Institute of Telecommunications. koniec wykładu V.

Wielkość: px

Rozpocząć pokaz od strony:

Download "Institute of Telecommunications. koniec wykładu V. mariusz@tele.pw.edu.pl"

Teresa Kurek
8 lat temu
Przeglądów:

1 koniec wykładu V

2 operacje na wierszu tablicy wymagania MAX-ACCESS= read-create obecność kolumny typu RowStatus operacje tworzenie (creation) zawieszanie (suspension) SetRequest( RowStatus= notinservice) usunięcie (deletion) SetRequest( RowStatus= destroy)

tworzenie (creation) zawieszanie (suspension) SetRequest(

3 wartości kolumny RowStatus active (rw), which indicates that the conceptual row is available for use by the managed device; notinservice (rw), which indicates that the conceptual row exists in the agent, but is unavailable for use by the managed device notready (r), which indicates that the conceptual row exists in the agent, but is missing information necessary in order to be available for use by the managed device; createandgo (rw), which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making it available for use by the managed device; createandwait (rw), which is supplied by a management station wishing to create a new instance of a conceptual row (but not make it available for use by the managed device); and, destroy (rw), which is supplied by a management station wishing to delete all of the instances associated with an existing conceptual row.

use by the managed device; createandgo (rw), which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making

4 tworzenie wiersza ustalenie OID na podstawie wartości obiektu pomocniczego na podstawie znanych reguł SetRequest( RowStatus=CreateAndGo, c1= vc1, c2= vc2,..., cc= vcc) [NoError, RowStatus== notready -> SetRequest( cx= vcx)] NoError, RowStatus= active (ustawione przez agenta) SetRequest( RowStatus=CreateAndWait,...) [NoError, RowStatus== notready -> SetRequest( cx- vcx)] NoError, RowStatus== notinservice -> SetRequest( RowStatus= active,...);

.., cc= vcc) [NoError, RowStatus== notready -> SetRequest( cx= vcx)] NoError, RowStatus= active (ustawione

5 standardowe MIB y (stan z roku 2002) SMIv1 MIB Modules Full Standards: RFC Management Information Base II RFC Ethernet-Like Interface Types MIB Draft Standards: RFC Bridge MIB RFC DECnet phase IV MIB Proposed Standards: RFC FDDI Interface Type (SMT 6.2) MIB RFC X.25 LAPB MIB RFC X.25 Packet Layer MIB RFC Identification MIB RFC X.25 Multiprotocol Interconnect MIB RFC PPP Link Control Protocol MIB RFC PPP Security Protocols MIB RFC PPP IP NCP MIB RFC PPP Bridge NCP MIB RFC FDDI Interface Type (SMT 7.3) MIB RFC RMON Token Ring Extensions MIB RFC Source Routing Bridge MIB RFC AppleTalk MIB SMIv2 MIB Modules Full Standards: RFC Remote Network Monitoring MIB RFC SNMP Framework MIB RFC SNMPv3 MPD MIB RFC SNMP Applications MIBs RFC SNMPv3 USM MIB RFC SNMP VACM MIB RFC SNMP MIB Draft Standards: RFC BGP version 4 MIB RFC Character Device MIB RFC RS-232 Interface Type MIB RFC Parallel Printer Interface Type MIB RFC SMDS Interface Type MIB RFC RIP version 2 MIB RFC IEEE Interface Type MIB RFC OSPF version 2 MIB RFC Frame Relay DTE Interface Type MIB RFC AgentX MIB RFC Host Resources MIB

25 Multiprotocol Interconnect MIB RFC 1471 - PPP Link Control Protocol MIB RFC 1472 - PPP Security Protocols MIB RFC 1473 - PPP IP NCP MIB RFC 1474 - PPP Bridge NCP MIB RFC 1512 - FDDI Interface Type

6 SNMP Protokół zarządzania

7 wersje protokołu Simple Network Management Protocol RFC , RFC , RFC Protocol Operations for version 2 of the Simple Network Management Protocol (SNMPv2) (RFC , RFC ) Version 2 of the Protocol Operations for the Simple Network Management Protocol (SNMP) RFC Wersja I Wersja II

Protocol (SNMPv2) (RFC 1448 1993, RFC 1905 1996) Version 2 of the Protocol

8 SNMP (v2) MIB NMS A NMS GetRequest GetNextRequest SetRequest GetResponse GetResponse GetResponse Trap GetBulkRequest Inform GetResponse

9 struktura wiadomości (v2) SNMPv2 message version community SNMP PDU SNMPv3 message version msgglobldata msgsecurityparameters msgdata msgglobaldata msgid INTEGER msgmaxsize INTEGER msgflags OCTET STRING (1) msgsecuritymodel INTEGER msgsecurityparameters OCTET STRING msgdata plaintext contextengineid contextname data encryptedpdu OCTET STRING OCTET STRING PDU OCTET STRING

msgflags OCTET STRING (1) msgsecuritymodel INTEGER msgsecurityparameters OCTET STRING msgdata

10 RFC 3416 PDU PDU ::= SEQUENCE { request-id Integer32, error-status INTEGER { noerror(0), toobig(1), nosuchname(2), badvalue(3), readonly(4), generr(5), noaccess(6), wrongtype(7),... }, error-index INTEGER (0..max-bindings), variable-bindings VarBindList }

badvalue(3), readonly(4), generr(5), noaccess(6), wrongtype(7),.

