900 lines
37 KiB
Plaintext
900 lines
37 KiB
Plaintext
SNMP-USER-BASED-SM-MIB DEFINITIONS ::= BEGIN
|
|
|
|
IMPORTS
|
|
MODULE-IDENTITY, OBJECT-TYPE,
|
|
OBJECT-IDENTITY,
|
|
snmpModules, Counter32 FROM SNMPv2-SMI
|
|
TEXTUAL-CONVENTION, TestAndIncr,
|
|
RowStatus, RowPointer,
|
|
StorageType, AutonomousType FROM SNMPv2-TC
|
|
MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF
|
|
SnmpAdminString, SnmpEngineID,
|
|
snmpAuthProtocols, snmpPrivProtocols FROM SNMP-FRAMEWORK-MIB;
|
|
|
|
snmpUsmMIB MODULE-IDENTITY
|
|
LAST-UPDATED "9901200000Z" -- 20 Jan 1999, midnight
|
|
ORGANIZATION "SNMPv3 Working Group"
|
|
CONTACT-INFO "WG-email: snmpv3@lists.tislabs.com
|
|
Subscribe: majordomo@lists.tislabs.com
|
|
In msg body: subscribe snmpv3
|
|
|
|
Chair: Russ Mundy
|
|
Trusted Information Systems
|
|
postal: 3060 Washington Rd
|
|
Glenwood MD 21738
|
|
USA
|
|
email: mundy@tislabs.com
|
|
phone: +1-301-854-6889
|
|
|
|
Co-editor Uri Blumenthal
|
|
IBM T. J. Watson Research
|
|
postal: 30 Saw Mill River Pkwy,
|
|
Hawthorne, NY 10532
|
|
USA
|
|
email: uri@watson.ibm.com
|
|
phone: +1-914-784-7964
|
|
|
|
Co-editor: Bert Wijnen
|
|
IBM T. J. Watson Research
|
|
postal: Schagen 33
|
|
3461 GL Linschoten
|
|
Netherlands
|
|
email: wijnen@vnet.ibm.com
|
|
phone: +31-348-432-794
|
|
"
|
|
DESCRIPTION "The management information definitions for the
|
|
SNMP User-based Security Model.
|
|
"
|
|
-- Revision history
|
|
|
|
REVISION "9901200000Z" -- 20 Jan 1999, midnight
|
|
DESCRIPTION "Clarifications, published as RFC2574"
|
|
|
|
REVISION "9711200000Z" -- 20 Nov 1997, midnight
|
|
DESCRIPTION "Initial version, published as RFC2274"
|
|
|
|
::= { snmpModules 15 }
|
|
|
|
-- Administrative assignments ****************************************
|
|
|
|
usmMIBObjects OBJECT IDENTIFIER ::= { snmpUsmMIB 1 }
|
|
usmMIBConformance OBJECT IDENTIFIER ::= { snmpUsmMIB 2 }
|
|
|
|
-- Identification of Authentication and Privacy Protocols ************
|
|
|
|
usmNoAuthProtocol OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION "No Authentication Protocol."
|
|
::= { snmpAuthProtocols 1 }
|
|
|
|
usmHMACMD5AuthProtocol OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION "The HMAC-MD5-96 Digest Authentication Protocol."
|
|
REFERENCE "- H. Krawczyk, M. Bellare, R. Canetti HMAC:
|
|
Keyed-Hashing for Message Authentication,
|
|
RFC2104, Feb 1997.
|
|
- Rivest, R., Message Digest Algorithm MD5, RFC1321.
|
|
"
|
|
::= { snmpAuthProtocols 2 }
|
|
|
|
usmHMACSHAAuthProtocol OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION "The HMAC-SHA-96 Digest Authentication Protocol."
|
|
REFERENCE "- H. Krawczyk, M. Bellare, R. Canetti, HMAC:
|
|
Keyed-Hashing for Message Authentication,
|
|
RFC2104, Feb 1997.
|
|
- Secure Hash Algorithm. NIST FIPS 180-1.
|
|
"
|
|
::= { snmpAuthProtocols 3 }
|
|
|
|
usmNoPrivProtocol OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION "No Privacy Protocol."
|
|
::= { snmpPrivProtocols 1 }
|
|
|
|
usmDESPrivProtocol OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION "The CBC-DES Symmetric Encryption Protocol."
