: 09 PM Ari Rabinowitz wrote: > > Hi, > > I'm > trying to set up SNMP monitoring of many of our devices. Since most of them > support SNMPv3 I've set up the following in my /etc/snmp/snmp. conf: > > defVersion > ZjQcmQRYFpfptBannerStart > This Message Is From an External Sender > This message came from outside your organization. > > ZjQcmQRYFpfptBannerEnd > > On Mon, Apr 21, 2025 at 4:09 PM Ari Rabinowitz wrote: > > > > Hi, > > > > I'm trying to set up SNMP monitoring of many of our devices. Since most of them support SNMPv3 I've set up the following in my /etc/snmp/snmp.conf: > > defVersion 3 > > defSecurityLevel authPriv > > defAuthType SHA > > defPrivType AES > > defAuthPassphrase REDACTED > > defPrivPassphrase REDACTED > > defSecurityName USER > > > > I'm able to override the Version 3 parameters such as defSecurityLevel, defAuthType and the passphrases for the devices which support SNMPv3 in host specific configuration files in /etc/snmp/hosts/, but I can't find any way to specify in a host-specific configuration that the host uses version 2c or version 1. Is there any way to do that, if the general default is version 3? > > There's supposed to be a way - man snmp.conf says > For example, if you wanted a particular host to use SNMPv2c by default > you could create a ˜/.snmp/hosts/NAME.conf file and in it put: > > defVersion 2c > > but it doesn't work for me > > $ cat ~/.snmp/librarysw.conf > defVersion 2c > > $ head -1 ~/.snmp/snmp.conf > defVersion 3 > > $ snmpwalk librarysw system > snmpwalk: Unknown user name (Sub-id not found: (top) -> system) > > $ snmpwalk -v 2c librarysw system > RFC1213-MIB::sysDescr.0 = STRING: "JetStream 24-Port Gigabit L2+ > Managed Switch with 4 SFP Slots" > RFC1213-MIB::sysObjectID.0 = OID: TPLINK-MIB::tplinkProducts.122 > RFC1213-MIB::sysUpTime.0 = Timeticks: (1501667371) 173 days, 19:17:53.71 > RFC1213-MIB::sysContact.0 = STRING: "https://urldefense.proofpoint.com/v2/url?u=http-3A__www.tp-2Dlink.com&d=DwIFaQ&c=009klHSCxuh5AI1vNQzSO0KGjl4nbi2Q0M1QLJX9BeE&r=7VDP4N-fj98QvYr9AY4iLJh3GBO-d7Oa-o-8TLGIA7c&m=MYTKeSiGnacxnJ8w3AdGzcCgA2JLnsgcQuQPMWbIKhdCvra1_bSjV7RkureXLW2s&s=vK-iWeKK8GncVMQdwBeD57n_nPEBXBcsmJztBro84so&e=" > RFC1213-MIB::sysName.0 = STRING: "librarysw" > RFC1213-MIB::sysLocation.0 = STRING: "Hong Kong" > RFC1213-MIB::sysServices.0 = INTEGER: 3 > > hrmmm.. the man page says ˜/.snmp/hosts/NAME.conf so let's move the > librarysw.conf file to .snmp/hosts/ and try again > > $ cat ~/.snmp/hosts/librarysw.conf > defVersion 2c > > $ snmpwalk librarysw system > snmpwalk: Unknown user name (Sub-id not found: (top) -> system) > > still no :( > > Regards > Lee > > |
|
From: Lee <le...@gm...> - 2025-04-21 21:57:53
|
On Mon, Apr 21, 2025 at 4:09 PM Ari Rabinowitz wrote:
>
> Hi,
>
> I'm trying to set up SNMP monitoring of many of our devices. Since most of them support SNMPv3 I've set up the following in my /etc/snmp/snmp.conf:
> defVersion 3
> defSecurityLevel authPriv
> defAuthType SHA
> defPrivType AES
> defAuthPassphrase REDACTED
> defPrivPassphrase REDACTED
> defSecurityName USER
>
> I'm able to override the Version 3 parameters such as defSecurityLevel, defAuthType and the passphrases for the devices which support SNMPv3 in host specific configuration files in /etc/snmp/hosts/, but I can't find any way to specify in a host-specific configuration that the host uses version 2c or version 1. Is there any way to do that, if the general default is version 3?
There's supposed to be a way - man snmp.conf says
For example, if you wanted a particular host to use SNMPv2c by default
you could create a ˜/.snmp/hosts/NAME.conf file and in it put:
defVersion 2c
but it doesn't work for me
$ cat ~/.snmp/librarysw.conf
defVersion 2c
$ head -1 ~/.snmp/snmp.conf
defVersion 3
$ snmpwalk librarysw system
snmpwalk: Unknown user name (Sub-id not found: (top) -> system)
$ snmpwalk -v 2c librarysw system
RFC1213-MIB::sysDescr.0 = STRING: "JetStream 24-Port Gigabit L2+
Managed Switch with 4 SFP Slots"
RFC1213-MIB::sysObjectID.0 = OID: TPLINK-MIB::tplinkProducts.122
RFC1213-MIB::sysUpTime.0 = Timeticks: (1501667371) 173 days, 19:17:53.71
RFC1213-MIB::sysContact.0 = STRING: "www.tp-link.com"
RFC1213-MIB::sysName.0 = STRING: "librarysw"
RFC1213-MIB::sysLocation.0 = STRING: "Hong Kong"
RFC1213-MIB::sysServices.0 = INTEGER: 3
hrmmm.. the man page says ˜/.snmp/hosts/NAME.conf so let's move the
librarysw.conf file to .snmp/hosts/ and try again
$ cat ~/.snmp/hosts/librarysw.conf
defVersion 2c
$ snmpwalk librarysw system
snmpwalk: Unknown user name (Sub-id not found: (top) -> system)
still no :(
Regards
Lee
|
|
From: Ari R. <ar...@cs...> - 2025-04-21 20:07:32
|
Hi, I'm trying to set up SNMP monitoring of many of our devices. Since most of them support SNMPv3 I've set up the following in my /etc/snmp/snmp.conf: defVersion 3 defSecurityLevel authPriv defAuthType SHA defPrivType AES defAuthPassphrase REDACTED defPrivPassphrase REDACTED defSecurityName USER I'm able to override the Version 3 parameters such as defSecurityLevel, defAuthType and the passphrases for the devices which support SNMPv3 in host specific configuration files in /etc/snmp/hosts/, but I can't find any way to specify in a host-specific configuration that the host uses version 2c or version 1. Is there any way to do that, if the general default is version 3? I'm running NET-SNMP version: 5.9.1 on an Ubuntu 24.04 system. Thanks, Ari -- Ari Rabinowitz Systems Administrator IT Infrastructure and Support Computer Science Department Columbia University Tel: 212-853-8418 |
|
From: <so...@te...> - 2025-04-10 08:40:03
|
