Lucent Technologies Stinger, Administration Manual

Page: 172 / 374

7-14 Stinger® Administration Guide
Administering the SNMP Agent
Securing the SNMP agent
Enabling VACM
To enable VACM, set the enable-vacm parameter to yes in the snmp profile. With this
setting, each object in each incoming request (GET/SET/GETNEXT/GETBULK) and
each object in the sysTrapOID of each outgoing trap (TRAP2) is verified for VACM
access.
The default value of no disables VACM, allowing access to all objects in the system.
However, the unit still uses security based on SNMPv1 community strings and
SNMPv3 USM (if enabled) to determine access.
Mapping a security name and security model to a security group
To map a security name and security model to a security group, set the parameters in
the
vacm-security-group profile. Following is a listing of the profile’s default values:
[in VACM-SECURITY-GROUP/{ v1 "" } (new)]
security-properties* = { v1 "" }
active = no
group-name = ""
[in VACM-SECURITY-GROUP/{ v1 "" }:security-properties (new) (changed)]
security-model = v1
security-name = ""
For example, the following commands configure SNMPv3 USM for a USM user called
joe and a group called groupNY :
admin> new vacm-security-group
VACM-SECURITY-GROUP/{ v1 "" } read
admin> list
[in VACM-SECURITY-GROUP/{ v1 "" } (new)]
security-properties* = { v1 "" }
active = no
group-name = ""
admin> set active = yes
admin> set group-name = groupNY
admin> list security-properties
[in VACM-SECURITY-GROUP/{ v1 "" }:security-properties (new) (changed)]
Parameter Setting
active Enable/disable VACM. Specify yes to enable VACM or no (the
default) to disable it.
group-name
Group name. The default is null.
security-
properties:
security-model Security model in use for an incoming or outgoing message:
v1 (the default)—The SNMPv1 security model.
v3-usm
—SNMPv3 USM. For VACM support, specify
v3-usm
.
security-
properties:
security-name USM username associated with an incoming or outgoing
message. The default is null.