koniec wykładu V
operacje na wierszu tablicy wymagania MAX-ACCESS= read-create obecność kolumny typu RowStatus operacje tworzenie (creation) zawieszanie (suspension) SetRequest( RowStatus= notinservice) usunięcie (deletion) SetRequest( RowStatus= destroy)
wartości kolumny RowStatus active (rw), which indicates that the conceptual row is available for use by the managed device; notinservice (rw), which indicates that the conceptual row exists in the agent, but is unavailable for use by the managed device notready (r), which indicates that the conceptual row exists in the agent, but is missing information necessary in order to be available for use by the managed device; createandgo (rw), which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making it available for use by the managed device; createandwait (rw), which is supplied by a management station wishing to create a new instance of a conceptual row (but not make it available for use by the managed device); and, destroy (rw), which is supplied by a management station wishing to delete all of the instances associated with an existing conceptual row.
tworzenie wiersza ustalenie OID na podstawie wartości obiektu pomocniczego na podstawie znanych reguł SetRequest( RowStatus=CreateAndGo, c1= vc1, c2= vc2,..., cc= vcc) [NoError, RowStatus== notready -> SetRequest( cx= vcx)] NoError, RowStatus= active (ustawione przez agenta) SetRequest( RowStatus=CreateAndWait,...) [NoError, RowStatus== notready -> SetRequest( cx- vcx)] NoError, RowStatus== notinservice -> SetRequest( RowStatus= active,...);
standardowe MIB y (stan z roku 2002) SMIv1 MIB Modules Full Standards: RFC 1213 - Management Information Base II RFC 1643 - Ethernet-Like Interface Types MIB Draft Standards: RFC 1493 - Bridge MIB RFC 1559 - DECnet phase IV MIB Proposed Standards: RFC 1285 - FDDI Interface Type (SMT 6.2) MIB RFC 1381 - X.25 LAPB MIB RFC 1382 - X.25 Packet Layer MIB RFC 1414 - Identification MIB RFC 1461 - X.25 Multiprotocol Interconnect MIB RFC 1471 - PPP Link Control Protocol MIB RFC 1472 - PPP Security Protocols MIB RFC 1473 - PPP IP NCP MIB RFC 1474 - PPP Bridge NCP MIB RFC 1512 - FDDI Interface Type (SMT 7.3) MIB RFC 1513 - RMON Token Ring Extensions MIB RFC 1525 - Source Routing Bridge MIB RFC 1742 - AppleTalk MIB SMIv2 MIB Modules Full Standards: RFC 2819 - Remote Network Monitoring MIB RFC 3411 - SNMP Framework MIB RFC 3412 - SNMPv3 MPD MIB RFC 3413 - SNMP Applications MIBs RFC 3414 - SNMPv3 USM MIB RFC 3415 - SNMP VACM MIB RFC 3418 - SNMP MIB Draft Standards: RFC 1657 - BGP version 4 MIB RFC 1658 - Character Device MIB RFC 1659 - RS-232 Interface Type MIB RFC 1660 - Parallel Printer Interface Type MIB RFC 1694 - SMDS Interface Type MIB RFC 1724 - RIP version 2 MIB RFC 1748 - IEEE 802.5 Interface Type MIB RFC 1850 - OSPF version 2 MIB RFC 2115 - Frame Relay DTE Interface Type MIB RFC 2742 - AgentX MIB RFC 2790 - Host Resources MIB
SNMP Protokół zarządzania
wersje protokołu Simple Network Management Protocol RFC 1067 1988, RFC 1098 1989, RFC 1157 1990 Protocol Operations for version 2 of the Simple Network Management Protocol (SNMPv2) (RFC 1448 1993, RFC 1905 1996) Version 2 of the Protocol Operations for the Simple Network Management Protocol (SNMP) RFC 3416 2002 Wersja I Wersja II
SNMP (v2) MIB NMS A NMS GetRequest GetNextRequest SetRequest GetResponse GetResponse GetResponse Trap GetBulkRequest Inform GetResponse