It seems that --enable-shared=yes is not working (for me). I tried compiling with MS Visual Studio and get the netsnmp.dll in the bin folder. More details here: https://stackoverflow.com/questions/79564857/net-snmp-compiles-fine-but-missing-dll thx ________________________________ From: so...@te... Sent: Wednesday, April 9, 2025 9:09 AM To: Net...@li... Subject: No DLL when compiling with msys2 Dear All, I am compiling fine and get all executables and static libs, but don't get any DLL build. Windows 10, Msys2, configure: ./configure --prefix="c:/snmp" --with-mibdirs="c:/snmp/share/snmp/mibs" --with-mib-modules="agentx disman/event-mib winExtDLL examples/example" --disable-embedded-perl --without-perl-modules --enable-shared=yes --with-defaults Thank you for any hints. BR _______________________________________________ Net-snmp-users mailing list Net...@li... Please see the following page to unsubscribe or change other options: https://lists.sourceforge.net/lists/listinfo/net-snmp-users |
|
From: <so...@te...> - 2025-04-09 16:26:35
|
Dear All, I am compiling fine and get all executables and static libs, but don't get any DLL build. Windows 10, Msys2, configure: ./configure --prefix="c:/snmp" --with-mibdirs="c:/snmp/share/snmp/mibs" --with-mib-modules="agentx disman/event-mib winExtDLL examples/example" --disable-embedded-perl --without-perl-modules --enable-shared=yes --with-defaults Thank you for any hints. BR |
|
From: Wilhelm G. <ne...@er...> - 2025-03-31 08:06:35
|
Hello, Do you have an idea why the error below occours? If we remove any OIDs the command it is working… Not Working because too long / to much OIDs: /usr/bin/snmpget -OQne -v 3 -u username -A PASSWORD -l authNoPriv -a MD5 -t 10 172.20.1.23 1.3.6.1.4.1.6574.1.5.1.0 1.3.6.1.4.1.6574.1.5.2.0 1.3.6.1.4.1.6574.1.5.3.0 1.3.6.1.4.1.6574.1.1.0 1.3.6.1.4.1.6574.1.2.0 1.3.6.1.4.1.6574.1.3.0 1.3.6.1.4.1.6574.1.4.1.0 1.3.6.1.4.1.6574.1.4.2.0 1.3.6.1.4.1.6574.2.1.1.2.0 1.3.6.1.4.1.6574.2.1.1.3.0 1.3.6.1.4.1.6574.2.1.1.5.0 1.3.6.1.4.1.6574.2.1.1.6.0 1.3.6.1.4.1.6574.2.1.1.2.1 1.3.6.1.4.1.6574.2.1.1.3.1 1.3.6.1.4.1.6574.2.1.1.5.1 1.3.6.1.4.1.6574.2.1.1.6.1 1.3.6.1.4.1.6574.2.1.1.2.2 1.3.6.1.4.1.6574.2.1.1.3.2 1.3.6.1.4.1.6574.2.1.1.5.2 1.3.6.1.4.1.6574.2.1.1.6.2 1.3.6.1.4.1.6574.2.1.1.2.3 1.3.6.1.4.1.6574.2.1.1.3.3 1.3.6.1.4.1.6574.2.1.1.5.3 1.3.6.1.4.1.6574.2.1.1.6.3 1.3.6.1.4.1.6574.2.1.1.2.4 1.3.6.1.4.1.6574.2.1.1.3.4 1.3.6.1.4.1.6574.2.1.1.5.4 1.3.6.1.4.1.6574.2.1.1.6.4 1.3.6.1.4.1.6574.2.1.1.2.5 1.3.6.1.4.1.6574.2.1.1.3.5 1.3.6.1.4.1.6574.2.1.1.5.5 1.3.6.1.4.1.6574.2.1.1.6.5 1.3.6.1.4.1.6574.2.1.1.2.6 1.3.6.1.4.1.6574.2.1.1.3.6 1.3.6.1.4.1.6574.2.1.1.5.6 1.3.6.1.4.1.6574.2.1.1.6.6 1.3.6.1.4.1.6574.2.1.1.2.7 1.3.6.1.4.1.6574.2.1.1.3.7 1.3.6.1.4.1.6574.2.1.1.5.7 1.3.6.1.4.1.6574.2.1.1.6.7 1.3.6.1.4.1.6574.2.1.1.2.8 1.3.6.1.4.1.6574.2.1.1.3.8 1.3.6.1.4.1.6574.2.1.1.5.8 1.3.6.1.4.1.6574.2.1.1.6.8 1.3.6.1.4.1.6574.2.1.1.2.9 1.3.6.1.4.1.6574.2.1.1.3.9 1.3.6.1.4.1.6574.2.1.1.5.9 1.3.6.1.4.1.6574.2.1.1.6.9 1.3.6.1.4.1.6574.2.1.1.2.10 1.3.6.1.4.1.6574.2.1.1.3.10 1.3.6.1.4.1.6574.2.1.1.5.10 1.3.6.1.4.1.6574.2.1.1.6.10 1.3.6.1.4.1.6574.2.1.1.2.11 1.3.6.1.4.1.6574.2.1.1.3.11 Working example with less oids: /usr/bin/snmpget -OQne -v 3 -u username -A PASSWORD -l authNoPriv -a MD5 -t 10 172.20.1.23 1.3.6.1.4.1.6574.1.5.1.0 1.3.6.1.4.1.6574.1.5.2.0 1.3.6.1.4.1.6574.1.5.3.0 1.3.6.1.4.1.6574.1.1.0 1.3.6.1.4.1.6574.1.2.0 1.3.6.1.4.1.6574.1.3.0 1.3.6.1.4.1.6574.1.4.1.0 1.3.6.1.4.1.6574.1.4.2.0 1.3.6.1.4.1.6574.2.1.1.2.0 1.3.6.1.4.1.6574.2.1.1.3.0 1.3.6.1.4.1.6574.2.1.1.5.0 1.3.6.1.4.1.6574.2.1.1.6.0 1.3.6.1.4.1.6574.2.1.1.2.1 1.3.6.1.4.1.6574.2.1.1.3.1 1.3.6.1.4.1.6574.2.1.1.5.1 1.3.6.1.4.1.6574.2.1.1.6.1 1.3.6.1.4.1.6574.2.1.1.2.2 1.3.6.1.4.1.6574.2.1.1.3.2 1.3.6.1.4.1.6574.2.1.1.5.2 1.3.6.1.4.1.6574.2.1.1.6.2 1.3.6.1.4.1.6574.2.1.1.2.3 1.3.6.1.4.1.6574.2.1.1.3.3 1.3.6.1.4.1.6574.2.1.1.5.3 1.3.6.1.4.1.6574.2.1.1.6.3 1.3.6.1.4.1.6574.2.1.1.2.4 1.3.6.1.4.1.6574.2.1.1.3.4 1.3.6.1.4.1.6574.2.1.1.5.4 1.3.6.1.4.1.6574.2.1.1.6.4 1.3.6.1.4.1.6574.2.1.1.2.5 1.3.6.1.4.1.6574.2.1.1.3.5 1.3.6.1.4.1.6574.2.1.1.5.5 1.3.6.1.4.1.6574.2.1.1.6.5 1.3.6.1.4.1.6574.2.1.1.2.6 1.3.6.1.4.1.6574.2.1.1.3.6 1.3.6.1.4.1.6574.2.1.1.5.6 1.3.6.1.4.1.6574.2.1.1.6.6 1.3.6.1.4.1.6574.2.1.1.2.7 1.3.6.1.4.1.6574.2.1.1.3.7 1.3.6.1.4.1.6574.2.1.1.5.7 1.3.6.1.4.1.6574.2.1.1.6.7 1.3.6.1.4.1.6574.2.1.1.2.8 1.3.6.1.4.1.6574.2.1.1.3.8 1.3.6.1.4.1.6574.2.1.1.5.8 1.3.6.1.4.1.6574.2.1.1.6.8 1.3.6.1.4.1.6574.2.1.1.2.9 1.3.6.1.4.1.6574.2.1.1.3.9 1.3.6.1.4.1.6574.2.1.1.5.9 1.3.6.1.4.1.6574.2.1.1.6.9 1.3.6.1.4.1.6574.2.1.1.2.10 1.3.6.1.4.1.6574.2.1.1.3.10 1.3.6.1.4.1.6574.2.1.1.5.10 1.3.6.1.4.1.6574.2.1.1.6.10 Thank you, Wilhelm |
|
From: Janne P. <jpa...@gm...> - 2025-03-10 19:01:15
|
Hello, Background: I have a C/C++ .so agent module for snmpd. It works correctly. However, now I am thinking about making it more resistant to brute-forcing. Lets say I want to block the user if they make 5 failed requests in a row (a naive example). I was thinking about capturing the request during auth stage, verifying the user credentials "manually" (then continuing the normal processing) and keeping track of failed requests per user. Is there any possibility using the Net-SNMP to achieve anything like this? All kinds of ideas are appreciated. Even those needing to extend the library/snmpd functionality. Regards, Janne Paalijarvi |
|
From: Turritopsis D. T. En M. <teo...@pr...> - 2025-01-30 16:03:52
|
