snmp-trap in inetd.sec is not working

[NTC]

Hi all,
I am trying to block certain ip's that send trapd to our UNix machine (NNM server). i have put the command:
snmp-trap 172.20.10.4,172.20.11.34
in /var/adm/inetd.sec and killed inetd ( inetd -k) and restarted it then i still see thoese traps coming. any thing to do is still missing??
Thanx
sbk

[Hemmetter]

HI

Do you want to deny/allow the addresses from above?

Try
snmp-trap allow 172.20.10.4,172.20.11.34
or
snmp-trap deny 172.20.10.4,172.20.11.34

rgds
HGH

[NTC]

Thanx Hemmetter,

I have missed the word deny in writing the thread, i ahev actually put:
snmp-trap deny 172.20.10.4,172.20.11.34

and im still getting traps from these ip's. anything more need to be done other than restarting inetd??

Regards
sbk

[Antonio Cardoso_1]

Hi,

are you sure the traps are being received by inetd?
I may be wrong, but I'd rather think traps to be received directly by ovtrapd process.
=> the response is thus probably on NNM configuration...

HTH,
antonio.

[NTC]

Hello Antonio,
I suppose all the incoming traffic is passing through the inetd before being processed because the inetd provide a security layer of control. so i dont know if ovtrapd bypass the inetd.sec i need someone with a good experience on that to tell me.

thanx
sbk

[Hemmetter]

hi

You can see what process handles
snmpd-trap ( 162/udp ) with lsof

# lsof -i4udp:162 | grep Idle

the first column of the output shows the "commad" that handles that port.

If it is "inetd" then inetd.sec is used.
Else do a
# ldd "path-to-command"
on the "command" you find in the lsof-output.
If there is a line with "libsec" or "libwrap"
then you may use /etc/hosts.allow. like:

"command : "ip" : allow|deny


rgds
HGH

[Hemmetter]

hi again

add to my last post:

the /etc/hosts.allow syntax may differ between hp-ux and e.g. Linux

@hp-ux everything mentioned in /etc/hosts.allow is allowed:
"command" : "ip-list"

you need a /etc/hosts.deny to deny every thing else:
"ALL : ALL "



Confusion perfect?

rgds
HGH