|
|
REFERENCE "- Data Encryption Standard, National Institute of
|
|
Standards and Technology. Federal Information
|
|
Processing Standard (FIPS) Publication 46-1.
|
|
Supersedes FIPS Publication 46,
|
|
(January, 1977; reaffirmed January, 1988).
|
|
|
|
- Data Encryption Algorithm, American National
|
|
Standards Institute. ANSI X3.92-1981,
|
|
(December, 1980).
|
|
|
|
- DES Modes of Operation, National Institute of
|
|
Standards and Technology. Federal Information
|
|
Processing Standard (FIPS) Publication 81,
|
|
(December, 1980).
|
|
|
|
- Data Encryption Algorithm - Modes of Operation,
|
|
American National Standards Institute.
|
|
ANSI X3.106-1983, (May 1983).
|
|
"
|
|
::= { snmpPrivProtocols 2 }
|
|
|
|
usmAESPrivProtocol OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION "_The Rijndael Symmetric Encryption Protocol_"
|
|
REFERENCE "_Advanced Encryption Standard _ NIST.
|
|
http://www.nist.gov/aes_"
|
|
::= { snmpPrivProtocols 4 }
|
|
|
|
|
|
|
|
|
|
|
|
-- Textual Conventions ***********************************************
|
|
|
|
|
|
KeyChange ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Every definition of an object with this syntax must identify
|
|
a protocol P, a secret key K, and a hash algorithm H
|
|
that produces output of L octets.
|
|
|
|
The object's value is a manager-generated, partially-random
|
|
value which, when modified, causes the value of the secret
|
|
key K, to be modified via a one-way function.
|
|
|
|
The value of an instance of this object is the concatenation
|
|
of two components: first a 'random' component and then a
|
|
'delta' component.
|
|
|
|
The lengths of the random and delta components
|
|
are given by the corresponding value of the protocol P;
|
|
if P requires K to be a fixed length, the length of both the
|
|
random and delta components is that fixed length; if P
|
|
allows the length of K to be variable up to a particular
|
|
maximum length, the length of the random component is that
|
|
maximum length and the length of the delta component is any
|
|
length less than or equal to that maximum length.
|
|
For example, usmHMACMD5AuthProtocol requires K to be a fixed
|
|
length of 16 octets and L - of 16 octets.
|
|
usmHMACSHAAuthProtocol requires K to be a fixed length of
|
|
20 octets and L - of 20 octets. Other protocols may define
|
|
other sizes, as deemed appropriate.
|
|
|
|
When a requester wants to change the old key K to a new
|
|
key keyNew on a remote entity, the 'random' component is
|
|
obtained from either a true random generator, or from a
|
|
pseudorandom generator, and the 'delta' component is
|
|
computed as follows:
|
|
|
|
- a temporary variable is initialized to the existing value
|
|
of K;
|
|
- if the length of the keyNew is greater than L octets,
|
|
then:
|
|
- the random component is appended to the value of the
|
|
temporary variable, and the result is input to the
|
|
the hash algorithm H to produce a digest value, and
|
|
the temporary variable is set to this digest value;
|
|
- the value of the temporary variable is XOR-ed with
|
|
the first (next) L-octets (16 octets in case of MD5)
|
|
of the keyNew to produce the first (next) L-octets
|
|
(16 octets in case of MD5) of the 'delta' component.
|
|
- the above two steps are repeated until the unused
|
|
portion of the keyNew component is L octets or less,
|
|
- the random component is appended to the value of the
|
|
temporary variable, and the result is input to the
|
|
hash algorithm H to produce a digest value;
|
|
- this digest value, truncated if necessary to be the same
|
|
length as the unused portion of the keyNew, is XOR-ed
|
|
with the unused portion of the keyNew to produce the
|
|
(final portion of the) 'delta' component.
|
|
|
|
For example, using MD5 as the hash algorithm H:
|
|
|
|
iterations = (lenOfDelta - 1)/16; /* integer division */
|
|
temp = keyOld;
|
|
for (i = 0; i < iterations; i++) {
|
|
temp = MD5 (temp || random);
|
|
delta[i*16 .. (i*16)+15] =
|
|
temp XOR keyNew[i*16 .. (i*16)+15];
|
|
}
|
|
temp = MD5 (temp || random);
|
|
delta[i*16 .. lenOfDelta-1] =
|
|
temp XOR keyNew[i*16 .. lenOfDelta-1];
|
|
|
|
The 'random' and 'delta' components are then concatenated as
|
|
described above, and the resulting octet string is sent to
|
|
the recipient as the new value of an instance of this object.