Subject: Mr. Teo En Ming's Refugee Seeking Attempts as of 31 Jan 2025 Good day from Singapore, My name is Mr. Turritopsis Dohrnii Teo En Ming (Zhang Enming) @ Time Traveller. I am a Singapore Citizen, and was born in Singapore in 1978. I have attempted to apply for political asylum and refugee status in the following countries. [01] United Nations High Commissioner for Refugees (UNHCR) Bangkok, Thailand I flew from Singapore to Bangkok, Thailand on 21 March 2017. Upon arrival at the airport, I took a taxi to UNHCR Bangkok building. A UNHCR Bangkok staff told me I would need to spend a few months waiting in Bangkok for the first interview. The UNHCR Bangkok staff told me there is no refugee shelter in Bangkok and there is no financial assistance whatsoever. At that time, SGD$300 is all the money that I had. I realized that I won't have enough money to book a hotel in Bangkok and pay for all expenses while waiting in Bangkok for a few months. I definitely won't be able to survive in Bangkok for a few months with just SGD$300 in my bank account. I flew back to Singapore on 22 March 2017. After I returned to Singapore, UNHCR Bangkok informed me that I do not qualify to be a refugee. [02] Taiwan (Republic of China) I had applied for refugee status in person at the National Immigration Agency Ministry of the Interior in Taipei on 5 Aug 2019. Documents were submitted to the Director of the National Immigration Agency. Taiwanese immigration informed me that Taiwan does not have refugee laws and Taiwan does not accept refugees. I have not received any response from the Taiwanese government ever since. [03] Australia There is Form 842 - Application for an offshore humanitarian visa - Refugee and Humanitarian (Class XB) visa. On 25 Dec 2019 (Christmas Day), I sent Form 842 by DHL to the following address in Australia. Visa and Citizenship office - Canberra Australian Capital Territory (ACT) Department of Home Affairs Australian Government 3 Lonsdale Street Braddon ACT 2612 Australia The Australian Department of Home Affairs NSW received my Form 842 on 27 Dec 2019. Then on 8 Jan 2020, I sent Form 842 by postal mail to the Australian High Commission in Singapore. On 17 Jan 2020 Friday at 1.25 PM, I received a call from Jennifer at the Australian High Commission in Singapore. On 10 Mar 2020 Tuesday at 3.38 PM, I received another telephone call from Jennifer Munro at the Australian High Commission in Singapore. The Australian High Commission in Singapore had referred my refugee application to the Australian High Commission in Kuala Lumpur, Malaysia. On 10 Mar 2020, I received a letter from the Australian High Commission in Kuala Lumpur with the Subject: Acknowledgement of valid application for a REFUGEE AND HUMANITARIAN (Class XB) IN-COUNTRY SPECIAL HUMANITARIAN PROGRAM (Subclass 201) visa. On 23 Apr 2020, I had received a final letter from the Australian High Commission in Kuala Lumpur with the Subject: Notification of the refusal of a REFUGEE AND HUMANITARIAN (Class XB) IN-COUNTRY SPECIAL HUMANITARIAN PROGRAM (Subclass 201) visa. That is to say that the Australian Government had rejected my refugee application. In the letter, the Australian Government recognized that I faced some degree of discrimination in Singapore but I still do not meet the requirements for a refugee visa. [04] United Kingdom of Great Britain and Northern Ireland (UK) On 22 Oct 2023, I flew from Singapore to Shanghai and then from Shanghai to London by Air China airline. I arrived at London Gatwick Airport on 23 Oct 2023. Upon arrival, I applied for refugee status at the airport immediately. British immigration officers and London Gatwick Airport personnel told me: (a) they have no idea how long the refugee status application processing may take. (b) but the Worst Case Scenario was that I may need to wait for up to 5 years in a detention center. (c) I will not be able to work or have a job in the UK for up to 5 years, until refugee status application is approved. Hence I will have no income for up to 5 years. (d) I will not be able to step out of the detention center for up to 5 years and cannot go to coffee shops and shopping malls in the UK freely, until refugee status application is approved. Even if refugee status application is approved: (e) I will not be able to go back to Singapore to bring my elderly mother to the UK (f) The British Government will not pay for my mother's stay in a mental hospital in the UK (g) I will not be able to go back to Singapore to bring my personal belongings to the UK (h) I will not be able to go back to Singapore to revoke my citizenship, and hence I cannot withdraw SGD$120,000 from my CPF account for spending in the UK I was already 45 years old in the year 2023, if I waited for 5 years in the UK, and if Refugee Status Application is not approved and the British Government deported me back to Singapore at the end of 5 years, I would have wasted a lot of my time (half a decade). Because I am very old now. At that point in time, I decided to withdraw my refugee application in the UK. After I had decided to withdraw my refugee application in the UK, I was transferred by a van from London Gatwick Airport to London Heathrow Airport. From there, the British Government fully paid for my FREE Singapore Airlines SIA SQ321 flight from London back to Singapore. I arrived in Singapore on 24 Oct 2023. [05] South Korea I flew from Singapore to Seoul, South Korea by Scoot airline on 7 Jan 2025 Tuesday. Upon arrival at Incheon Airport, I applied for refugee status immediately. I was transferred to the Refugee Waiting Room at Incheon Airport. On 9 Jan 2025 Thursday, I was interviewed by South Korean immigration with the help of an interpreter who can understand and speak English. The following day, on 10 Jan 2025 Friday, the Korean government had swiftly rejected my refugee application. One of the reasons the Korean government cited is that I had applied for refugee status in South Korea primarily and mainly out of economic reasons. But I had also informed the Korean government that I have government-induced schizophrenia mental illness and lots of numerous government-induced health and medical problems (slow kill). The Korean government then asked me to purchase a Scoot air ticket to fly back to Singapore. I was transferred from the Refugee Waiting Room to the Departure Waiting Room at Incheon Airport on 10 Jan 2025 Friday. I was allowed to roam the whole of Incheon Airport Terminal 1 with the exception of the concourse. On 11 Jan 2025 Saturday at 10 pm, I took the Scoot flight from Incheon Airport back to Singapore. I arrived in Singapore on 12 Jan 2025 Sunday in the early hours of the morning. Regards, Mr. Turritopsis Dohrnii Teo En Ming Targeted Individual in Singapore |
