1 Introduction

1 Introduction

1.1 Goals

Learn How to setup SNMPv3

1.2 Note

SHA authentication and DES/AES encryption support is only available if you have OpenSSL installed.
Encryption support now is enabled in the binary releases downloadable from the net-snmp web site.
This description assumes you're using the software compiled from source, and so installed using the default prefix location (/usr/local).
If you're working with a vendor-provided system, or have configured things with a different prefix, you'll need to adjust locations accordingly.

1.3 # CREATING THE FIRST USER:

On Ubuntu 14.04, install libsnmp-dev

sudo apt-get install libsnmp-dev

Because of an Ubuntu bug (https://bugs.launchpad.net/ubuntu/+source/net-snmp/+bug/1322431), the command to create SNMPv3 users is missing, so, until this is fixed, download the net-snmp-create-v3-user to /usr/local/bin and make sure it's executable:

cd /usr/local/bin
sudo wget http://noc.ws.nsrc.org/downloads/net-snmp-create-v3-user

Paste in the contents of net-snmp-create-v3-user into this file and save. Make it executable:

sudo chmod +x /usr/local/bin/net-snmp-create-v3-user

First, you need to create a new snmpv3 user and give them rights to do things. Stop the snmpd service, then create the user, and restart the snmpd service:

sudo service snmpd stop
sudo net-snmp-create-v3-user -a SHA -A NetManage -x AES admin
sudo service snmpd start

WARNING: SNMPv3 pass phrases must be at least 8 characters long!

The above line creates the user "admin" with a password of "NetManage" (and uses MD5 and DES for protection).

net-snmp-create-v3-user will also add a line to your snmpd.conf file to let that user have read/write access to your agent. You may want to change this in your snmpd.conf file (see the snmpd.conf manual page). Run net-snmp-config --help for more information about it.

Test your setup:

snmpget -v 3 -u admin -l authNoPriv -a SHA -A NetManage localhost sysUpTime.0

This should return information about how long your agent has been up

snmpget -v 3 -u admin -l authPriv -a SHA -A NetManage -x AES -X NetManage localhost sysUpTime.0

This should return similar information, but encrypts the transmission

1.4 # FURTHER STUDIES:

1.5 Tired of all those command line authentication options?

put something like this in your $HOME/.snmp/snmp.conf file (make it readable only by you!!!):

defSecurityName admin
defContext ""
defAuthType SHA
defSecurityLevel authNoPriv
defAuthPassphrase NetManage
defVersion 3

And this is in place the last of the above example lines boils down to:

snmpget localhost sysUpTime.0