SNMP v3?

[TheWitness]

I just got back from dinner. I will ping you momentarily. Installing TV Card in my Son's computer.

Larry

[TheWitness]

Ok, for those of you tracking this post. I have a progress report to provide. Here we go:

1) snmpv3 is working with 0.8.7 Alpha using the following modes:

AuthPriv
AuthNoPriv

2) The following Auth protocols are supported:

MD5, SHA

3) The following Priv protocols are supported:

DES, AES128/AES

4) Due to changes in net-snmp, AES192 and AES256 will NOT be supported. So, if you are using it, it's a deadend road.

Thanks to all those who supported me in this effort (and don't take my ID away yet!!).

Please remember to not deploy 0.8.7 in production as we will break it major any day now (Need to call Ian and find out what's taking him so long ).

Later,

TheWitness

[perldork]

Perldork,

Cactid 0.8.7 is ready for SNMPv3 testing. The CVS currently posted is accurate. I think Ian is keeping the downloads folder accurate as well. The January 13th version should be up-to-date. Any chance you can test?

TheWitness

Somehow I stopped getting notifications on this thread; my apologies for not responding. Is testing still needed? Happy to help if it is .. I used the SNMPv3 support for a few weeks on a previous project and it worked fine for the few hosts I used it on .. I have a project now that needs it so it would be a good time for me to test and I would happy to help fix bugs too if that is needed.

[TheWitness]

We have made significant changes to 0.8.7 (now 0.9) since we last talked. It is quite a ways out now due to some feature changes. Although, snmpv3 is functionally complete in that version.

TheWitness

[perldork]

You mean the official inclusion of SNMP v3 support in the stable release is delayed?

[TheWitness]

It's actually in the current release with some notable exceptions:

1) No privacy passphrase support - AuthNoPriv - it will be in 0.9 (DB Changes)
2) No Cactid support

If your passphrases are all the same, you can hack snmp.php to incorporate though. You may also have to change 2 files in setup. All the non priv passphrase fields are in the database, just hidden for now.

TheWitness

[yellowdog]

Any update of the release/progress of SNMPv3 support? I have two largish Cisco networks which I can test SNMPv3 with, how do I become a tester?

[TheWitness]

The Date has not been set yet. Testing is optional, but we are not quite ready right now.

TheWitness

[airwalk]

what's the current status of the subject? will there be a full v3 support in 0.8.6 branch at all?

Actually I can use v3 with 0.8.6j but looks like it supports only authentication. What about encryption? What types of auth? MD5 has worked for me, what about AES?

I've seen a script here to workaround encryption. But to make every shell script work on my win32 is a real pain in the ass. =(

[marnues]

hehe, I'd say your problem is win32, not the scripts

[rodolphedj]

Hello,

I have problem with device OpenBSD on snmp v3 and Cacti 0.8.6j

Where is the magic version 0.9 or 0.8.7 ???

Only for developer :
1 - on line command
/usr/bin/snmpget -O vt -v3 -t 20 -r 1 10.33.0.6:161 -u ********* -l authNoPriv -a MD5 -A ************************* .1.3.6.1.2.1.2.2.1.10.2
Counter32: 558750468

2 - code program (lib/snmp.php)
$snmp_value = @snmp3_get("$hostname:$port", $username, "authNoPriv", "MD5", $password, "", "", $oid, ($timeout * 1000), $retries);
work with some device, but not OpenBSD


I didn't understand the problem ???


Rodolphe

[Maestro_Ba]

Hi. I'm trying to use SNMP v3 in CACTI 0.8.6j in Linux. (I'm going to upgrade it to CACTI 0.8.6h)

This is the command I use for getting SNMP information in the server:
snmpwalk -v 3 -u user -l authPriv -a MD5 -A pass1 -x DES -X pass2 hostname

In Cacti I believe I can only set the parameters -v, -u and -A.
How can I edit lib/snmp.php in order to set the other parameters? ( -l, -X, ...) They are equal for all my equipments.

Thanks a lot to anyone that can help me!

[TheWitness]

Best bet is to wait for Cacti 0.8.7 due out on October 15th.

TheWitness

[Maestro_Ba]

Thanks, I will wait.

In the meantime, I seem to have solved my problem by making the following changes in cacti/lib/snmp.php:

$snmp_value = @snmp3_get("$hostname:$port", $username, "authPriv", "MD5", $password, "", "", $oid, ($timeout * 1000), $retries);
--- (instead of) ---
$snmp_value = @snmp3_get("$hostname:$port", $username, "authNoPriv", "MD5", $password, "", "", $oid, ($timeout * 1000), $retries);


$snmp_auth = "-u $username -l authPriv -a MD5 -A $password -x DES -X pass2"; /* v3 - username/password */
--- (instead of) ---
$snmp_auth = "-u $username -l authNoPriv -a MD5 -A $password"; /* v3 - username/password */



$temp_array = @snmp3_real_walk("$hostname:$port", $username, "authPriv", "MD5", $password, "", "", $oid, ($timeout * 1000), $retries);
--- (instead of) ---
$temp_array = @snmp3_real_walk("$hostname:$port", $username, "authNoPriv", "MD5", $password, "", "", $oid, ($timeout * 1000), $retries);


$snmp_auth = "-u $username -l authPriv -a MD5 -A $password -x DES -X pass2"; /* v3 - username/password */
--- (instead of) ---
$snmp_auth = "-u $username -l authNoPriv -a MD5 -A $password"; /* v3 - username/password */

[TheWitness]

Understood. That works too

TheWitness