11 RFC 1905, RFC 3416 VarBind(List) VarBind ::= SEQUENCE { name ObjectName, CHOICE { value unspecified nosuchobject[0] nosuchinstance[1] endofmibview[2] } } ObjectSyntax, NULL, IMPLICIT NULL, IMPLICIT NULL, IMPLICIT NULL VarBindList ::= SEQUENCE (SIZE (0..max-bindings)) OF VarBind

nosuchinstance[1] endofmibview[2] } } ObjectSyntax, NULL, IMPLICIT

12 RFC 3416 PDU Integer32 INTEGER INTEGER VarBindList Request-id Error-status Error-index Variable-bindings GetRequest M - - List( OID) GetNextRequest M - - List(OID) GetBulkRequest M Non-repeaters Max-repetitions List(OID) SetRequest M - - List(OID+ value) Response = 0 lub typ błędu 0 lub index błędu List(OID+value) SNMPv2-Trap M - - sysuptime snmptrapoid Objects InformRequest M - - Objects

Non-repeaters Max-repetitions List(OID) SetRequest M - - List(OID+ value) Response = 0 lub typ

13 tablica - GetNextRequest mib-2 (1) [ ] system (1) interfaces (2) at (3) ip (4) icmp (5) tcp (6) udp (7) egp (8) transmission (10) snmp (11) ipnettomediatable (22) IpNetToMediaEntry (1) ipnettomediaifindex (1) ipnettomediaphysaddress (2) ipnettomedianetaddress (3) ipnettomediatype (4) Interface-Number Network-Address Physical-Address Type :00:10:01:23:45 static :00:10:54:32:10 dynamic :00:10:98:76:54 dynamic

14 Interface-Number Network-Address Physical-Address Type :00:10:01:23:45 static :00:10:54:32:10 dynamic :00:10:98:76:54 dynamic GetNextRequest GetNextRequest ( sysuptime, ipnettomediaphysaddress, ipnettomediatype ) Response ( ( sysuptime.0 = "123456" ), ( ipnettomediaphysaddress = " " ), ( ipnettomediatype = "dynamic" )) GetNextRequest ( sysuptime, ipnettomediaphysaddress , ipnettomediatype ) Response ( ( sysuptime.0 = "123461" ), ( ipnettomediaphysaddress = " " ), ( ipnettomediatype = "static" )) GetNextRequest ( sysuptime, ipnettomediaphysaddress , ipnettomediatype ) Response ( ( sysuptime.0 = "123466" ), ( ipnettomediaphysaddress = " " ), ( ipnettomediatype = "dynamic" )) GetNextRequest ( sysuptime, ipnettomediaphysaddress , ipnettomediatype ) Response ( ( sysuptime.0 = "123471" ), ( ipnettomedianetaddress = " " ), ( iproutingdiscards.0 = "2" ))

0 = "123461" ), ( ipnettomediaphysaddress.1.10.0.0.51 = "000010012345" ), ( ipnettomediatype.1.10.0.0.51 = "static" )) GetNextRequest ( sysuptime, ipnettomediaphysaddress.1.10.0.0.51, ipnettomediatype.

15 Interface-Number Network-Address Physical-Address Type :00:10:01:23:45 static :00:10:54:32:10 dynamic :00:10:98:76:54 dynamic GetBulkRequest GetBulkRequest [ non-repeaters = 1, max-repetitions = 2 ] ( sysuptime, ipnettomediaphysaddress, ipnettomediatype ) Response (( sysuptime.0 = "123456" ), ( ipnettomediaphysaddress = " " ), ( ipnettomediatype = "dynamic" ), ( ipnettomediaphysaddress = " " ), ( ipnettomediatype = "static" )) GetBulkRequest [ non-repeaters = 1, max-repetitions = 2 ] ( sysuptime, ipnettomediaphysaddress , ipnettomediatype ) Response (( sysuptime.0 = "123466" ), ( ipnettomediaphysaddress = " " ), ( ipnettomediatype = "dynamic" ), ( ipnettomedianetaddress = " " ), ( iproutingdiscards.0 = "2" ))

0 = "123456" ), ( ipnettomediaphysaddress.1.9.2.3.4 = "000010543210" ), ( ipnettomediatype.1.9.2.3.4 = "dynamic" ), ( ipnettomediaphysaddress.1.10.0.0.51 = "000010012345" ), ( ipnettomediatype.1.10.0.0.51 = "static" )) GetBulkRequest [ non-repeaters = 1, max-repetitions = 2 ] ( sysuptime, ipnettomediaphysaddress.

