get-community-name: public

[Omprakash_2]

Hi,

Can any one suggest me for the mentioned entries in /etc/SnmpAgent.d/snmpd.conf

get-community-name: public

1. For what it is required?

2. What happen when we put # before this entry.

Its very urgent for me need to send a report for Security health check. Plsssssss

[Johnson Punniyalingam]

DESCRIPTION
When invoked, the SNMP agent reads its configuration information from the /etc/SnmpAgent.d/snmpd.conf configuration file. The SNMP agent is either the snmpd(1M) (included with HP-UX) or the snmpd.ea(1M) (purchased with the OpenView product). The SNMP agent operates correctly if no values are configured in /etc/SnmpAgent.d/snmpd.conf.

/etc/SnmpAgent.d/snmpd.conf contains the following configurable values:

get-community-name: name IP: addr VIEW: mib-view
Specifies a community name for the agent. The agent responds to SNMP GetRequests with this community name. You can configure the agent to respond to more than one get community name. If a community name is not entered, the agent responds to SNMP GetRequests using any community name.

There are two, optional, fields that may be associated with a community name. They are IP: and VIEW:. These fields allow you to associate manager IP addresses and MIB views with community names.

Following IP: is a list of IP address in dot notation. The list MUST be space separated. Only SNMP Requests with one of these IP addresses, as the source address, will be accepted. Any source IP address will be allowed if; IP: does not appear on the line, no IP address appears after IP:, or an address of 0.0.0.0 is placed after IP:. No wildcarding is supported.

The VIEW: is used to associate a MIB view with the community string. Placing a name or OID from some portion of the MIB tree will cause that object plus all portions of the tree below that object to be included in the view. Several names may be placed on the line after VIEW: and MUST be space separated. If the '-' character proceeds an object name then it is excluded from the NIB view. For example: VIEW: internet -mib-2 would allow access to all of internet except for mib-2. The default mib view will be assigned if VIEW: does not appear on the line or no MIB view appears after VIEW:. It is important to note that any MIB object(s) specified after VIEW: override the default MIB view and are not used in conjunction with it. The default MIB view is specified below under default-mibVIEW: and is configurable.

Lines may be continued using the ``\'' character.

set-community-name: name IP: addr VIEW: mib-view
Specifies community name for the agent. The agent responds to the SNMP SetRequests with this community name. You can configure the agent to respond to more than one set community name. If a community name is not entered, the agent returns an error. The IP: and VIEW: fields for set community names are the same as for get community names. See above.

trap-dest:
Specifies a system name where traps are sent (that is, the trap destination). This system name is usually the host name or IP address of the manager. If traps should be sent to multiple systems then a trap-dest line should be included for each system.

location:
Specifies the physical location of the agent.

contact:
Specifies the person responsible for this agent and information on how to contact this person.

sys-descr:
Specifies the system description. This value becomes the system.sysDescr MIB object.

default-mibVIEW:
Specifies the new default MIB view. By default, the MIB view of internet is set by the system. The default MIB view may be changed several times and anywhere in the configuration file. This new MIB view is "in effect" from the point in the file that it is defined until another default-mibVIEW: is encountered. To reset the system supplied MIB view, enter default-mibVIEW: with no MIB objects after it. The MIB view values are specified in the same way as for the get-community-name: above.

Separate the fields by blanks or tabs. A # character indicates the beginning of a comment; characters from the # character to the end of the line are ignored.


EXAMPLES
Each line in the following example snmpd.conf file is preceded by a comment (beginning with #) that explains the entry. Please note that this is an example. Taken as a whole in is not intended to represent a configuration that you should use. It's sole purpose is to show the flexibility of the configuration file.

# We'll specify the location, contact, and sysDescr first.
location: Somewhere in the building.
contact: Jane Doe
sys-descr: HP-UX testsys1 A.09.04 E 9000/887 400509201

# This community string has the system default MIB view
# and any management station can use it.
get-community-name: globalget

# Setting a new default MIB view.
default-mibVIEW: system

# The following get and set community names will have the new
# default MIB view of system. But are restricted to use by
# systems 15.2.2.1 and 15.2.2.3. Note that the sysset community
# string is only usable from 15.2.2.1.
get-community-name: sysget IP: 15.2.2.1 15.2.2.3
set-community-name: sysset IP: 15.2.2.1

# Resetting the default MIB view back to the original
# system default.
default-mibVIEW:

# Now allow some specific machines access to limited
# portions of the MIB.
# Note use of line continuation character '\'.
get-community-name: monitor IP: 15.3.2.1 15.4.23.1 VIEW: system \
interfaces at ip snmp
get-community-name: public IP: 0.0.0.0 VIEW: system

# Set up an administrative role and a root role.
set-community-name: admin IP: 15.3.2.1 15.4.23.1 VIEW: internet \
-private
set-community-name: root IP: 15.3.2.1 VIEW: internet

# Specify some trap dests.
trap-dest: 15.2.1.45
trap-dest: 15.3.2.1
trap-dest: 15.4.23.1

Thanks,
JOhnson

[Md. Farhan A Azam]

Hi Omprakash,

>>get-community-name: public<<
This is the SNMP community name, most of the security people will ask to change it from public to some other name as per your needs.

Thnx...Farhan