|
|
|
|
At the receiver side, when an instance of this object is set
|
|
to a new value, then a new value of K is computed as follows:
|
|
|
|
- a temporary variable is initialized to the existing value
|
|
of K;
|
|
- if the length of the delta component is greater than L
|
|
octets, then:
|
|
- the random component is appended to the value of the
|
|
temporary variable, and the result is input to the
|
|
hash algorithm H to produce a digest value, and the
|
|
temporary variable is set to this digest value;
|
|
- the value of the temporary variable is XOR-ed with
|
|
the first (next) L-octets (16 octets in case of MD5)
|
|
of the delta component to produce the first (next)
|
|
L-octets (16 octets in case of MD5) of the new value
|
|
of K.
|
|
- the above two steps are repeated until the unused
|
|
portion of the delta component is L octets or less,
|
|
- the random component is appended to the value of the
|
|
temporary variable, and the result is input to the
|
|
hash algorithm H to produce a digest value;
|
|
- this digest value, truncated if necessary to be the same
|
|
length as the unused portion of the delta component, is
|
|
XOR-ed with the unused portion of the delta component to
|
|
produce the (final portion of the) new value of K.
|
|
For example, using MD5 as the hash algorithm H:
|
|
|
|
iterations = (lenOfDelta - 1)/16; /* integer division */
|
|
temp = keyOld;
|
|
for (i = 0; i < iterations; i++) {
|
|
temp = MD5 (temp || random);
|
|
keyNew[i*16 .. (i*16)+15] =
|
|
temp XOR delta[i*16 .. (i*16)+15];
|
|
}
|
|
temp = MD5 (temp || random);
|
|
keyNew[i*16 .. lenOfDelta-1] =
|
|
temp XOR delta[i*16 .. lenOfDelta-1];
|
|
|
|
The value of an object with this syntax, whenever it is
|
|
retrieved by the management protocol, is always the zero
|
|
length string.
|
|
|
|
Note that the keyOld and keyNew are the localized keys.
|
|
|
|
Note that it is probably wise that when an SNMP entity sends
|
|
a SetRequest to change a key, that it keeps a copy of the old
|
|
key until it has confirmed that the key change actually
|
|
succeeded.
|
|
"
|
|
SYNTAX OCTET STRING
|
|
|
|
|
|
-- Statistics for the User-based Security Model **********************
|
|
|
|
|
|
usmStats OBJECT IDENTIFIER ::= { usmMIBObjects 1 }
|
|
|
|
|
|
usmStatsUnsupportedSecLevels OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "The total number of packets received by the SNMP
|
|
engine which were dropped because they requested a
|
|
securityLevel that was unknown to the SNMP engine
|
|
or otherwise unavailable.
|
|
"
|
|
::= { usmStats 1 }
|
|
|
|
usmStatsNotInTimeWindows OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "The total number of packets received by the SNMP
|
|
engine which were dropped because they appeared
|
|
outside of the authoritative SNMP engine's window.
|
|
"
|
|
::= { usmStats 2 }
|
|
|
|
usmStatsUnknownUserNames OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "The total number of packets received by the SNMP
|
|
engine which were dropped because they referenced a
|
|
user that was not known to the SNMP engine.
|
|
"
|
|
::= { usmStats 3 }
|
|
|
|
usmStatsUnknownEngineIDs OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "The total number of packets received by the SNMP
|
|
engine which were dropped because they referenced an
|
|
snmpEngineID that was not known to the SNMP engine.
|
|
"
|
|
::= { usmStats 4 }
|
|
|
|
usmStatsWrongDigests OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "The total number of packets received by the SNMP
|
|
engine which were dropped because they didn't
|
|
contain the expected digest value.
|
|
"
|
|
::= { usmStats 5 }
|
|
|
|
usmStatsDecryptionErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "The total number of packets received by the SNMP
|
|
engine which were dropped because they could not be
|
|
decrypted.
|
|
"
|
|
::= { usmStats 6 }
|
|
|
|
-- The usmUser Group ************************************************
|
|
|
|
usmUser OBJECT IDENTIFIER ::= { usmMIBObjects 2 }
|
|
|
|
usmUserSpinLock OBJECT-TYPE
|
|
SYNTAX TestAndIncr
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION "An advisory lock used to allow several cooperating
|
|
Command Generator Applications to coordinate their
|
|
use of facilities to alter secrets in the
|
|
usmUserTable.