16 snmptrapoid internet (1) mgmt( 2) mib-2 (1) snmpv2(6) snmpmodules (3) snmpmib(1) snmptrapoid OBJECT-TYPE SYNTAX OBJECT IDENTIFIER MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "The authoritative identification of the notification currently being sent. This variable occurs as the second varbind in every SNMPv2-Trap-PDU and InformRequest-PDU." ::= { snmptrap 1 } snmpmibobjects(1) snmptrap(4) snmptrapoid(1) snmptraps(5) linkup(4)

MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "The authoritative identification of the notification

17 SNMPv2-Trap - linkup PDU Request-id 0 (noerrors) 0 (nr błędnej pozycji w VarBindList) VarBindList (sysuptime) np (.01s start) (snmptrapoid) (linkup) cos (ifindex) linkup NOTIFICATION-TYPE OBJECTS { ifindex } STATUS current DESCRIPTION "A linkup trap signifies that the SNMPv2 entity, acting in an agent role, recognizes that one of the communication links represented in its configuration has come up." ::= { snmptraps 4 } np. 1 (interfejs pierwszy)

NOTIFICATION-TYPE OBJECTS { ifindex } STATUS current DESCRIPTION "A linkup trap signifies that the SNMPv2 entity, acting in an agent

18 SNMP Security& Access Control Community Based (RFC ) Party Based Security Model (RFC ) (SNMPv2) User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3) (RFC ) View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP) (RFC )

the Simple Network Management Protocol (SNMPv3) (RFC 3414-2002) View-based Access

community SNMPv1 i SNMPv2 message version community SNMP PDU community - relacja między agentem i NMS (zbiorem NMS); community name - nazwa community (string); źródło umieszcza nazwę community w

19 community SNMPv1 i SNMPv2 message version community SNMP PDU community - relacja między agentem i NMS (zbiorem NMS); community name - nazwa community (string); źródło umieszcza nazwę community w każdym PDU (niekodowany string) agent sprawdza, czy dane community istnieje nie istnieje, nie wykonuje polecenia istnieje, wykonuje polecenie o ile jest to zgodne z access policy access policy to community name community profile MIB-View - zbiór obiektów modelu (niekoniecznie spójny) SNMP access mode r, w, r/w, na (not accessible)

istnieje nie istnieje, nie wykonuje polecenia istnieje, wykonuje polecenie o ile jest to zgodne z access policy access policy to

20 community a sniffer

21 USM User-based Security Model - cele identyfikacja (authentification) i sprawdzenie uprawnień (authorization) źródła wiadomości SNMP gwarantowanie, że otrzymana wiadomość SNMP nie została zmodyfikowana podczas transmisji w sieci (np. poprzez ustawienie innej wartości zmiennej w PDU polecenia Set) gwarantowanie, że wiadomość nadeszła w odpowiednim oknie czasowym - nie została opóźniona ani odtworzona (np. w celu złośliwego restartowania urządzenia) zabezpieczenie zawartości SNMP przed ujawnieniem podczas transmisji (np. wiadomości modyfikującej hasło administratora)

USM User-based Security Model- środki MD5 (Message Digest #5) wspólny sekret (ciąg znaków) 16-oktetowa suma kontrolna (digest) naliczana na treści wiadomości + sekret (sekret nie jest przesyłany)

22 USM User-based Security Model- środki MD5 (Message Digest #5) wspólny sekret (ciąg znaków) 16-oktetowa suma kontrolna (digest) naliczana na treści wiadomości + sekret (sekret nie jest przesyłany) digest może zostać poprawnie wyliczony tylko przez strony (authentification) digest wyliczony w odbiorniku (o ile zgodny z przesłanym) zapewnia, że wiadomość nie została zmodyfikowana DES (Data Encription Standard) Loosely synchronized clocks timestamp dołączany przez nadawcę wiadomości odbiorca sprawdza, czy mieści się w przedziale (lifetime) zabezpieczenie przed powtórzeniem wiadomości

23 USM orientacyjne koszty protocol vars/sec %-of 1157 %-of prev 1157 (SNMP) n/a n/a noauth/nopriv % 62% md5/nopriv % 85% md5/des % 47% securitylevel źródło: The Simple Times

24 koniec wykładu VI

Podobne dokumenty

Simple Network Management Protocol

Simple Network Management Protocol Simple Network Management Protocol Rozwój W miarę wzrostu rozmiarów, złożoności i niejednorodności sieci, wzrastają koszty zarządzania nimi. Aby kontrolować te koszty,