From owner-snmpv3@lists.tislabs.com Wed May 26 08:07:29 2004 Received: from lists.tislabs.com (portal.tislabs.com [192.94.214.101]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA11318 for ; Wed, 26 May 2004 08:07:28 -0400 (EDT) Received: by lists.tislabs.com (8.11.6/8.11.6) id i4QAcwq10625 for snmpv3-outgoing; Wed, 26 May 2004 06:38:58 -0400 (EDT) X-Authentication-Warning: portal.tislabs.com: majordom set sender to owner-snmpv3@lists.tislabs.com using -f Message-ID: <14F834609826C748873A5012F5C13EAE5B6064@dubmail2.iel.ie> From: Grainne Foley To: "'snmpv3@lists.tislabs.com'" Subject: snmp community mib Date: Wed, 26 May 2004 11:45:01 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by lists.tislabs.com id i4QAcuc10620 Sender: owner-snmpv3@lists.tislabs.com Precedence: bulk Content-Transfer-Encoding: 8bit Hello SNMPv3 Working Group, I am working with Cable Modem devices and want to send an snmp SET to update the read-only and write community strings. I need to index into the snmpCommunityTable. Based on the CMTSs that I can browse, the snmpCommunityIndex is not available, but the instance is a dot separated ascii equivalent of a word, possibly the name of the view. Is this the case? If indeed the snmpCommunityEntry can be indexed using the ascii index, how do I a) know which row contains the read-only community string, and which contains the write commnuity string? b) know the ascii index in the first place? Thank you for taking the time to read this email. I appreciate any help you can give me. If this is not the best forum for such a question, please advise me of a more suitable one. Gráinne From owner-snmpv3@lists.tislabs.com Wed May 26 08:30:09 2004 Received: from lists.tislabs.com (portal.tislabs.com [192.94.214.101]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA12958 for ; Wed, 26 May 2004 08:30:09 -0400 (EDT) Received: by lists.tislabs.com (8.11.6/8.11.6) id i4QBYNh20940 for snmpv3-outgoing; Wed, 26 May 2004 07:34:23 -0400 (EDT) X-Authentication-Warning: portal.tislabs.com: majordom set sender to owner-snmpv3@lists.tislabs.com using -f Message-ID: <7D5D48D2CAA3D84C813F5B154F43B15504678AB8@nl0006exch001u.nl.lucent.com> From: "Wijnen, Bert (Bert)" To: "'Grainne Foley'" , "Snmpv3-wg (E-mail)" Subject: FW: SNMP Community MIB Date: Wed, 26 May 2004 13:35:45 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by lists.tislabs.com id i4QBYKc20921 Sender: owner-snmpv3@lists.tislabs.com Precedence: bulk Content-Transfer-Encoding: 8bit Inline > I am currently working with Cable Modem devices and want to send an snmp SET > to update the read-only and write community strings. I need to index into > the snmpCommunityTable. Based on the CMTSs that I can browse, the > snmpCommunityIndex is not available, but the instance is a dot separated > ascii equivalent of a word, possibly the name of the view. Is this the case? > The snmpCommunityTable is indexed by a SnmpAdminString, which is UTF-8, See RFC3411. So that is not ASCII. US-ASCII characters turn out to show up exactly the same in UTF-8 as in 7-bit ASCII, but it is not correct to state that the index is ascii. If you want to use views for the indexing, then I think that is OK. It is of course not mandatory. The index string can be anything as long as it is unique within the table. > If indeed the snmpCommunityEntry can be indexed using the ascii index, > how do I > a) know which row contains the read-only community string, and which > contains the write commnuity string? Well, your have to pickup