|
|
"
|
|
::= { usmUser 1 }
|
|
|
|
-- The table of valid users for the User-based Security Model ********
|
|
|
|
|
|
usmUserTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF UsmUserEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "The table of users configured in the SNMP engine's
|
|
Local Configuration Datastore (LCD).
|
|
|
|
To create a new user (i.e., to instantiate a new
|
|
conceptual row in this table), it is recommended to
|
|
follow this procedure:
|
|
|
|
1) GET(usmUserSpinLock.0) and save in sValue.
|
|
2) SET(usmUserSpinLock.0=sValue,
|
|
usmUserCloneFrom=templateUser,
|
|
usmUserStatus=createAndWait)
|
|
You should use a template user to clone from
|
|
which has the proper auth/priv protocol defined.
|
|
|
|
If the new user is to use privacy:
|
|
|
|
3) generate the keyChange value based on the secret
|
|
privKey of the clone-from user and the secret key
|
|
to be used for the new user. Let us call this
|
|
pkcValue.
|
|
4) GET(usmUserSpinLock.0) and save in sValue.
|
|
5) SET(usmUserSpinLock.0=sValue,
|
|
usmUserPrivKeyChange=pkcValue
|
|
usmUserPublic=randomValue1)
|
|
6) GET(usmUserPulic) and check it has randomValue1.
|
|
If not, repeat steps 4-6.
|
|
|
|
If the new user will never use privacy:
|
|
|
|
7) SET(usmUserPrivProtocol=usmNoPrivProtocol)
|
|
|
|
If the new user is to use authentication:
|
|
|
|
8) generate the keyChange value based on the secret
|
|
authKey of the clone-from user and the secret key
|
|
to be used for the new user. Let us call this
|
|
akcValue.
|
|
9) GET(usmUserSpinLock.0) and save in sValue.
|
|
10) SET(usmUserSpinLock.0=sValue,
|
|
usmUserAuthKeyChange=akcValue
|
|
usmUserPublic=randomValue2)
|
|
11) GET(usmUserPulic) and check it has randomValue2.
|
|
If not, repeat steps 9-11.
|
|
|
|
If the new user will never use authentication:
|
|
|
|
12) SET(usmUserAuthProtocol=usmNoAuthProtocol)
|
|
|
|
Finally, activate the new user:
|
|
|
|
13) SET(usmUserStatus=active)
|
|
|
|
The new user should now be available and ready to be
|
|
used for SNMPv3 communication. Note however that access
|
|
to MIB data must be provided via configuration of the
|
|
SNMP-VIEW-BASED-ACM-MIB.
|
|
|
|
The use of usmUserSpinlock is to avoid conflicts with
|
|
another SNMP command responder application which may
|
|
also be acting on the usmUserTable.
|
|
"
|
|
::= { usmUser 2 }
|
|
|
|
usmUserEntry OBJECT-TYPE
|
|
SYNTAX UsmUserEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "A user configured in the SNMP engine's Local
|
|
Configuration Datastore (LCD) for the User-based
|
|
Security Model.
|
|
"
|
|
INDEX { usmUserEngineID,
|
|
usmUserName
|
|
}
|
|
::= { usmUserTable 1 }
|
|
|
|
UsmUserEntry ::= SEQUENCE
|
|
{
|
|
usmUserEngineID SnmpEngineID,
|
|
usmUserName SnmpAdminString,
|
|
usmUserSecurityName SnmpAdminString,
|
|
usmUserCloneFrom RowPointer,
|
|
usmUserAuthProtocol AutonomousType,
|
|
usmUserAuthKeyChange KeyChange,
|
|
usmUserOwnAuthKeyChange KeyChange,
|
|
usmUserPrivProtocol AutonomousType,
|
|
usmUserPrivKeyChange KeyChange,
|
|
usmUserOwnPrivKeyChange KeyChange,
|
|
usmUserPublic OCTET STRING,
|
|
usmUserStorageType StorageType,
|
|
usmUserStatus RowStatus
|
|
}
|
|
|
|
--
|
|
--
|
|
usmUserEngineID OBJECT-TYPE
|
|
SYNTAX SnmpEngineID
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "An SNMP engine's administratively-unique identifier.
|
|
|
|
In a simple agent, this value is always that agent's
|
|
own snmpEngineID value.
