Plugins: SNMP: Support for SNMPv3

[markuspachali]

Hi all,

are there any plans to implement support for SNMPv3? Via WebGUI there is only basic support which (I guess) leads to SNMPv2. There are options to configure SNMPv3 directly in /etc/snmp.conf but I'm not sure if any changes there are safe for updates of the SNMP Plugin or OPNsene itself.

Best regards,
Markus

[fichtner]

Hi Markus,

Not familiar with SNMPv3 on FreeBSD yet, but this looks promising as a guide to sketch out a working config:

https://lists.freebsd.org/pipermail/freebsd-current/2014-April/049343.html

If we have a working config we can add the required GUI knobs. How does that sound? :)

Cheers,
Franco

[fabianfrz]

@fichtner at the same time, snmp could be converted to MVC. The plugin seems to be a simple form with a bit of validation.

[markuspachali]

Hi Franco,
me neither, but that sounds like a deal :) I'll investigate that the next days.
The challenge here seems to be to work with what is shipped with OPNsense. Based on man page for snmpd.conf there is similar command to net-snmp-create-v3-user which can be found on linux and just creates the lines in /etc/snmp/snmpd.conf and /var/lib/net-snmp/snmpd.conf. As described here https://www.freebsd.org/cgi/man.cgi?query=snmpd.conf&manpath=ports&sektion=5 in section "SNMPv3 USM Users".
I'll play around a little bit with that and come back to you as soon as I got a working configuration :)

Best regards,
Markus

[fichtner]

@markuspachali thanks in advance! :)

[markuspachali]

Hmm... okay, it's not net-snmp which is used, it's bsnmpd. That makes it a "little bit" more complicated. There is nearly no documentation regarding snmpv3 available. This will take some time for me to get a working configuration.
Is there a reason why OPNsene decided to use bsnmpd and not net-snmp? Are there otherwise any chances to replace bnsmpd with net-snmp, which would make it much easier to get SNMPv3 working?

[fichtner]

Very historic reasons. bsnmpd is in the FreeBSD base system, that's all. net-smpd was added to pfSense just this year. I don't mind adding it for SNMPv3 or as an alternative to bsnmpd. One of the key goals has been reached with 17.1: removing the service from the base system.

It would make Fabian's request even easier, we could add a new os-net-snmp package based on MVC and not touch the os-snmp package.

[markuspachali]

Adding net-snmp as an alternative for bsnmp would be great.
I've spend some time go get a working SNMPv3 config for bsnmpd but without success. Based on my understanding of the comments in the config file /etc/snmpd.config (which is the only documentation I could find) everything is fine. I'm also able to start the deamon with "/usr/sbin/snmpd -c /etc/snmpd.config -d" but there is absolutely no response from the server. SNMPv2 is working fine.

The only current limitation for net-snmp Ic could find is, that there is currently no direct access to pf statistics:
https://forum.pfsense.org/index.php?topic=124071.0

[fabianfrz]

@markuspachali that could be a problem because PF is the core component of OPNsense. However a plugin could be created and it will support the additional OIDs as soon as upstream does it.

[linuxmail]

hi,

we looking for switching from PfSense to OpnSense and using SNMPv3 for monitoring. It works since a few month under Pfsense but I saw, that OpnSense doesn't support it yet (which is very sad).

But that is something which I don't understand also from other projects: products/solutions which has there places in security based areas and doesn't support tools / protocols which is required there. SNMP is one of the. SNMPv2 should be removed from everywhere :-)
I was very happy (also the PCI/DSS auditor), that Pfsense added the v3 version ;-)

[fichtner]

Hi,

At the end of the day: who will start the work? :)

Cheers,
Franco

[mimugmail]

@linuxmail can you upload a anonymized config of v3? I only use v2 since it's my own trusted network :)

[linuxmail]

@mimugmail You mean the Pfsense SNMPv3 Config ? If so, yes. I will prepare one.

[mimugmail]

@linuxmail I don't mean the xml file, just the snmpd.conf etc.

[linuxmail]

@mimugmail

Ok, but you should know, the Pfsense uses net-snmpd:

• /var/etc/netsnmpd.conf

agentaddress udp:1.2.3.4:
engineIDType 1
[snmp] tsmUseTransportPrefix no
sysLocation FC-R02.409
sysContact [email protected]
sysName dmz-01
interface_fadeout 300
interface_replace_old no
ignoreDisk /dev
ignoreDisk /var/dhcpd/dev
includeAllDisks 20%
rouser -s usm "monitoring" priv
iquerySecName "manager"
agentSecName "manager"
master agentx

• /var/etc/netsnmpd-users.conf
  createUser "monitoring" SHA "geheim" AES "secret"

[linuxmail]

hi,

I tried to install the PFSense package from net-snmpd and configure it by hand, but the version was compiled with Perl 5.24 but OpnSense has 5.26. So the Daemon refuse to start.

