Simple Network Managment war in Version 1 weder Safe noch secure. Nach ein paar Versionen mit der Bezeichnung 2 haben die Ingenieure das Protokoll mit Version 3 komplett überarbeitet. Die neue Spezifikation lässt keine Wünsche mehr offen, doch trotz der Vorteile ist das Protokoll in der Praxis noch wenig verbreitet. Ursache hierfür ist mit Sicherheit auch die gestiegene Komplexität welche neue Features wie Schlüsselverwaltung und logische Kontexte mit sich bringt. Der Vortrag gibt einen Überblick über die Architektur von SNMPv3 und zeigt den Einsatz in typischen Szenarien.

1. © Dr. SchwartzkopffSNMP Seite 1/19
Dr. Schwartzkopff IT Services
SNMPv3
Secure, Safe and Still Simple
Dr. Michael Schwartzkopff

2. © Dr. SchwartzkopffSNMP Seite 2/19
Why SNMPv3?
●
● Several attemps for a SNMPv2 solved different
problems.
● SNMPv3 offers a general solution that emphases on
security and modularity.
● Only SNMPv3 offers:
 Encryption,
 Authentication and
 Authorization.
● SNMPv3 the only valid IETF standard!

3. © Dr. SchwartzkopffSNMP Seite 3/19
A SNMPv3 Entity
 SNMPv3 does not speak of agents or
managers, but knows entities.
● The definition of SNMPv3 ist modular. So v1 and v2c
integrate nicely.
● This modularity allows for future extentions.
 i.e. new encryption algorithm can be implmented.
● The work is done by so called applications.
According to the role of the entity different
appications work.

4. © Dr. SchwartzkopffSNMP Seite 4/19
SNMP Entity
SNMP Applications
SNMP Engine
Modular Architecture
Dispatcher
Message Processing
Subsystem
Security
Subsystem
Access Control
Subsystem
Command
Generator
Command
Responder
Notification
Originator
Notification
Receiver
Proxy
Forwarder

5. © Dr. SchwartzkopffSNMP Seite 5/19
The Machine
 The dispatcher receives and and sends sends
the SNMP messages. It passes the data on to
the processing.
● The modular message processing creates or processes
mesages. Modules for v1, v2 and v3 exist.
● The security subsystem authenticates and/or encryptes
messages. A COMMUNITY (v1, v2c) and a user based
security model (USM, v3) exist.
● Das acces control subsystem authorizes access to parts of
the MIBs (view based access control model, VACM).

6. © Dr. SchwartzkopffSNMP Seite 6/19
The Applications
 The command generator creates get,
getnext, getbulk and set requests.
It also processes the answers. This
module works in „managers“.
● The command resonder creates the answers to the
requests. This module works in „agents“.
● The notification originator and receiver create or
process notifications.
● There is pletny room for additional applicationens.

7. © Dr. SchwartzkopffSNMP Seite 7/19
The entities
 In v3 entities talk to each other.
● Each SNMP entity is defined by its snmpEngineID.
 RFC3411 offers some methods calculating an
unique ID.
● Every entity calculates it own ID.
● Bevore two entities exchange information the ID of
the other has to be known. SNMPv3 defines a
autodiscovery process.

8. © Dr. SchwartzkopffSNMP Seite 8/19
More Items ...
 SNMPv3 defines many (!) new items.
Imporant are:
● Username
● Security Level
from noAuthNoPriv to authPriv.
● Authentication protocol MD5 or SHA1
● Authentication passphrase
● Privacy Protocol (DES, AES) with passphrase

9. © Dr. SchwartzkopffSNMP Seite 9/19
The SNMPv3 packet
msgVersion
msgID
msgMaxSize
msgAuthoritativeEngineID
msgFlags
msgSecurityModel
msgAuthoritativeEngineBoots
MsgAutoritativeEngineTime
msgAuthenticationParameters
msgUserName
msgPrivacyParameters
msgAuthenticationParameters
contextEngineID
contexName
PDU
Message Processing Payload
encrypted
authenticated
Security Subsystem

10. © Dr. SchwartzkopffSNMP Seite 10/19
1. Create Users
 Create users (=secName), or map
communities to a secName.
● USM – Option
createUser username (MD5|SHA)
authpassphrase [DES|AES] privpassphrase
Sample:
createUser misch MD5 verysecret
● v1 and v2c – Option
com2sec SECNAME SOURCE COMMUNITY
z.B.: com2sec readonly 192.168.1.0/24 public

11. © Dr. SchwartzkopffSNMP Seite 11/19
2. Group Users
 Next users are grouped together:
group GROUP secModel secName
● Sample:
group MyROSystem v1 readonly
group MyROGroup usm misch

12. © Dr. SchwartzkopffSNMP Seite 12/19
3. Create Views
 Views define a part of the complete OID
tree.
● Different groups have access to different views.
● Views also can be defined exclusive.
view VNAME TYPE OID [MASK]
● Sample:
view all included .1 80
view sys included .1.3.6.1.2.1.1
view interfaces included 1.3.6.1.2.1.2

13. © Dr. SchwartzkopffSNMP Seite 13/19
4. Define Access
 All definitions are combined to an
access:
access GROUP context secModel secLevel match read write notif
● Sample:
access MyROSystem „“ any noauth exact system none none
access MyROGroup „“ usm priv exact all none none

14. © Dr. SchwartzkopffSNMP Seite 14/19
Simple Usermanagement
 The options rouser and rwuser
provide for a simplified management:
rouser USER [noauth|auth|priv [OID | …]]
● noauth: No authentication for this user.
● auth: The user has to authenticate.
● priv: The communication will be encrypted.

15. © Dr. SchwartzkopffSNMP Seite 15/19
v3 in snmpcmd
 The command line offers a lot of options
for v3 use.
­a authProtocol MD5|SHA
­A authPassphrase
­x privProtocol DES|AES
­X privPassphrase
­l secLevel noAuthNoPriv … authPriv
­u secName
­v 3

16. © Dr. SchwartzkopffSNMP Seite 16/19
v3 In The Config File
 No fun typing all the v3 optins. Therefor
the file ~/.snmp/snmp.conf exists:
defAuthType MD5|SHA
defAuthPassphrase passphrase
defSecurityLevel noAuthNoPriv … authPriv
defSecurityName Username
DefVersion 3
defPrivType DES|AES
defPrivPassphrase passphrase
● Also possible: defPassphrase

17. © Dr. SchwartzkopffSNMP Seite 17/19
Simple ...
 Having these entries a simple
snmpwalk host .system
… works again.
● You get: Simple Network Management!

18. © Dr. SchwartzkopffSNMP Seite 18/19
SNMP Myth
 „SNMP is not secure“
 Yes! But the design of SNMPv1 was never ment to be
secure.
 SNMPv3 is secure. All messages can be authenticated
and encrypted.
 SNMPv3 offers a role based access model.
● „SNMP is not safe“ (Traps are not acknowledged)
 SNMPv3 offers Informs that are being acknowledged.
● „SNMP floods the net / overloads my router“
 Depends on the implementation, i.e. on you!
 A wrong DNS-Server also can flood the net.

19. © Michael Schwartzkopff, Seite 19/46
Thank you very much for you attention!
Questions?