|
From: Lokesh M. <lok...@gm...> - 2025-01-30 09:30:08
|
corrected typo: On Thu, Jan 30, 2025 at 2:56 PM Lokesh Mogra <lok...@gm...> wrote: > Hi folks, > i am trying to create snmp groups and associating views with it. > and assign users to these groups. I see there is no explicit way to assign > user to group. > Am i missing some configuration? > > This is the configuration i am doing: > > # Define Views > view view1 included .1.3.6.1.2.1 > view view2 included .1 > view view2 excluded .1.3.6.1.2.1 > > # Define Groups > group group1 usm authPriv > access group1 "" any authPriv exact view1 none none > group group2 usm authNoPriv > access group2 "" any authNoPriv exact view2 none none > > # Define Users > createUser user1 SHA authpass1 AES encryptpass1 > #rouser user1 authPriv > createUser user2 SHA authpass2 > #rouser user2 authNoPriv > > If I dont write rouser for users, snmpwalk doesnt work. > # snmpwalk -v3 -u user2 -l authNoPriv -a SHA -A "authpass2" 10.225.2.143 > Error in packet. > Reason: authorizationError (access denied to that object) > if I write rouser, then the view2 which I want for user2 doesnt work, and > everything gets accessed. > Appreciate your help !!!! > > regards > Lokesh Mogra > |
|
From: Lokesh M. <lok...@gm...> - 2025-01-30 09:27:10
|
Hi folks, i am trying to create snmp groups and associating views with it. and assign users to these groups. I see there is no explicit way to assign user to group. Am i missing some configuration? This is the configuration i am doing: # Define Views view view1 included .1.3.6.1.2.1 view view2 included .1 view view2 excluded .1.3.6.1.2.1 # Define Groups group group1 usm authPriv access group1 "" any authPriv exact view1 none none group group2 usm authNoPriv access group2 "" any authNoPriv exact view2 none none # Define Users createUser user1 SHA authpass1 AES encryptpass1 #rouser user1 authPriv createUser user2 SHA authpass2 #rouser user2 authNoPriv If I dont write rouser for users, snmpwalk doesnt work. # snmpwalk -v3 -u user2 -l authPriv -a SHA -A "authpass2" 10.225.2.143 Error in packet. Reason: authorizationError (access denied to that object) if I write rouser, then the view2 which I want for user2 doesnt work, and everything gets accessed. Appreciate your help !!!! regards Lokesh Mogra |
|
From: Amber B. <amb...@br...> - 2024-12-24 07:21:56
|
Hello All, This thread is 3 years older, and it was recommended that I use v5.9.1. I checked that Ubuntu and Rocky Linux are still using this version. Could you please help me out here with which version to use? I visited the official NetSnmp website and found that the currently supported version is 5.9.4, so should I use 5.9.1 or v5.9.4? I asked this because we are using v5.8.x version that is now EOL. I also learned from netsnmp threads that the branch will be maintained only for the supported version, i.e., 5.9.4 or master. Thanks, Amber -- This electronic communication and the information and any files transmitted with it, or attached to it, are confidential and are intended solely for the use of the individual or entity to whom it is addressed and may contain information that is confidential, legally privileged, protected by privacy laws, or otherwise restricted from disclosure to anyone else. If you are not the intended recipient or the person responsible for delivering the e-mail to the intended recipient, you are hereby notified that any use, copying, distributing, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you received this e-mail in error, please return the e-mail to the sender, delete it from your computer, and destroy any printed copy of it. |
|
From: Amber B. <amb...@br...> - 2024-12-20 02:33:39
|
Hello, I am planning to use the Net SNMP v5.9.4 version. However, I cannot find the release frequency or support period. Please let me know if anyone has any information. Thanks, Amber -- This electronic communication and the information and any files transmitted with it, or attached to it, are confidential and are intended solely for the use of the individual or entity to whom it is addressed and may contain information that is confidential, legally privileged, protected by privacy laws, or otherwise restricted from disclosure to anyone else. If you are not the intended recipient or the person responsible for delivering the e-mail to the intended recipient, you are hereby notified that any use, copying, distributing, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you received this e-mail in error, please return the e-mail to the sender, delete it from your computer, and destroy any printed copy of it. |
|
From: David R A. <da...@mr...> - 2024-12-15 21:42:30
|