the securityName and then go with that into the vacm tables (RFC3415) to figure with which of the community names you can read, write, or both. It is not as simple as read-only and write anymore. The snmpCommunityTable allows you to map into the VACM access control, and so one community name can give you read access to som parts of the MIB tree and write access to other parts. > b) know the ascii index in the first place? > You can do a getnext loop or getbulk on the table and from the responses you can figure out the existing indices. Hope this gets you going Bert > Thank you for taking the time to read this email. I > appreciate any help you > can give me. > Gráinne > From owner-snmpv3@lists.tislabs.com Wed May 26 15:47:31 2004 Received: from lists.tislabs.com (portal.tislabs.com [192.94.214.101]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA09705 for ; Wed, 26 May 2004 15:47:30 -0400 (EDT) Received: by lists.tislabs.com (8.11.6/8.11.6) id i4QImst29861 for snmpv3-outgoing; Wed, 26 May 2004 14:48:54 -0400 (EDT) X-Authentication-Warning: portal.tislabs.com: majordom set sender to owner-snmpv3@lists.tislabs.com using -f Message-ID: <00de01c44352$3f1904c0$7f1afea9@oemcomputer> From: "Randy Presuhn" To: "'Grainne Foley'" , "Snmpv3-wg \(E-mail\)" References: <7D5D48D2CAA3D84C813F5B154F43B15504678AB8@nl0006exch001u.nl.lucent.com> Subject: Re: SNMP Community MIB Date: Wed, 26 May 2004 11:49:59 -0700 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Sender: owner-snmpv3@lists.tislabs.com Precedence: bulk Hi - > From: "Wijnen, Bert (Bert)" > To: "'Grainne Foley'" ; "Snmpv3-wg (E-mail)" > Sent: Wednesday, May 26, 2004 4:35 AM > Subject: FW: SNMP Community MIB ... > > b) know the ascii index in the first place? > > > You can do a getnext loop or getbulk on the table and from the responses > you can figure out the existing indices. .... Of course, this assumes that you have permission to read all those object instances. :-) But this all begs the question of why someone would still want to use community strings at all. With heightened concerns about security these days, wouldn't use of SNMPv1 or SNMPv2c be considered negligent, and a possible legal liability? Randy From owner-snmpv3@lists.tislabs.com Wed May 26 16:25:15 2004 Received: from lists.tislabs.com (portal.tislabs.com [192.94.214.101]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12745 for ; Wed, 26 May 2004 16:25:15 -0400 (EDT) Received: by lists.tislabs.com (8.11.6/8.11.6) id i4QJZgs07575 for snmpv3-outgoing; Wed, 26 May 2004 15:35:42 -0400 (EDT) X-Authentication-Warning: portal.tislabs.com: majordom set sender to owner-snmpv3@lists.tislabs.com using -f To: "Randy Presuhn" Cc: "'Grainne Foley'" , "Snmpv3-wg (E-mail)" Subject: Re: SNMP Community MIB References: <7D5D48D2CAA3D84C813F5B154F43B15504678AB8@nl0006exch001u.nl.lucent.com> <00de01c44352$3f1904c0$7f1afea9@oemcomputer> From: Wes Hardaker Organization: Sparta Date: Wed, 26 May 2004 12:37:07 -0700 In-Reply-To: <00de01c44352$3f1904c0$7f1afea9@oemcomputer> (Randy Presuhn's message of "Wed, 26 May 2004 11:49:59 -0700") Message-ID: User-Agent: Gnus/5.110002 (No Gnus v0.2) XEmacs/21.5 (celeriac, linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-snmpv3@lists.tislabs.com Precedence: bulk >>>>> On Wed, 26 May 2004 11:49:59 -0700, "Randy Presuhn" said: Randy> Of course, this assumes that you have permission to read all Randy> those object instances. :-) But this all begs the question of why Randy> someone would still want to use community