0

I'm having trouble getting snmptrapd to accept remote SNMPv3 TRAP messages.

Here's my simple snmptrapd.conf:

root@snmptrapper:~# cat /tmp/testsnmptrapd.conf
createUser -e 0x80001f8880013da3af54da7882 skohrs MD5 PaSSWoRD DES
createUser -e 0x80001f888047483cc654cfeee8 skohrs MD5 PaSSWoRD DES
authUser log skohrs

When I start the service, I can see it creates both users. However, when the remote message comes in, it can't match the remote engineID:

root@snmptrapper:~# snmptrapd -f -C -c /tmp/testsnmptrapd.conf -Le -Dusm,usmUser,snmptrapd
registered debug token usm, 1
registered debug token usmUser, 1
registered debug token snmptrapd, 1
netsnmp_assert !"registration != duplicate" failed agent_registry.c:535 netsnmp_subtree_load()
netsnmp_assert !"registration != duplicate" failed agent_registry.c:535 netsnmp_subtree_load()
netsnmp_assert !"registration != duplicate" failed agent_registry.c:535 netsnmp_subtree_load()
usmUser: created a new user skohrs at 80 00 1F 88 80 01 3D A3 AF 54 DA 78 82
usmUser: created a new user skohrs at 80 00 1F 88 80 47 48 3C C6 54 CF EE E8
NET-SNMP version 5.4.1


usm: USM processing begun...
usm: match on user skohrs
usm: no match on engineID (80 00 1F 88 80 47 48 3C C6 54 CF EE E8 )
usm: match on user skohrs
usm: Verification succeeded.
usm: USM processing completed.
snmptrapd: input: a7
snmptrapd: Trap OID: DISMAN-EVENT-MIB::sysUpTimeInstance
snmptrapd: Running auth trap handlers
snmptrapd:auth: Comparing auth types: result=8, request=0, result=1
snmptrapd:auth: Calling VACM for checking phase 0:read
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 1:write
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 2:notify
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 3:log
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 4:execute
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 5:net
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 6:(null)
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 7:(null)
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Final bitmask auth: 0
snmptrapd:auth: Dropping unauthorized message

If I send an SNMPv3 TRAP from the localhost, the message is logged:

usm: USM processing begun...
usm: match on user skohrs
usm: Verification succeeded.
usm: USM processing completed.
snmptrapd: input: a7
snmptrapd: Trap OID: DISMAN-EVENT-MIB::sysUpTimeInstance
snmptrapd: Running auth trap handlers
snmptrapd:auth: Comparing auth types: result=0, request=0, result=1
snmptrapd:auth: Calling VACM for checking phase 0:read
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 1:write
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 2:notify
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 3:log
snmptrapd:auth:   result: authorized
snmptrapd:auth: Calling VACM for checking phase 4:execute
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 5:net
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 6:(null)
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Calling VACM for checking phase 7:(null)
snmptrapd:auth:   result: not authorized
snmptrapd:auth: Final bitmask auth: 8
snmptrapd: Running pre-global trap handlers
snmptrapd:auth: Comparing auth types: result=8, request=8, result=1
snmptrapd: print_handler
snmptrapd: v2/3 format
2015-02-11 09:40:51 localhost [UDP: [127.0.0.1]:48403]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (55) 0:00:00.55        SNMPv2-MIB::snmpTrapOID.0 = OID: DISMAN-EVENT-MIB::sysUpTimeInstance
snmptrapd: Running trap specific handlers
snmptrapd: get_traphandler default (0)
snmptrapd: Running global handlers
snmptrapd:auth: Comparing auth types: result=8, request=8, result=1
snmptrapd: notification_handler

Here is the snmptrap command I'm using, in case that's the problem:

root@client:~# snmptrap -v3 -a MD5 -A PaSSWoRD -x DES -X PaSSWoRD -u skohrs -mALL -l authPriv -Dusm snmptrapper 55 sysUpTime.0

The net-snmp Wiki and man pages aren't much help. I'm hoping someone here can offer some guidance.

0

I discovered the problem by enabling all debug options for snmptrapd with -Dall:

root@snmptrapper:~# snmptrapd -f -C -c /root/testsnmptrapd.conf -Le -Dall

The issue turned out to be a bad context set in ~/.snmp/snmp.conf. I had created this file, early in the initial SNMPv3 setup.

root@client:~# cat ~/.snmp/snmp.conf
defContext none
defVersion 3
defSecurityName skohrs
defAuthType MD5
defAuthPassphrase PaSSWoRD
defPrivType DES
defPrivPassphrase PaSSWoRD
defSecurityLevel authPriv

I misunderstood that defContext none is not the same as setting the context to"". When I deleted that token, the remote SNMPv3 TRAP messages were logged correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.