I found a solution for "error finding server identity keys" 1. Looking at debug output showed the certificates were being searched for in /usr/local/share/snmp/tls 2. By supplying a file path [snmp] localCert /usr/local/share/snmp/tls/certs/snmpd.crt I was doing nothing other than supplying the same thing again - It needed to be the fingerprint. Which I only had in my comments. 3. Debug also showed that the default port was 10161 not 1161 which I had found in the Ubuntu man pages. Although this was not the reason for "error finding server identity keys". Here is a set of instructions for a successful configuration of SNMP over TLS/TCP that users may find useful. SNMP v3 Using TLS over TCP - Instructions for testing localhost connection client/server on 127.0.0.1 using Linux Subsystem for Windows, VM, or single native-linux machine to confirm successful configuration/operation of secure SNMP communication which may be mandatory on some networks. This uses only a basic snmpd.conf configuration, with no accompanying snmp.conf file, together with the most basic of command line client requests. Only available for Unix based platforms like Linux (no Windows unless running VM or WSL) When you have compiled source code with OpenSSL support (not covered here) you should be able to verify your build like: In my case: $ net-snmp-config --version 5.9.4 $ net-snmp-config --config-options '--with-security-modules=tsm' '--with-transports=TLSTCP,DTLSUDP' '--with-mib-modules=tsm-mib' Create your own certificate authority certificate & use it to sign your server/client certificates using net-snmp-cert utility supplied by net-snmp. Steps: certificate authority certificate & key > certificate signing requests for snmpd & manager > signing of snmpd & manager certificates. net-snmp-cert genca -I -n ca.snmp.dev CA Generated: ca-certs/ca.snmp.dev.crt private/ca.snmp.dev.key ~/.snmp$ net-snmp-cert gencsr -I -t snmpd -n snmp.dev Certificate Signing Request Generated: newcerts/snmpd.csr private/snmpd.key ~/.snmp$ net-snmp-cert gencsr -I -t manager -n danderson Certificate Signing Request Generated: newcerts/manager.csr private/manager.key :~/.snmp$ net-snmp-cert signcsr -I --with-ca ca.snmp.dev --csr snmpd Signed Certificate Signing Request: newcerts/snmpd.csr with CA: ca-certs/ca.snmp.dev.crt private/ca.snmp.dev.key Generated Certificate: newcerts/snmpd.crt ~/.snmp$ net-snmp-cert signcsr -I --with-ca ca.snmp.dev --csr manager Signed Certificate Signing Request: newcerts/manager.csr with CA: ca-certs/ca.snmp.dev.crt private/ca.snmp.dev.key Generated Certificate: newcerts/manager.crt Copy tls directory with certificates to default file location /usr/local/share/snmp Server/Client fingerprints (manager/peer) manager = 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 snmpd = 70:3E:91:F9:2D:E9:16:05:F8:6F:D0:A3:BD:85:1D:CC:45:7D:56:2D Config file snmpd.conf - minimum lines required Step 1: Testing the server snmpd with just these two lines agentaddress tlstcp:127.0.0.1:10161 [snmp] localCert 70:3E:91:F9:2D:E9:16:05:F8:6F:D0:A3:BD:85:1D:CC:45:7D:56:2D Start Server with TLS Debug sudo /usr/local/sbin/snmpd -f -Lo -Dtls -C -c snmpd.conf Output registered debug token tls, 1 tlstcp: registering TLS constructor tlstcp: listening on tlstcp port 127.0.0.1:10161 NET-SNMP version 5.9.4 Step 2: Add manager details into snmpd.conf in order to use the TLS connection certSecName 10 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --sn danderson rwuser -s tsm danderson auth rwuser danderson auth system syscontact david@xxxxxxxxxx # Add in some information we will transfer from server to client Start snmpd server in a Linux terminal in the same directory as snmpd.conf Run the following in another terminal from any directory (no snmp.conf file yet) With debugging -D of tls optional e.g. -Dtls sudo snmpget -v 3 --defSecurityModel=tsm -u manager \ -l authPriv -T localCert=4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 \ -T peerCert=70:3E:91:F9:2D:E9:16:05:F8:6F:D0:A3:BD:85:1D:CC:45:7D:56:2D -Dtls \ tlstcp:127.0.0.1:10161 sysContact.0 Result NMPv2-MIB::sysContact.0 = STRING: david@xxxxxxxxxxx Not much output. In this case, just a line from snmpd.conf transferred from server to client. But it proves the SNMP over TLS/TCP has been successful. This should now work for more useful exercises using snmpget/snmpwalk etc. Debugging options (when things predictably don’t go to plan) Checking the server is listening Command: sudo netstat -tlnp | grep 10161 For checking the output for tls, certs information use -Dtls or -DCerts When things got tough I found -D9 useful See: https://net-snmp.sourceforge.io/wiki/index.php/Debug_tokens References that I found helpful Quick setup of SNMP v3 DTLS/TLS access in CentOS/RHEL 7 Linux - net-snmp <https://www.youtube.com/watch?v=BTEFwYbGJ-8> https://net-snmp.sourceforge.io/wiki/index.php/TUT:Using_TLS On Fri, Dec 13, 2024 at 11:09 AM David R Anderson <da...@mr...> wrote: > NET-SNMP version: 5.9.4 > net-snmp-config --config-options > '--with-security-modules=tsm' '--with-transports=TLSTCP,DTLSUDP' > '--with-mib-modules=tsm-mib' > > OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.4.0 22 Oct 2024) > > OS > Welcome to Ubuntu 24.04.1 LTS (GNU/Linux > 5.15.167.4-microsoft-standard-WSL2 x86_64) > > Relevant config lines snmpd.conf - No snmp.conf used > agentaddress tlstcp:1161 > > # certificate local defines the default X.509 public key to use as the > server's identity (man pgs Ubuntu snmpd.conf) > [snmp] localCert /usr/local/share/snmp/tls/certs/snmpd.crt > > # certificate common name danderson e.g CN = danderson > # /usr/local/share/snmp/tls/certs/manager.crt: SHA1 > Fingerprint=4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 > certSecName 10 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 > --cn > > # SNMP v3 user. Security model -s > rwuser -s tsm danderson auth > > Output from snmpd using: sudo /usr/local/sbin/snmpd -f -Lo -Dcert -C -c > snmpd.conf > ---->snip<--- > cert:dump: ------------------------ End ---------------------- > cert:util:config: parsing 10 > 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --cn > cert:find:params: looking for remote_peer(2) in MULTIPLE(0x200), hint > 0x7ffd493e92d0 > cert:find:params: looking for remote_peer(2) in FINGERPRINT(0x2), hint > 0x7ffd493e92d0 > cert:find:params: hint = > 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 > cert:find:found: using cert manager.crt / > 4adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2) > (uses=identity+remote_peer (3)) > cert:find:found: using cert manager.crt / > 4adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2) > (uses=identity+remote_peer (3)) > cert:map:add: pri 10, fp 4adb1f38c859e90958dfcc4a5f30394a53fb3198 > cert:find:params: looking for identity(1) in DEFAULT(0x0), hint (nil) > cert:find:params: looking for identity(1) in MULTIPLE(0x200), hint > 0x5573fdf68c60 > cert:find:params: looking for identity(1) in FINGERPRINT(0x2), hint > 0x5573fdf68c60 > cert:find:params: hint = /usr/local/share/snmp/tls/certs/snmpd.crt > cert:find:params: looking for identity(1) in FILE(0x1), hint 0x5573fdf68c60 > cert:find:params: hint = /usr/local/share/snmp/tls/certs/snmpd.crt > error finding server identity keys > > I have tested the certificates/keys using: > sudo openssl s_server -cert /usr/local/share/snmp/tls/certs/snmpd.crt -key > /usr/local/share/snmp/tls/private/snmpd.key -CAfile > /usr/local/share/snmp/tls/ca-certs/ca.snmp.dev.crt -accept 1161 -tls1_2 > -www > > sudo openssl s_client -connect 127.0.0.1:1161 -tls1_2 -CAfile > /usr/local/share/snmp/tls/ca-certs/ca.snmp.dev.crt -cert > /usr/local/share/snmp/tls/certs/manager.crt -key > /usr/local/share/snmp/tls/private/manager.key > > All good with the certificates generated using *net-snmp-cert* > > This error appears a number of times in the net-snmp mailing list archives > - without any obvious explanation or fix. If this is a: "well you're not > running on a native Linux machine" problem then it would be really helpful > to have it fixed. Since Linux is being run more often than ever on Windows > machines. > > I have found the code references and could possibly recompile with > additional debug lines. But I was hoping someone may have an easier > solution. > > Regards > David Anderson > > |
|
From: David R A. <da...@mr...> - 2024-12-12 22:34:30
|
NET-SNMP version: 5.9.4 net-snmp-config --config-options '--with-security-modules=tsm' '--with-transports=TLSTCP,DTLSUDP' '--with-mib-modules=tsm-mib' OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.4.0 22 Oct 2024) OS Welcome to Ubuntu 24.04.1 LTS (GNU/Linux 5.15.167.4-microsoft-standard-WSL2 x86_64) Relevant config lines snmpd.conf - No snmp.conf used agentaddress tlstcp:1161 # certificate local defines the default X.509 public key to use as the server's identity (man pgs Ubuntu snmpd.conf) [snmp] localCert /usr/local/share/snmp/tls/certs/snmpd.crt # certificate common name danderson e.g CN = danderson # /usr/local/share/snmp/tls/certs/manager.crt: SHA1 Fingerprint=4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 certSecName 10 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --cn # SNMP v3 user. Security model -s rwuser -s tsm danderson auth Output from snmpd using: sudo /usr/local/sbin/snmpd -f -Lo -Dcert -C -c snmpd.conf ---->snip<--- cert:dump: ------------------------ End ---------------------- cert:util:config: parsing 10 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --cn cert:find:params: looking for remote_peer(2) in MULTIPLE(0x200), hint 0x7ffd493e92d0 cert:find:params: looking for remote_peer(2) in FINGERPRINT(0x2), hint 0x7ffd493e92d0 cert:find:params: hint = 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 cert:find:found: using cert manager.crt / 4adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2) (uses=identity+remote_peer (3)) cert:find:found: using cert manager.crt / 4adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2) (uses=identity+remote_peer (3)) cert:map:add: pri 10, fp 4adb1f38c859e90958dfcc4a5f30394a53fb3198 cert:find:params: looking for identity(1) in DEFAULT(0x0), hint (nil) cert:find:params: looking for identity(1) in MULTIPLE(0x200), hint 0x5573fdf68c60 cert:find:params: looking for identity(1) in FINGERPRINT(0x2), hint 0x5573fdf68c60 cert:find:params: hint = /usr/local/share/snmp/tls/certs/snmpd.crt cert:find:params: looking for identity(1) in FILE(0x1), hint 0x5573fdf68c60 cert:find:params: hint = /usr/local/share/snmp/tls/certs/snmpd.crt error finding server identity keys I have tested the certificates/keys using: sudo openssl s_server -cert /usr/local/share/snmp/tls/certs/snmpd.crt -key /usr/local/share/snmp/tls/private/snmpd.key -CAfile /usr/local/share/snmp/tls/ca-certs/ca.snmp.dev.crt -accept 1161 -tls1_2 -www sudo openssl s_client -connect 127.0.0.1:1161 -tls1_2 -CAfile /usr/local/share/snmp/tls/ca-certs/ca.snmp.dev.crt -cert /usr/local/share/snmp/tls/certs/manager.crt -key /usr/local/share/snmp/tls/private/manager.key All good with the certificates generated using *net-snmp-cert* This error appears a number of times in the net-snmp mailing list archives - without any obvious explanation or fix. If this is a: "well you're not running on a native Linux machine" problem then it would be really helpful to have it fixed. Since Linux is being run more often than ever on Windows machines. I have found the code references and could possibly recompile with additional debug lines. But I was hoping someone may have an easier solution. Regards David Anderson |
|
From: Simon C. <sim...@mp...> - 2024-12-05 21:54:28
|
Hi, When I use *snmptable* command to get a table: - when all entries of the tables are STRINGS, no problem, I get the table. - when onf the entry of the table is an integer and the rest are strings, I get the following error message: *Wrong Type (should be INTEGER)* Is there a way to prevent the error message? Thanks, S. |
|
From: gday vw <gd...@gm...> - 2024-11-24 01:35:04
|
Hello Lee,
snmptranslate -IR -On unifiIfRxBytes
Warning: Module UBNT-MIB was in /usr/share/snmp/mibs/UBNT-MIB now is
/usr/share/snmp/mibs/UBNT-UniFi-MIB
Unknown object identifier: unifiIfRxBytes
zen@debian11-DR6:~$ snmptranslate .1.3.6.1.4.1.41112.1.6.2.1.1.6
Warning: Module UBNT-MIB was in /usr/share/snmp/mibs/UBNT-MIB now is
/usr/share/snmp/mibs/UBNT-UniFi-MIB
iso.3.6.1.4.1.41112.1.6.2.1.1.6
So it looks like there is smoething wrong with my setup.
