Administering the SNMP Agent
Securing the SNMP agent
Stinger®
Administration Guide
7-13
Configuring view-based access control
As described in RFC 2575, the view-based access control model (VACM) defines a
mechanism for SNMP entities to determine whether a specific type of access (read,
write, or notify) to a particular object is allowed. RFC 2575 defines a structured
configuration that can check accessibility for each
get
or
set
request received and
notify
request sent.
With VACM enabled, you can configure the system to control different types of access
to various objects in the system on the basis of the security name in the request, the
security level specified for the request, or the context name and object identifier
(OID) of the object for which access is being attempted. You can select read (
get
),
write (
set
), and notify (
trap
or
trap2
) access.
You configure VACM at the command-line interface by performing the following
tasks:
1
Enable VACM by setting the
enable-vacm
parameter to
yes
in the
snmp
profile.
2
Map a security name and security model in an incoming or outgoing message to a
security group by setting the parameters in the
vacm-security-group
profile.
3
Specify view names for different kinds of access (read, write, notify) by setting
parameters in the
vacm-access
profile. A view specifies whether a given OID is
accessible.
4
Define views by setting parameters in the
vacm-view-tree
profile.
security-model
Security model to use when generating SNMP messages.
Specify one of the following values:
v1
(the default)—SNMPv1 security model. This setting is
valid only if
msg-proc-model
is set to
v1
.
v3-usm
—SNMPv3 USM. For SNMPv3 notifications support,
specify
v3-usm
. This setting is valid only if
msg-proc-model
is set to
v3
.
For the
snmpv3-target-param
profile to have any effect when
security-model
is set to
v3-usm
, the
name
parameter in the
snmpv3-usm-user
profile must match the
security-name
parameter in the
snmpv3-target-param
subprofile.
security-name
Security name of up to 22 characters that identifies the user on
whose behalf SNMPv3 USM messages are generated. The
default is null. For the
security-name
parameter to apply, set
security-model
to
v3-usm
.
security-level
Level of security to use when generating messages. Specify one
of the following values:
none
(the default)—No authentication and no privacy.
auth-nopriv
—Authentication and no privacy.
auth-priv
—Authentication and privacy. For the
auth-priv
to apply, you must set the
priv-protocol
and
priv-
password
parameters in the
snmpv3-usm-user
profile.
Parameter
Setting
Содержание Stinger
Страница 1: ...Stinger Administration Guide Part Number 7820 0712 008 For software version 9 7 0 August 2004 ...
Страница 4: ......
Страница 16: ......
Страница 18: ......
Страница 62: ......
Страница 82: ......
Страница 96: ......
Страница 182: ......
Страница 218: ......
Страница 236: ......
Страница 252: ......
Страница 288: ......
Страница 350: ......
Страница 362: ......
Страница 374: ......