|
|
|
|
The value can also take the value of the snmpEngineID
|
|
of a remote SNMP engine with which this user can
|
|
communicate.
|
|
"
|
|
::= { usmUserEntry 1 }
|
|
|
|
usmUserName OBJECT-TYPE
|
|
SYNTAX SnmpAdminString (SIZE(1..32))
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "A human readable string representing the name of
|
|
the user.
|
|
|
|
This is the (User-based Security) Model dependent
|
|
security ID.
|
|
"
|
|
::= { usmUserEntry 2 }
|
|
|
|
usmUserSecurityName OBJECT-TYPE
|
|
SYNTAX SnmpAdminString
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "A human readable string representing the user in
|
|
Security Model independent format.
|
|
|
|
The default transformation of the User-based Security
|
|
Model dependent security ID to the securityName and
|
|
vice versa is the identity function so that the
|
|
securityName is the same as the userName.
|
|
"
|
|
::= { usmUserEntry 3 }
|
|
|
|
usmUserCloneFrom OBJECT-TYPE
|
|
SYNTAX RowPointer
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "A pointer to another conceptual row in this
|
|
usmUserTable. The user in this other conceptual
|
|
row is called the clone-from user.
|
|
|
|
When a new user is created (i.e., a new conceptual
|
|
row is instantiated in this table), the privacy and
|
|
authentication parameters of the new user must be
|
|
cloned from its clone-from user. These parameters are:
|
|
- authentication protocol (usmUserAuthProtocol)
|
|
- privacy protocol (usmUserPrivProtocol)
|
|
They will be copied regardless of what the current
|
|
value is.
|
|
|
|
Cloning also causes the initial values of the secret
|
|
authentication key (authKey) and the secret encryption
|
|
key (privKey) of the new user to be set to the same
|
|
value as the corresponding secret of the clone-from
|
|
user.
|
|
|
|
The first time an instance of this object is set by
|
|
a management operation (either at or after its
|
|
instantiation), the cloning process is invoked.
|
|
Subsequent writes are successful but invoke no
|
|
action to be taken by the receiver.
|
|
The cloning process fails with an 'inconsistentName'
|
|
error if the conceptual row representing the
|
|
clone-from user does not exist or is not in an active
|
|
state when the cloning process is invoked.
|
|
|
|
When this object is read, the ZeroDotZero OID
|
|
is returned.
|
|
"
|
|
::= { usmUserEntry 4 }
|
|
|
|
usmUserAuthProtocol OBJECT-TYPE
|
|
SYNTAX AutonomousType
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "An indication of whether messages sent on behalf of
|
|
this user to/from the SNMP engine identified by
|
|
usmUserEngineID, can be authenticated, and if so,
|
|
the type of authentication protocol which is used.
|
|
|
|
An instance of this object is created concurrently
|
|
with the creation of any other object instance for
|
|
the same user (i.e., as part of the processing of
|
|
the set operation which creates the first object
|
|
instance in the same conceptual row).
|
|
|
|
If an initial set operation (i.e. at row creation time)
|
|
tries to set a value for an unknown or unsupported
|
|
protocol, then a 'wrongValue' error must be returned.
|
|
|
|
The value will be overwritten/set when a set operation
|
|
is performed on the corresponding instance of
|
|
usmUserCloneFrom.
|
|
|
|
Once instantiated, the value of such an instance of
|
|
this object can only be changed via a set operation to
|
|
the value of the usmNoAuthProtocol.
|
|
|
|
If a set operation tries to change the value of an
|
|
existing instance of this object to any value other
|
|
than usmNoAuthProtocol, then an 'inconsistentValue'
|
|
error must be returned.
|
|
|
|
If a set operation tries to set the value to the
|
|
usmNoAuthProtocol while the usmUserPrivProtocol value
|
|
in the same row is not equal to usmNoPrivProtocol,
|
|
then an 'inconsistentValue' error must be returned.
|
|
That means that an SNMP command generator application
|
|
must first ensure that the usmUserPrivProtocol is set
|
|
to the usmNoPrivProtocol value before it can set
|
|
the usmUserAuthProtocol value to usmNoAuthProtocol.