struktura wiadomości (v2) SNMPv2 message version community SNMP PDU SNMPv3 message version msgglobldata msgsecurityparameters msgdata msgglobaldata msgid INTEGER msgmaxsize INTEGER msgflags OCTET STRING (1) msgsecuritymodel INTEGER msgsecurityparameters OCTET STRING msgdata plaintext contextengineid contextname data encryptedpdu OCTET STRING OCTET STRING PDU OCTET STRING
RFC 3416 PDU PDU ::= SEQUENCE { request-id Integer32, error-status INTEGER { noerror(0), toobig(1), nosuchname(2), badvalue(3), readonly(4), generr(5), noaccess(6), wrongtype(7),... }, error-index INTEGER (0..max-bindings), variable-bindings VarBindList }
RFC 1905, RFC 3416 VarBind(List) VarBind ::= SEQUENCE { name ObjectName, CHOICE { value unspecified nosuchobject[0] nosuchinstance[1] endofmibview[2] } } ObjectSyntax, NULL, IMPLICIT NULL, IMPLICIT NULL, IMPLICIT NULL VarBindList ::= SEQUENCE (SIZE (0..max-bindings)) OF VarBind
RFC 3416 PDU Integer32 INTEGER INTEGER VarBindList Request-id Error-status Error-index Variable-bindings GetRequest M - - List( OID) GetNextRequest M - - List(OID) GetBulkRequest M Non-repeaters Max-repetitions List(OID) SetRequest M - - List(OID+ value) Response = 0 lub typ błędu 0 lub index błędu List(OID+value) SNMPv2-Trap M - - sysuptime snmptrapoid Objects InformRequest M - - Objects
tablica - GetNextRequest mib-2 (1) [1.3.6.1.2.1] system (1) interfaces (2) at (3) ip (4) icmp (5) tcp (6) udp (7) egp (8) transmission (10) snmp (11) ipnettomediatable (22) IpNetToMediaEntry (1) ipnettomediaifindex (1) ipnettomediaphysaddress (2) ipnettomedianetaddress (3) ipnettomediatype (4) Interface-Number Network-Address Physical-Address Type 1 10.0.0.51 00:00:10:01:23:45 static 1 9.2.3.4 00:00:10:54:32:10 dynamic 2 10.0.0.15 00:00:10:98:76:54 dynamic
Interface-Number Network-Address Physical-Address Type 1 10.0.0.51 00:00:10:01:23:45 static 1 9.2.3.4 00:00:10:54:32:10 dynamic 2 10.0.0.15 00:00:10:98:76:54 dynamic GetNextRequest GetNextRequest ( sysuptime, ipnettomediaphysaddress, ipnettomediatype ) Response ( ( sysuptime.0 = "123456" ), ( ipnettomediaphysaddress.1.9.2.3.4 = "000010543210" ), ( ipnettomediatype.1.9.2.3.4 = "dynamic" )) GetNextRequest ( sysuptime, ipnettomediaphysaddress.1.9.2.3.4, ipnettomediatype.1.9.2.3.4 ) Response ( ( sysuptime.0 = "123461" ), ( ipnettomediaphysaddress.1.10.0.0.51 = "000010012345" ), ( ipnettomediatype.1.10.0.0.51 = "static" )) GetNextRequest ( sysuptime, ipnettomediaphysaddress.1.10.0.0.51, ipnettomediatype.1.10.0.0.51 ) Response ( ( sysuptime.0 = "123466" ), ( ipnettomediaphysaddress.2.10.0.0.15 = "000010987654" ), ( ipnettomediatype.2.10.0.0.15 = "dynamic" )) GetNextRequest ( sysuptime, ipnettomediaphysaddress.2.10.0.0.15, ipnettomediatype.2.10.0.0.15 ) Response ( ( sysuptime.0 = "123471" ), ( ipnettomedianetaddress.1.9.2.3.4 = "9.2.3.4" ), ( iproutingdiscards.0 = "2" ))
Interface-Number Network-Address Physical-Address Type 1 10.0.0.51 00:00:10:01:23:45 static 1 9.2.3.4 00:00:10:54:32:10 dynamic 2 10.0.0.15 00:00:10:98:76:54 dynamic GetBulkRequest GetBulkRequest [ non-repeaters = 1, max-repetitions = 2 ] ( sysuptime, ipnettomediaphysaddress, ipnettomediatype ) Response (( sysuptime.0 = "123456" ), ( ipnettomediaphysaddress.1.9.2.3.4 = "000010543210" ), ( ipnettomediatype.1.9.2.3.4 = "dynamic" ), ( ipnettomediaphysaddress.1.10.0.0.51 = "000010012345" ), ( ipnettomediatype.1.10.0.0.51 = "static" )) GetBulkRequest [ non-repeaters = 1, max-repetitions = 2 ] ( sysuptime, ipnettomediaphysaddress.1.10.0.0.51, ipnettomediatype.1.10.0.0.51 ) Response (( sysuptime.0 = "123466" ), ( ipnettomediaphysaddress.2.10.0.0.15 = "000010987654" ), ( ipnettomediatype.2.10.0.0.15 = "dynamic" ), ( ipnettomedianetaddress.1.9.2.3.4 = "9.2.3.4" ), ( iproutingdiscards.0 = "2" ))
