Setting access community information
231
IPLink Software Configuration Guide
20 • SNMP configuration
Setting access community information
SNMP uses one or more labels called community strings to delimit groups of objects (variables) that can be
viewed or modified on a device. The SNMP data in such a group is organized in a tree structure called a Man-
agement Information Base (MIB). A single device may have multiple MIBs connected together into one large
structure, and various community strings may provide read-only or read-write access to different, possibly
overlapping portions of the larger data structure. An example of a read-only variable might be a counter show-
ing the total number of octets sent or received through an interface. An example of a read-write variable might
be the speed of an interface, or the hostname of a device.
Community strings also provide a weak form of access control in earlier versions of SNMP version 1 and 2.
SNMP version 3 provides much improved access control using strong authentication and should be preferred
over SNMP version 1 and 2 wherever it is supported. If a community string is defined, then it must be pro-
vided in any basic SNMP query if the requested operation is to be permitted by the device. Community strings
usually allow read-only or read-write access to the entire device. In some cases, a given community string will
be limited to one group of read-only or read-write objects described in an individual MIB.
In the absence of additional configuration options to constrain access, knowledge of the single community
string for the device is all that is required to gain access to all objects, both read-only and read-write, and to
modify any read-write objects.
Note
Security problems can be caused by unauthorized individuals possessing
knowledge of read-only community strings so they gain read access to confi-
dential information stored on an affected device. Worse can happen if they
gain access to read-write community strings that allow unauthorized remote
configuration of affected devices, possibly without the system administrators
being aware that changes are being made, resulting in a failure of integrity
and a possible failure of device availability. To prevent these situations, define
community strings that only allow read-only access to the MIB objects
should be the default.
By default SNMP uses the default communities public and private. You probably do not want to use those, as
they are the first things an intruder will look for. Choosing community names is like choosing a password. Do
not use easily guessed ones; do not use commonly known words, mix letters and other characters, and so on. If
you do not intend to allow anyone to use SNMP write commands on your system, then you probably only
need one community name.
This procedure describes how to define your own SNMP community
Mode:
Configure
Use the
no
command option to remove a SNMP community setting.
Example:
Setting access community information
Step
Command
Purpose
1
node(cfg)#snmp community
name
{ ro | rw }
Configures the SNMP community name with read-only
or read/write access