|
|
"
|
|
DEFVAL { usmNoAuthProtocol }
|
|
::= { usmUserEntry 5 }
|
|
|
|
usmUserAuthKeyChange OBJECT-TYPE
|
|
SYNTAX KeyChange -- typically (SIZE (0 | 32)) for HMACMD5
|
|
-- typically (SIZE (0 | 40)) for HMACSHA
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "An object, which when modified, causes the secret
|
|
authentication key used for messages sent on behalf
|
|
of this user to/from the SNMP engine identified by
|
|
usmUserEngineID, to be modified via a one-way
|
|
function.
|
|
|
|
The associated protocol is the usmUserAuthProtocol.
|
|
The associated secret key is the user's secret
|
|
authentication key (authKey). The associated hash
|
|
algorithm is the algorithm used by the user's
|
|
usmUserAuthProtocol.
|
|
|
|
When creating a new user, it is an 'inconsistentName'
|
|
error for a set operation to refer to this object
|
|
unless it is previously or concurrently initialized
|
|
through a set operation on the corresponding instance
|
|
of usmUserCloneFrom.
|
|
|
|
When the value of the corresponding usmUserAuthProtocol
|
|
is usmNoAuthProtocol, then a set is successful, but
|
|
effectively is a no-op.
|
|
|
|
When this object is read, the zero-length (empty)
|
|
string is returned.
|
|
|
|
The recommended way to do a key change is as follows:
|
|
|
|
1) GET(usmUserSpinLock.0) and save in sValue.
|
|
2) generate the keyChange value based on the old
|
|
(existing) secret key and the new secret key,
|
|
let us call this kcValue.
|
|
|
|
If you do the key change on behalf of another user:
|
|
|
|
3) SET(usmUserSpinLock.0=sValue,
|
|
usmUserAuthKeyChange=kcValue
|
|
usmUserPublic=randomValue)
|
|
|
|
If you do the key change for yourself:
|
|
|
|
4) SET(usmUserSpinLock.0=sValue,
|
|
usmUserOwnAuthKeyChange=kcValue
|
|
usmUserPublic=randomValue)
|
|
|
|
If you get a response with error-status of noError,
|
|
then the SET succeeded and the new key is active.
|
|
If you do not get a response, then you can issue a
|
|
GET(usmUserPublic) and check if the value is equal
|
|
to the randomValue you did send in the SET. If so, then
|
|
the key change succeeded and the new key is active
|
|
(probably the response got lost). If not, then the SET
|
|
request probably never reached the target and so you
|
|
can start over with the procedure above.
|
|
"
|
|
DEFVAL { ''H } -- the empty string
|
|
::= { usmUserEntry 6 }
|
|
|
|
usmUserOwnAuthKeyChange OBJECT-TYPE
|
|
SYNTAX KeyChange -- typically (SIZE (0 | 32)) for HMACMD5
|
|
-- typically (SIZE (0 | 40)) for HMACSHA
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "Behaves exactly as usmUserAuthKeyChange, with one
|
|
notable difference: in order for the set operation
|
|
to succeed, the usmUserName of the operation
|
|
requester must match the usmUserName that
|
|
indexes the row which is targeted by this
|
|
operation.
|
|
In addition, the USM security model must be
|
|
used for this operation.
|
|
|
|
The idea here is that access to this column can be
|
|
public, since it will only allow a user to change
|
|
his own secret authentication key (authKey).
|
|
Note that this can only be done once the row is active.
|
|
|
|
When a set is received and the usmUserName of the
|
|
requester is not the same as the umsUserName that
|
|
indexes the row which is targeted by this operation,
|
|
then a 'noAccess' error must be returned.
|
|
|
|
When a set is received and the security model in use
|
|
is not USM, then a 'noAccess' error must be returned.
|
|
"
|
|
DEFVAL { ''H } -- the empty string
|
|
::= { usmUserEntry 7 }
|
|
|
|
|
|
usmUserPrivProtocol OBJECT-TYPE
|
|
SYNTAX AutonomousType
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "An indication of whether messages sent on behalf of
|
|
this user to/from the SNMP engine identified by
|
|
usmUserEngineID, can be protected from disclosure,
|
|
and if so, the type of privacy protocol which is used.
|
|
|
|
An instance of this object is created concurrently
|
|
with the creation of any other object instance for
|
|
the same user (i.e., as part of the processing of
|
|
the set operation which creates the first object
|
|
instance in the same conceptual row).
|
|
|
|
If an initial set operation (i.e. at row creation time)
|
|
tries to set a value for an unknown or unsupported
|
|
protocol, then a 'wrongValue' error must be returned.