snmptrapoid 1.3.6. internet (1) mgmt( 2) mib-2 (1) snmpv2(6) snmpmodules (3) snmpmib(1) snmptrapoid OBJECT-TYPE SYNTAX OBJECT IDENTIFIER MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "The authoritative identification of the notification currently being sent. This variable occurs as the second varbind in every SNMPv2-Trap-PDU and InformRequest-PDU." ::= { snmptrap 1 } snmpmibobjects(1) snmptrap(4) snmptrapoid(1) 1.3.6.1.6.3.1.1.4.1.0 snmptraps(5) linkup(4)
SNMPv2-Trap - linkup PDU Request-id 0 (noerrors) 0 (nr błędnej pozycji w VarBindList) VarBindList 1.3.6.1.2.1.1.3.0 (sysuptime) np.31415926 (.01s start) 1.3.6.1.6.3.1.1.4.1.0 (snmptrapoid) 1.3.6.1.6.3.1.1.5.4.0 (linkup) 1.3.6.1.1.2.1.2.1.1.1.cos (ifindex) linkup NOTIFICATION-TYPE OBJECTS { ifindex } STATUS current DESCRIPTION "A linkup trap signifies that the SNMPv2 entity, acting in an agent role, recognizes that one of the communication links represented in its configuration has come up." ::= { snmptraps 4 } np. 1 (interfejs pierwszy)
SNMP Security& Access Control Community Based (RFC 1157-1990) Party Based Security Model (RFC 1446-1993) (SNMPv2) User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3) (RFC 3414-2002) View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP) (RFC 3415-2002)
community SNMPv1 i SNMPv2 message version community SNMP PDU community - relacja między agentem i NMS (zbiorem NMS); community name - nazwa community (string); źródło umieszcza nazwę community w każdym PDU (niekodowany string) agent sprawdza, czy dane community istnieje nie istnieje, nie wykonuje polecenia istnieje, wykonuje polecenie o ile jest to zgodne z access policy access policy to community name community profile MIB-View - zbiór obiektów modelu (niekoniecznie spójny) SNMP access mode r, w, r/w, na (not accessible)
community a sniffer
USM User-based Security Model - cele identyfikacja (authentification) i sprawdzenie uprawnień (authorization) źródła wiadomości SNMP gwarantowanie, że otrzymana wiadomość SNMP nie została zmodyfikowana podczas transmisji w sieci (np. poprzez ustawienie innej wartości zmiennej w PDU polecenia Set) gwarantowanie, że wiadomość nadeszła w odpowiednim oknie czasowym - nie została opóźniona ani odtworzona (np. w celu złośliwego restartowania urządzenia) zabezpieczenie zawartości SNMP przed ujawnieniem podczas transmisji (np. wiadomości modyfikującej hasło administratora)
USM User-based Security Model- środki MD5 (Message Digest #5) wspólny sekret (ciąg znaków) 16-oktetowa suma kontrolna (digest) naliczana na treści wiadomości + sekret (sekret nie jest przesyłany) digest może zostać poprawnie wyliczony tylko przez strony (authentification) digest wyliczony w odbiorniku (o ile zgodny z przesłanym) zapewnia, że wiadomość nie została zmodyfikowana DES (Data Encription Standard) Loosely synchronized clocks timestamp dołączany przez nadawcę wiadomości odbiorca sprawdza, czy mieści się w przedziale (lifetime) zabezpieczenie przed powtórzeniem wiadomości
USM orientacyjne koszty protocol vars/sec %-of 1157 %-of prev 1157 (SNMP) 60.97 n/a n/a noauth/nopriv 37.97 62% 62% md5/nopriv 32.13 53% 85% md5/des 15.06 25% 47% securitylevel źródło: The Simple Times
koniec wykładu VI