strings at all. With Randy> heightened concerns about security these days, wouldn't use of Randy> SNMPv1 or SNMPv2c be considered negligent, and a possible Randy> legal liability? Operationally, it's been shown to be more problematic though. A poll at NANOG yesterday indicated that one of the primary reasons operators hadn't deployed SNMPv3 is that it was too much of a pain to set up because it didn't integrate with their existing infrastructure. -- Wes Hardaker Sparta From owner-snmpv3@lists.tislabs.com Wed May 26 16:49:21 2004 Received: from lists.tislabs.com (portal.gw.tislabs.com [192.94.214.101]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA14916 for ; Wed, 26 May 2004 16:49:20 -0400 (EDT) Received: by lists.tislabs.com (8.11.6/8.11.6) id i4QJrG310430 for snmpv3-outgoing; Wed, 26 May 2004 15:53:16 -0400 (EDT) X-Authentication-Warning: portal.tislabs.com: majordom set sender to owner-snmpv3@lists.tislabs.com using -f Message-ID: <000a01c4435b$524bc9c0$7f1afea9@oemcomputer> From: "Randy Presuhn" To: "Snmpv3-wg \(E-mail\)" Cc: "'Grainne Foley'" References: <7D5D48D2CAA3D84C813F5B154F43B15504678AB8@nl0006exch001u.nl.lucent.com><00de01c44352$3f1904c0$7f1afea9@oemcomputer> Subject: Re: SNMP Community MIB Date: Wed, 26 May 2004 12:54:57 -0700 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Sender: owner-snmpv3@lists.tislabs.com Precedence: bulk Hi - > From: "Wes Hardaker" > To: "Randy Presuhn" > Cc: "'Grainne Foley'" ; "Snmpv3-wg (E-mail)" > Sent: Wednesday, May 26, 2004 12:37 PM > Subject: Re: SNMP Community MIB ... > Operationally, it's been shown to be more problematic though. A poll > at NANOG yesterday indicated that one of the primary reasons operators > hadn't deployed SNMPv3 is that it was too much of a pain to set up > because it didn't integrate with their existing infrastructure. ... Thanks for gathering the data. I'm sure it will be useful. But... Are you saying that they believe the level of pain (cost of setting it up) is greater than the value of the assets they'd be protecting? (I support the goals of SBSM, but it's not the sine qua non of secure management, as demonstrated by those already using SNMPv3.) Randy From owner-snmpv3@lists.tislabs.com Wed May 26 16:49:41 2004 Received: from lists.tislabs.com (portal.gw.tislabs.com [192.94.214.101]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15018 for ; Wed, 26 May 2004 16:49:41 -0400 (EDT) Received: by lists.tislabs.com (8.11.6/8.11.6) id i4QJtLW10730 for snmpv3-outgoing; Wed, 26 May 2004 15:55:21 -0400 (EDT) X-Authentication-Warning: portal.tislabs.com: majordom set sender to owner-snmpv3@lists.tislabs.com using -f X-Originating-IP: [69.104.4.9] From: "Sean Lawless" To: "=?iso-8859-1?Q?Snmpv3=2Dwg?=" Subject: SNMPv3 and FIPS 140-1 Date: Wed, 26 May 2004 19:56:20 +0000 Message-ID: <20040526.8LP.21436300@192.168.0.13> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit Content-Disposition: inline X-Mailer: AngleMail for eGroupWare (http://www.egroupware.org) v 0.9.99.014 Sender: owner-snmpv3@lists.tislabs.com Precedence: bulk Content-Transfer-Encoding: 8bit Greetings, Does anyone know how to extend SNMPv3 to be FIPS 140-1 Level 2 compliant? Specifically, HMAC SHA-1 is not FIPS compliant to my understanding. Running SNMPv3 through a VPN seems to defeat its purpose. Regards, Sean Lawless Mibtonix Inc. From owner-snmpv3@lists.tislabs.com Thu May 27 10:51:43 2004 Received: from lists.tislabs.com (portal.tislabs.com [192.94.214.101]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA29996 