|
|
|
|
The value will be overwritten/set when a set operation
|
|
is performed on the corresponding instance of
|
|
usmUserCloneFrom.
|
|
|
|
Once instantiated, the value of such an instance of
|
|
this object can only be changed via a set operation to
|
|
the value of the usmNoPrivProtocol.
|
|
|
|
If a set operation tries to change the value of an
|
|
existing instance of this object to any value other
|
|
than usmNoPrivProtocol, then an 'inconsistentValue'
|
|
error must be returned.
|
|
|
|
Note that if any privacy protocol is used, then you
|
|
must also use an authentication protocol. In other
|
|
words, if usmUserPrivProtocol is set to anything else
|
|
than usmNoPrivProtocol, then the corresponding instance
|
|
of usmUserAuthProtocol cannot have a value of
|
|
usmNoAuthProtocol. If it does, then an
|
|
'inconsistentValue' error must be returned.
|
|
"
|
|
DEFVAL { usmNoPrivProtocol }
|
|
::= { usmUserEntry 8 }
|
|
|
|
usmUserPrivKeyChange OBJECT-TYPE
|
|
SYNTAX KeyChange -- typically (SIZE (0 | 32)) for DES
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "An object, which when modified, causes the secret
|
|
encryption key used for messages sent on behalf
|
|
of this user to/from the SNMP engine identified by
|
|
usmUserEngineID, to be modified via a one-way
|
|
function.
|
|
|
|
The associated protocol is the usmUserPrivProtocol.
|
|
The associated secret key is the user's secret
|
|
privacy key (privKey). The associated hash
|
|
algorithm is the algorithm used by the user's
|
|
usmUserAuthProtocol.
|
|
|
|
When creating a new user, it is an 'inconsistentName'
|
|
error for a set operation to refer to this object
|
|
unless it is previously or concurrently initialized
|
|
through a set operation on the corresponding instance
|
|
of usmUserCloneFrom.
|
|
|
|
When the value of the corresponding usmUserPrivProtocol
|
|
is usmNoPrivProtocol, then a set is successful, but
|
|
effectively is a no-op.
|
|
|
|
When this object is read, the zero-length (empty)
|
|
string is returned.
|
|
See the description clause of usmUserAuthKeyChange for
|
|
a recommended procedure to do a key change.
|
|
"
|
|
DEFVAL { ''H } -- the empty string
|
|
::= { usmUserEntry 9 }
|
|
|
|
usmUserOwnPrivKeyChange OBJECT-TYPE
|
|
SYNTAX KeyChange -- typically (SIZE (0 | 32)) for DES
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "Behaves exactly as usmUserPrivKeyChange, with one
|
|
notable difference: in order for the Set operation
|
|
to succeed, the usmUserName of the operation
|
|
requester must match the usmUserName that indexes
|
|
the row which is targeted by this operation.
|
|
In addition, the USM security model must be
|
|
used for this operation.
|
|
|
|
The idea here is that access to this column can be
|
|
public, since it will only allow a user to change
|
|
his own secret privacy key (privKey).
|
|
Note that this can only be done once the row is active.
|
|
|
|
When a set is received and the usmUserName of the
|
|
requester is not the same as the umsUserName that
|
|
indexes the row which is targeted by this operation,
|
|
then a 'noAccess' error must be returned.
|
|
|
|
When a set is received and the security model in use
|
|
is not USM, then a 'noAccess' error must be returned.
|
|
"
|
|
DEFVAL { ''H } -- the empty string
|
|
::= { usmUserEntry 10 }
|
|
|
|
usmUserPublic OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE(0..32))
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "A publicly-readable value which can be written as part
|
|
of the procedure for changing a user's secret
|
|
authentication and/or privacy key, and later read to
|
|
determine whether the change of the secret was
|
|
effected.
|
|
"
|
|
DEFVAL { ''H } -- the empty string
|
|
::= { usmUserEntry 11 }
|
|
|
|
usmUserStorageType OBJECT-TYPE
|
|
SYNTAX StorageType
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "The storage type for this conceptual row.
|
|
|
|
Conceptual rows having the value 'permanent' must
|
|
allow write-access at a minimum to:
|
|
|
|
- usmUserAuthKeyChange, usmUserOwnAuthKeyChange
|
|
and usmUserPublic for a user who employs
|
|
authentication, and
|
|
- usmUserPrivKeyChange, usmUserOwnPrivKeyChange
|
|
and usmUserPublic for a user who employs
|
|
privacy.
