Red Hat Enterprise Linux



Chapters     |     Exercises     |     Workshop     |    

Chapter 14: Simple Network Management Protocol (SNMP)

Simple Network Management Protocol (SNMP)

Service

snmpd

Installation

[root@redhat ~]# yum install net-snmp*

Files and Directories

/etc/snmp/
/etc/snmp/snmpd.conf

Configuration Steps

Files and Directories

/etc/snmp/ : Configuration Directory
/etc/snmp/snmpd.conf : Principal Configuration File

/etc/snmp/snmpd.conf Editing Steps

  1. Configuration des communautés autorisées à communiquer avec le serveur
  2. Création des groupes d'accès et leurs Relations avec les communautés
  3. Création des vues (OID explorables)
  4. Relations entre les vues et les groupes d'accès

Configuration des communautés

Toutes les machines ou tous les réseaux autorisés à communiquer avec le serveur doivent y être configurés

Syntax com2sec security-name Hostname-or-IP Community (password)


Examples

com2sec Local localhost xPzrWf # Authorise Itself connections with "xPzrWf" password

com2sec LocalNet 10.0.0.0/24 public # Authorise all hosts of 10.0.0.0/24 network connections with "public" password

com2sec LocalNet 10.0.0.11 XZw23 # Authorise host 10.0.0.11 connections with "XZw23" password

com2sec LocalNet rhgui XZw23 # Authorise host "rhgui" connections with "XZw23" password

Création des groupes d'accès

Syntax group GROUPNAME security-model security-name


security-model
v1 for Version 1
v2c for Version 2
any for any Version

Examples

Création des vues

Configuration des arborescences accessibles
Syntax view view-name included Subtree


# name incl/excl subtree mask(optional)
view view-name included .1

Examples

view systemview included .1.3.6.1.2.1.1
view systemview included .1.3.6.1.2.1.25.1.1
view AllView included .1
view mib2 included .iso.org.dod.internet.mgmt.mib-2 fc

Relations entre les vues et les groupes d'accès

Syntax access Groupname "" security-model security-Level prefix read-view-name write-view-name Notification


security-model
any (For any version)

security-Level
- noauth

prefix
- exact

read-view-name
- view-name
- none
- all

write-view-name
- view-name
- none
- all

Notification
-none

# group context sec.model sec.level prefix read write notif
#access notConfigGroup "" any noauth exact systemview none none
access RWGroup "" v2c noauth exact view-name none none
Examples

access ROGroup "" v2c noauth exact AllView none none
access RWGroup "" v2c noauth exact AllView none none

/etc/snmp/snmpd.conf

# COMMENTS

# First, map the community name "public" into a "security name"
# sec.name source community
com2sec security-name Hostname-or-IP password

source define who can request SNMP
community define a community password to access SNMP

#### GROUPS --------------------------
# Second, map the security name into a group name:

# groupName securityModel securityName
#group notConfigGroup v1 notConfigUser
#group notConfigGroup v2c notConfigUser

group GROUPNAME security-model security-name

security-model
v1 for Version 1
v2c for Version 2

####
# Third, create a view for us to let the group have rights to:
# Make at least snmpwalk -v 1 localhost -c public system fast again.
# name incl/excl subtree mask(optional)
view systemview included .1.3.6.1.2.1.1
view systemview included .1.3.6.1.2.1.25.1.1
view AllView included .1
view view-name included .1

####
# Finally, grant the group read-only access to the systemview view.
# group context sec.model sec.level prefix read write notif
#access notConfigGroup "" any noauth exact systemview none none
access ROGroup "" v2c noauth exact AllView none none
access RWGroup "" v2c noauth exact AllView none none
access RWGroup "" v2c noauth exact view-name none none
# First, map the community name "public" into a "security name"
# sec.name source community

com2sec notConfigUser default public
com2sec Local dnssyn1 casef@20
com2sec localnet 10.155.2.0/24 casef@20

# groupName securityModel securityName
#group notConfigGroup v1 notConfigUser
#group notConfigGroup v2c notConfigUser

group RWGroup v2c Local
group ROGroup V2c localnet

####
# Third, create a view for us to let the group have rights to:

# Make at least snmpwalk -v 1 localhost -c public system fast again.
# name incl/excl subtree mask(optional)
view systemview included .1.3.6.1.2.1.1
view systemview included .1.3.6.1.2.1.25.1.1
view AllView included .1

####
# Finally, grant the group read-only access to the systemview view.

# group context sec.model sec.level prefix read write notif
#access notConfigGroup "" any noauth exact systemview none none
access ROGroup "" v2c noauth exact AllView none none
access RWGroup "" v2c noauth exact AllView none none

SNMP Clients

snmpget

Syntax [root@redhat ~]# snmpget -v snmp-version -c Community-Password Host OID


Example
[root@redhat ~]# snmpget -v 1 -c public 10.0.0.2 .1.3.6.1.4.1.2021.4.5.0
[root@redhat ~]# snmpget -v 1 -c public 10.0.0.2 sysContact.0
SNMPv2-MIB::sysContact.0 = STRING: root@localhost

[root@lab ~]# snmpget -v 1 -c public localhost .1.3.6.1.2.1.1.3.0

snmpwalk

[root@redhat ~]# snmpwalk -OX -c public -v 1 10.0.0.2 ALL
[root@redhat ~]# snmpwalk -OX -c public -v 1 10.0.0.2 .1.3.6.1.2.1.2 IF-MIB Interfaces
[root@redhat ~]# snmpwalk -OX -c public -v 1 10.0.0.2 .1.3.6.1.2.1.4.20 IP-MIB IP Adresses
Eninam BAGNABANA     |         |     bagnadavid@outlook.fr     |