I have replaced the Unifi MIB files as suggested.
zen@debian11-DR6:~$ cat .snmp/snmp.conf
defVersion 1
defCommunity public
showMibErrors yes
# showMibErrors no
# whether to display MIB parsing errors.
# mibWarningLevel 0
mibWarningLevel 1
# mibWarningLevel 9
# whether to show warning messages in parsing MIB files
mibdirs /usr/share/snmp/mibs
zen@debian11-DR6:/usr/share/snmp/mibs$ grep unifiIfRxBytes *
zen@debian11-DR6:/usr/share/snmp/mibs$ ls UBNT*
UBNT-MIB UBNT-UniFi-MIB
zen@debian11-DR6:/usr/share/snmp/mibs$
I'm surprised that the grep unifiIfRxBytes doesn't return a result?
Vaughan
On Sun, Nov 24, 2024 at 11:34 AM Lee <le...@gm...> wrote:
> On Wed, Nov 20, 2024 at 4:01 PM gday vw wrote:
> >
> > > just curious: do you actually have an LS1010 in your network?
> > > The last time I worked with them was around the turn of the century
> > > along with LANE blades in the cat5000s
> >
> > No, I was using the snmptranslate query to hopefully confirm that my
> snmp environment was working.
> > That is the example in the wiki and initially the snmptranslate query
> didn't work in my environment as I didn't have many of the needed mib files.
>
> Thanks... I was thinking it'd be a bit strange if someone was still
> using LS1010s today :)
>
> > root@DavoUnraid:/usr/share/snmp/mibs# grep unifiIfIndex *
> > UI-UniFi-MIB: INDEX { unifiIfIndex }
> > UI-UniFi-MIB: unifiIfIndex ObjectIndex,
> > UI-UniFi-MIB:unifiIfIndex OBJECT-TYPE
> >
> > grep unifiApSystem *
> > UI-UniFi-MIB:unifiApSystem OBJECT IDENTIFIER ::= { ubntUniFi 3 }
> > UI-UniFi-MIB:unifiApSystemIp OBJECT-TYPE
> > UI-UniFi-MIB: ::= { unifiApSystem 1 }
> > UI-UniFi-MIB:unifiApSystemIsolated OBJECT-TYPE
> > UI-UniFi-MIB: ::= { unifiApSystem 2 }
> > UI-UniFi-MIB:unifiApSystemModel OBJECT-TYPE
> > UI-UniFi-MIB: ::= { unifiApSystem 3 }
> > UI-UniFi-MIB:unifiApSystemUplink OBJECT-TYPE
> > UI-UniFi-MIB: ::= { unifiApSystem 4 }
> > UI-UniFi-MIB:unifiApSystemUptime OBJECT-TYPE
> > UI-UniFi-MIB: ::= { unifiApSystem 5 }
> > UI-UniFi-MIB:unifiApSystemVersion OBJECT-TYPE
> > UI-UniFi-MIB: ::= { unifiApSystem 6 }
> > UI-UniFi-MIB:unifiApSystemGroup OBJECT-GROUP OBJECTS {
> > UI-UniFi-MIB: unifiApSystemIp, unifiApSystemIsolated,
> unifiApSystemModel, unifiApSystemUplink, unifiApSystemUptime,
> unifiApSystemVersion
> >
>
> hrmm... they're there but I don't see anything in your output mentioning
> them..
> Can you try moving the UniFi MIBs aside and downloading these files
> into your /usr/share/snmp/mibs directory:
> http://dl.ubnt-ut.com/snmp/UBNT-MIB
> http://dl.ubnt-ut.com/snmp/UBNT-UniFi-MIB
>
> With this bit in my ~/.snmp/snmp.conf
>
> showMibErrors yes
> # showMibErrors no
> # whether to display MIB parsing errors.
>
> # mibWarningLevel 0
> mibWarningLevel 1
> # mibWarningLevel 9
> # whether to show warning messages in parsing MIB files
>
> and using the the net-snmp-5.9.4 mibs along with the above two UniFi MIBS
> I get
>
> $ snmptranslate -IR -On unifiIfRxBytes
> MODULE-IDENTITY MACRO (lines 55..79 parsed and ignored).
> OBJECT-IDENTITY MACRO (lines 81..103 parsed and ignored).
> OBJECT-TYPE MACRO (lines 212..298 parsed and ignored).
> NOTIFICATION-TYPE MACRO (lines 302..334 parsed and ignored).
> TEXTUAL-CONVENTION MACRO (lines 8..48 parsed and ignored).
> OBJECT-GROUP MACRO (lines 8..39 parsed and ignored).
> NOTIFICATION-GROUP MACRO (lines 43..73 parsed and ignored).
> MODULE-COMPLIANCE MACRO (lines 77..183 parsed and ignored).
> AGENT-CAPABILITIES MACRO (lines 187..320 parsed and ignored).
> OBJECT-TYPE MACRO (lines 25..39 parsed and ignored).
> TRAP-TYPE MACRO (lines 14..35 parsed and ignored).