|
|
|
|
Note that any user who employs authentication or
|
|
privacy must allow its secret(s) to be updated and
|
|
thus cannot be 'readOnly'.
|
|
|
|
If an initial set operation tries to set the value to
|
|
'readOnly' for a user who employs authentication or
|
|
privacy, then an 'inconsistentValue' error must be
|
|
returned. Note that if the value has been previously
|
|
set (implicit or explicit) to any value, then the rules
|
|
as defined in the StorageType Textual Convention apply.
|
|
|
|
It is an implementation issue to decide if a SET for
|
|
a readOnly or permanent row is accepted at all. In some
|
|
contexts this may make sense, in others it may not. If
|
|
a SET for a readOnly or permanent row is not accepted
|
|
at all, then a 'wrongValue' error must be returned.
|
|
"
|
|
DEFVAL { nonVolatile }
|
|
::= { usmUserEntry 12 }
|
|
|
|
usmUserStatus OBJECT-TYPE
|
|
SYNTAX RowStatus
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION "The status of this conceptual row.
|
|
|
|
Until instances of all corresponding columns are
|
|
appropriately configured, the value of the
|
|
corresponding instance of the usmUserStatus column
|
|
is 'notReady'.
|
|
|
|
In particular, a newly created row for a user who
|
|
employs authentication, cannot be made active until the
|
|
corresponding usmUserCloneFrom and usmUserAuthKeyChange
|
|
have been set.
|
|
|
|
Further, a newly created row for a user who also
|
|
employs privacy, cannot be made active until the
|
|
usmUserPrivKeyChange has been set.
|
|
|
|
The RowStatus TC [RFC2579] requires that this
|
|
DESCRIPTION clause states under which circumstances
|
|
other objects in this row can be modified:
|
|
|
|
The value of this object has no effect on whether
|
|
other objects in this conceptual row can be modified,
|
|
except for usmUserOwnAuthKeyChange and
|
|
usmUserOwnPrivKeyChange. For these 2 objects, the
|
|
value of usmUserStatus MUST be active.
|
|
"
|
|
::= { usmUserEntry 13 }
|
|
|
|
-- Conformance Information *******************************************
|
|
|
|
usmMIBCompliances OBJECT IDENTIFIER ::= { usmMIBConformance 1 }
|
|
usmMIBGroups OBJECT IDENTIFIER ::= { usmMIBConformance 2 }
|
|
|
|
-- Compliance statements
|
|
|
|
usmMIBCompliance MODULE-COMPLIANCE
|
|
STATUS current
|
|
DESCRIPTION "The compliance statement for SNMP engines which
|
|
implement the SNMP-USER-BASED-SM-MIB.
|
|
"
|
|
|
|
MODULE -- this module
|
|
MANDATORY-GROUPS { usmMIBBasicGroup }
|
|
OBJECT usmUserAuthProtocol
|
|
MIN-ACCESS read-only
|
|
DESCRIPTION "Write access is not required."
|
|
|
|
OBJECT usmUserPrivProtocol
|
|
MIN-ACCESS read-only
|
|
DESCRIPTION "Write access is not required."
|
|
|
|
::= { usmMIBCompliances 1 }
|
|
|
|
-- Units of compliance
|
|
usmMIBBasicGroup OBJECT-GROUP
|
|
OBJECTS {
|
|
usmStatsUnsupportedSecLevels,
|
|
usmStatsNotInTimeWindows,
|
|
usmStatsUnknownUserNames,
|
|
usmStatsUnknownEngineIDs,
|
|
usmStatsWrongDigests,
|
|
usmStatsDecryptionErrors,
|
|
usmUserSpinLock,
|
|
usmUserSecurityName,
|
|
usmUserCloneFrom,
|
|
usmUserAuthProtocol,
|
|
usmUserAuthKeyChange,
|
|
usmUserOwnAuthKeyChange,
|
|
usmUserPrivProtocol,
|
|
usmUserPrivKeyChange,
|
|
usmUserOwnPrivKeyChange,
|
|
usmUserPublic,
|
|
usmUserStorageType,
|
|
usmUserStatus
|
|
}
|
|
STATUS current
|
|
DESCRIPTION "A collection of objects providing for configuration
|
|
of an SNMP engine which implements the SNMP
|
|
User-based Security Model.
|
|
"
|
|
::= { usmMIBGroups 1 }
|
|
|
|
END
|