for ; Thu, 27 May 2004 10:51:43 -0400 (EDT) From: owner-snmpv3@lists.tislabs.com Received: by lists.tislabs.com (8.11.6/8.11.6) id i4RDtax17672 for snmpv3-outgoing; Thu, 27 May 2004 09:55:36 -0400 (EDT) Date: Thu, 27 May 2004 09:55:36 -0400 (EDT) Message-Id: <200405271355.i4RDtax17672@lists.tislabs.com> X-Authentication-Warning: portal.tislabs.com: majordom set sender to owner-snmpv3@lists.tislabs.com using -f [192.94.214.100]) by lists.tislabs.com (8.11.6/8.11.6) with ESMTP id i4QKupc20516 for ; Wed, 26 May 2004 16:56:51 -0400 (EDT) csmap (V6.0) id srcAAAm8aOWC; Wed, 26 May 04 16:55:53 -0400 To: "Randy Presuhn" Cc: "Snmpv3-wg (E-mail)" , "'Grainne Foley'" Subject: Re: SNMP Community MIB References: <7D5D48D2CAA3D84C813F5B154F43B15504678AB8@nl0006exch001u.nl.lucent.com> <00de01c44352$3f1904c0$7f1afea9@oemcomputer> <000a01c4435b$524bc9c0$7f1afea9@oemcomputer> From: Wes Hardaker Organization: Sparta Date: Wed, 26 May 2004 13:57:56 -0700 In-Reply-To: <000a01c4435b$524bc9c0$7f1afea9@oemcomputer> (Randy Presuhn's message of "Wed, 26 May 2004 12:54:57 -0700") Message-ID: User-Agent: Gnus/5.110002 (No Gnus v0.2) XEmacs/21.5 (celeriac, linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-snmpv3@lists.tislabs.com Precedence: bulk >>>>> On Wed, 26 May 2004 12:54:57 -0700, "Randy Presuhn" said: Randy> Are you saying that they believe the level of pain (cost of Randy> setting it up) is greater than the value of the assets they'd Randy> be protecting? It's likely they're protecting it via the more traditional approaches: source filtering, dedicated management planes, etc. But I didn't ask them *why* they weren't using it. Only if they were or not. -- Wes Hardaker Sparta From owner-snmpv3@lists.tislabs.com Thu May 27 11:01:16 2004 Received: from lists.tislabs.com (portal.tislabs.com [192.94.214.101]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA00708 for ; Thu, 27 May 2004 11:01:16 -0400 (EDT) From: owner-snmpv3@lists.tislabs.com Received: by lists.tislabs.com (8.11.6/8.11.6) id i4RDt5E17560 for snmpv3-outgoing; Thu, 27 May 2004 09:55:05 -0400 (EDT) Date: Thu, 27 May 2004 09:55:05 -0400 (EDT) Message-Id: <200405271355.i4RDt5E17560@lists.tislabs.com> X-Authentication-Warning: portal.tislabs.com: majordom set sender to owner-snmpv3@lists.tislabs.com using -f [192.94.214.100]) by lists.tislabs.com (8.11.6/8.11.6) with ESMTP id i4QKt1c20206 for ; Wed, 26 May 2004 16:55:01 -0400 (EDT) csmap (V6.0) id srcAAAO_aqbC; Wed, 26 May 04 16:54:03 -0400 To: "Sean Lawless" Cc: "Snmpv3-wg" Subject: Re: SNMPv3 and FIPS 140-1 References: <20040526.8LP.21436300@192.168.0.13> From: Wes Hardaker Organization: Sparta Date: Wed, 26 May 2004 13:56:22 -0700 In-Reply-To: <20040526.8LP.21436300@192.168.0.13> (Sean Lawless's message of "Wed, 26 May 2004 19:56:20 +0000") Message-ID: User-Agent: Gnus/5.110002 (No Gnus v0.2) XEmacs/21.5 (celeriac, linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-snmpv3@lists.tislabs.com Precedence: bulk >>>>> On Wed, 26 May 2004 19:56:20 +0000, "Sean Lawless" said: Sean> Does anyone know how to extend SNMPv3 to be FIPS 140-1 Level 2 Sean> compliant? Specifically, HMAC SHA-1 is not FIPS compliant to my Sean> understanding. Quick web searches led me to believe that SHA-1 with and without HMAC is FIPS-2 compliant at least and I think FIPS-1 as well. But I'm not an expert. Sean> Running SNMPv3 through a VPN seems to defeat its purpose. It is fairly trivial to add other algorithms to USM if you needed to use something different. -- Wes Hardaker Sparta