> .1.3.6.1.4.1.41112.1.6.2.1.1.6
>
> lee@spot ~/Downloads/net-snmp-5.9.4/mibs
> $ snmptranslate .1.3.6.1.4.1.41112.1.6.2.1.1.6
> MODULE-IDENTITY MACRO (lines 55..79 parsed and ignored).
> OBJECT-IDENTITY MACRO (lines 81..103 parsed and ignored).
> OBJECT-TYPE MACRO (lines 212..298 parsed and ignored).
> NOTIFICATION-TYPE MACRO (lines 302..334 parsed and ignored).
> TEXTUAL-CONVENTION MACRO (lines 8..48 parsed and ignored).
> OBJECT-GROUP MACRO (lines 8..39 parsed and ignored).
> NOTIFICATION-GROUP MACRO (lines 43..73 parsed and ignored).
> MODULE-COMPLIANCE MACRO (lines 77..183 parsed and ignored).
> AGENT-CAPABILITIES MACRO (lines 187..320 parsed and ignored).
> OBJECT-TYPE MACRO (lines 25..39 parsed and ignored).
> TRAP-TYPE MACRO (lines 14..35 parsed and ignored).
> UBNT-UniFi-MIB::unifiIfRxBytes
>
> Does that work for you?
>
> Regards,
> Lee
>
|
|
From: Lee <le...@gm...> - 2024-11-24 00:34:06
|
On Wed, Nov 20, 2024 at 4:01 PM gday vw wrote:
>
> > just curious: do you actually have an LS1010 in your network?
> > The last time I worked with them was around the turn of the century
> > along with LANE blades in the cat5000s
>
> No, I was using the snmptranslate query to hopefully confirm that my snmp environment was working.
> That is the example in the wiki and initially the snmptranslate query didn't work in my environment as I didn't have many of the needed mib files.
Thanks... I was thinking it'd be a bit strange if someone was still
using LS1010s today :)
> root@DavoUnraid:/usr/share/snmp/mibs# grep unifiIfIndex *
> UI-UniFi-MIB: INDEX { unifiIfIndex }
> UI-UniFi-MIB: unifiIfIndex ObjectIndex,
> UI-UniFi-MIB:unifiIfIndex OBJECT-TYPE
>
> grep unifiApSystem *
> UI-UniFi-MIB:unifiApSystem OBJECT IDENTIFIER ::= { ubntUniFi 3 }
> UI-UniFi-MIB:unifiApSystemIp OBJECT-TYPE
> UI-UniFi-MIB: ::= { unifiApSystem 1 }
> UI-UniFi-MIB:unifiApSystemIsolated OBJECT-TYPE
> UI-UniFi-MIB: ::= { unifiApSystem 2 }
> UI-UniFi-MIB:unifiApSystemModel OBJECT-TYPE
> UI-UniFi-MIB: ::= { unifiApSystem 3 }
> UI-UniFi-MIB:unifiApSystemUplink OBJECT-TYPE
> UI-UniFi-MIB: ::= { unifiApSystem 4 }
> UI-UniFi-MIB:unifiApSystemUptime OBJECT-TYPE
> UI-UniFi-MIB: ::= { unifiApSystem 5 }
> UI-UniFi-MIB:unifiApSystemVersion OBJECT-TYPE
> UI-UniFi-MIB: ::= { unifiApSystem 6 }
> UI-UniFi-MIB:unifiApSystemGroup OBJECT-GROUP OBJECTS {
> UI-UniFi-MIB: unifiApSystemIp, unifiApSystemIsolated, unifiApSystemModel, unifiApSystemUplink, unifiApSystemUptime, unifiApSystemVersion
>
hrmm... they're there but I don't see anything in your output mentioning them..
Can you try moving the UniFi MIBs aside and downloading these files
into your /usr/share/snmp/mibs directory:
http://dl.ubnt-ut.com/snmp/UBNT-MIB
http://dl.ubnt-ut.com/snmp/UBNT-UniFi-MIB
With this bit in my ~/.snmp/snmp.conf
showMibErrors yes
# showMibErrors no
# whether to display MIB parsing errors.
# mibWarningLevel 0
mibWarningLevel 1
# mibWarningLevel 9
# whether to show warning messages in parsing MIB files
and using the the net-snmp-5.9.4 mibs along with the above two UniFi MIBS I get
$ snmptranslate -IR -On unifiIfRxBytes
MODULE-IDENTITY MACRO (lines 55..79 parsed and ignored).
OBJECT-IDENTITY MACRO (lines 81..103 parsed and ignored).
OBJECT-TYPE MACRO (lines 212..298 parsed and ignored).
NOTIFICATION-TYPE MACRO (lines 302..334 parsed and ignored).
TEXTUAL-CONVENTION MACRO (lines 8..48 parsed and ignored).
OBJECT-GROUP MACRO (lines 8..39 parsed and ignored).
NOTIFICATION-GROUP MACRO (lines 43..73 parsed and ignored).
MODULE-COMPLIANCE MACRO (lines 77..183 parsed and ignored).
AGENT-CAPABILITIES MACRO (lines 187..320 parsed and ignored).
OBJECT-TYPE MACRO (lines 25..39 parsed and ignored).
TRAP-TYPE MACRO (lines 14..35 parsed and ignored).
.1.3.6.1.4.1.41112.1.6.2.1.1.6
lee@spot ~/Downloads/net-snmp-5.9.4/mibs
$ snmptranslate .1.3.6.1.4.1.41112.1.6.2.1.1.6
MODULE-IDENTITY MACRO (lines 55..79 parsed and ignored).
OBJECT-IDENTITY MACRO (lines 81..103 parsed and ignored).
OBJECT-TYPE MACRO (lines 212..298 parsed and ignored).
NOTIFICATION-TYPE MACRO (lines 302..334 parsed and ignored).
TEXTUAL-CONVENTION MACRO (lines 8..48 parsed and ignored).
OBJECT-GROUP MACRO (lines 8..39 parsed and ignored).
NOTIFICATION-GROUP MACRO (lines 43..73 parsed and ignored).
MODULE-COMPLIANCE MACRO (lines 77..183 parsed and ignored).
AGENT-CAPABILITIES MACRO (lines 187..320 parsed and ignored).
OBJECT-TYPE MACRO (lines 25..39 parsed and ignored).
TRAP-TYPE MACRO (lines 14..35 parsed and ignored).
UBNT-UniFi-MIB::unifiIfRxBytes
Does that work for you?
Regards,
Lee
|
637 messages has been excluded from this view by a project administrator.