[fichtner]

We have the package...

# pkg install net-snmp

[linuxmail]

hmm, damn :-) Ok, package installed from the repo and now configure:

• /etc/rc.conf.d/snmpd

snmpd_enable="YES"
snmpd_flags="-LF 0-4 d -C"
snmpd_conffile="/usr/local/etc/snmp/snmpd.conf /usr/local/etc/snmp/netsnmpd-users.conf"

and configured like my configs above .. and it works for localhost, but not from a different host. Firewall is open ... hmm.

[linuxmail]

It must have something todo with the firewall. If I disable the firewall (through the options), than it works also from the remote host. I have on all interfaces an ipv4 allow rule from * to destination *. No other rules.

[mimugmail]

Your paths are not consistent, is it /var/etc or /usr/local/etc/snmp?
It's ages ago since I used net-snmp (with Linux) ...

[linuxmail]

hi @mimugmail

on the PFSense /var/etc is used, on OPNSense usr/local/etc/snmp

[linuxmail]

Hello, since the latest release ... it works:

# pkg install net-snmp
# mkdir /usr/local/etc/snmp

• /etc/rc.conf.d/snmpd

snmpd_enable="YES"
snmpd_flags="-LF 0-4 d -C"
snmpd_conffile="/usr/local/etc/snmp/snmpd.conf /usr/local/etc/snmp/netsnmpd-users.conf"

• /usr/local/etc/snmp/snmpd.conf

gentaddress udp:192.168.1.100:
engineIDType 1
[snmp] tsmUseTransportPrefix no
sysLocation RZ01
sysContact [email protected]
sysName dmz-01
interface_fadeout 300
interface_replace_old no
ignoreDisk /dev
ignoreDisk /var/dhcpd/dev
includeAllDisks 20%
rouser -s usm "monitoring" priv
iquerySecName "manager"
agentSecName "manager"
master agentx

• /usr/local/etc/snmp/netsnmpd-users.conf

createUser "monitoring" SHA "SECRET" AES "MASTERMIND

# chmod 0600 /usr/local/etc/snmp/netsnmpd-users.conf
# /usr/local/etc/rc.d/snmpd enabled
# /usr/local/etc/rc.d/snmpd start

[mimugmail]

I finally started with this plugin. Is it ok to only allow v2 and v3?
And for v3 only SHA / AES? I dont want to make an option for DES or MD5 or would this break something?

[linuxmail]

hi,

thanks for it :-) SHA/AES is fine, since DES / MD5 is depricated. It would not break anything, it says only that old monitoring software isn't able to use V3, but in that case, they can use SNMPv2.

[mimugmail]

@linuxmail with 18.1.9 you can install the devel pkg via CLI:

pkg install os-net-snmp-devel

I'd love to have some feedback if it works for you (on a test machine).
It currently lacks interface binding (it listens to all) and snmp traps.

[linuxmail]

No problem, I will test it on our pre production servers on Monday.

[linuxmail]

hi,

I upgraded both hosts and it seems to be working seamless :-) The only very small issue I had, was that on one node the agentaddress config line was wrong, as the port was missing. But I removed the whole line (may it was done by me with a copy paste error) and voila ... Icinga2 was happy again with the SNMP checks.

So, great work !

[mimugmail]

Thanks for testing, I'll try to add bind Interface selection and traps, then it can Go stable.

[TheGoblinHero]

I have another feature request. Currently v3 users are created as read only (rouser in config). I'd like to have an ability to create r/w users (rwuser in config).

[mimugmail]

@TheGoblinHero @linuxmail
You guys know what exactly is needed for rw access in addtion to ro?

Never used rw access and I don't want to just guess the solution

[TheGoblinHero]

You guys know what exactly is needed for rw access in addtion to ro?
Never used rw access and I don't want to just guess the solution

Edit /usr/local/opnsense/service/templates/OPNsense/Netsnmp/snmpd.conf and change "rouser" to "rwuser". Create a user using the web interface. After that you can execute snmpset:
snmpset -v3 -lauthPriv -uusername -asha -Apassword -xaes -Xencryptionkey 127.0.0.1 1.3.6.1.4.1.8072.1.5.3.1.2.1.3.6.1.2.1.2.2 i 1

[mimugmail]

Will be in next version:

https://github.com/opnsense/plugins/pull/890/files