Subject: FW: SNMP Community MIB

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Wed, 26 May 2004 13:35:45 +0200

Inline

> I am currently working with Cable Modem devices and want to send an snmp SET
> to update the read-only and write community strings. I need to index into
> the snmpCommunityTable. Based on the CMTSs that I can browse, the
> snmpCommunityIndex is not available, but the instance is a dot separated
> ascii equivalent of a word, possibly the name of the view. Is this the case?
> 
The snmpCommunityTable is indexed by a SnmpAdminString, which is UTF-8,
See RFC3411. So that is not ASCII. US-ASCII characters turn out to show up
exactly the same in UTF-8 as in 7-bit ASCII, but it is not correct to state
that the index is ascii.
If you want to use views for the indexing, then I think that is OK.
It is of course not mandatory. The index string can be anything as long
as it is unique within the table.

> If indeed the snmpCommunityEntry can be indexed using the ascii index,
> how do I
> a) know which row contains the read-only community string, and which
> contains the write commnuity string?

Well, your have to pickup the securityName and then go with that into the
vacm tables (RFC3415) to figure with which of the community names you
can read, write, or both.

It is not as simple as read-only and write anymore. The snmpCommunityTable
allows you to map into the VACM access control, and so one community name
can give you read access to som parts of the MIB tree and write access to
other parts.

> b) know the ascii index in the first place?
> 
You can do a getnext loop or getbulk on the table and from the responses
you can figure out the existing indices.

Hope this gets you going

Bert
> Thank you for taking the time to read this email. I 
> appreciate any help you
> can give me.
> Gráinne
>

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 26 May 2004 11:49:59 -0700

Hi -

> From: "Wijnen, Bert (Bert)" <[email-masked]>
> To: "'Grainne Foley'" <[email-masked]>; "Snmpv3-wg (E-mail)" <[email-masked]>
> Sent: Wednesday, May 26, 2004 4:35 AM
> Subject: FW: SNMP Community MIB
...
> you can figure out the existing indices.
....

Of course, this assumes that you have permission to read all
those object instances.  :-)  But this all begs the question of why
someone would still want to use community strings at all.  With
heightened concerns about security these days, wouldn't use of
SNMPv1 or SNMPv2c be considered negligent, and a possible
legal liability?

Randy

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 26 May 2004 12:37:07 -0700

>>>>> On Wed, 26 May 2004 11:49:59 -0700, "Randy Presuhn" <[email-masked]> said:

Randy> Of course, this assumes that you have permission to read all
Randy> those object instances.  :-)  But this all begs the question of why
Randy> someone would still want to use community strings at all.  With
Randy> heightened concerns about security these days, wouldn't use of
Randy> SNMPv1 or SNMPv2c be considered negligent, and a possible
Randy> legal liability?

Operationally, it's been shown to be more problematic though.  A poll
at NANOG yesterday indicated that one of the primary reasons operators
hadn't deployed SNMPv3 is that it was too much of a pain to set up
because it didn't integrate with their existing infrastructure.

-- 
Wes Hardaker
Sparta

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 26 May 2004 12:54:57 -0700

Hi -

> From: "Wes Hardaker" <[email-masked]>
> To: "Randy Presuhn" <[email-masked]>
> Cc: "'Grainne Foley'" <[email-masked]>; "Snmpv3-wg (E-mail)" <[email-masked]>
> Sent: Wednesday, May 26, 2004 12:37 PM
> Subject: Re: SNMP Community MIB
...
...

Thanks for gathering the data.  I'm sure it will be useful.  But...

Are you saying that they believe the level of pain (cost of setting it up)
is greater than the value of the assets they'd be protecting?

(I support the goals of SBSM, but it's not the sine qua non of secure
management, as demonstrated by those already using SNMPv3.)

Randy