Standard view Table view

SNMP-USM-DH-OBJECTS-MIB

        The management information definitions for providing forward
secrecy for key changes for the usmUserTable, and for providing a
method for 'kickstarting' access to the agent via a Diffie-Helman
key agreement.
Source file
SNMP-USM-DH-OBJECTS-MIB
Last revised
Identity
snmpUsmDHObjectsMIB
Base OID
1.3.6.1.3.101
Imported Objects
SNMP-FRAMEWORK-MIB SnmpAdminString
SNMP-USER-BASED-SM-MIB usmUserEntry
SNMPv2-CONF MODULE-COMPLIANCE OBJECT-GROUP
SNMPv2-SMI experimental Integer32 MODULE-IDENTITY OBJECT-TYPE
SNMPv2-TC TEXTUAL-CONVENTION
Net-SNMP examples using the rfc MIB directory Show commands

These commands use the standard Observium installation path and load the selected MIB variant before the RFC and Net-SNMP directories.

Translate the module identity
/usr/bin/snmptranslate -Pud -Ir -On -m 'SNMP-USM-DH-OBJECTS-MIB' -M '/opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp' 'SNMP-USM-DH-OBJECTS-MIB::snmpUsmDHObjectsMIB'
Walk the MIB subtree
/usr/bin/snmpbulkwalk -v2c -c '<community>' -Pud -Ir -OQUs -m 'SNMP-USM-DH-OBJECTS-MIB' -M '/opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp' 'udp:<hostname>:161' 'SNMP-USM-DH-OBJECTS-MIB::snmpUsmDHObjectsMIB'
How SNMP, Net-SNMP, MIB paths, and variants work
Objects (20)
snmpUsmDHObjectsMIB
.1.3.6.1.3.101
usmDHKeyObjects
.1.3.6.1.3.101.1
usmDHPublicObjects
.1.3.6.1.3.101.1.1
usmDHParameters r/w
OctetString
 .1.3.6.1.3.101.1.1.1
usmDHUserKeyTable
.1.3.6.1.3.101.1.1.2
usmDHUserKeyEntry
.1.3.6.1.3.101.1.1.2.1
usmDHUserAuthKeyChange r/w
DHKeyChange
 .1.3.6.1.3.101.1.1.2.1.1
usmDHUserOwnAuthKeyChange r/w
DHKeyChange
 .1.3.6.1.3.101.1.1.2.1.2
usmDHUserPrivKeyChange r/w
DHKeyChange
 .1.3.6.1.3.101.1.1.2.1.3
usmDHUserOwnPrivKeyChange r/w
DHKeyChange
 .1.3.6.1.3.101.1.1.2.1.4
usmDHKickstartGroup
.1.3.6.1.3.101.1.2
usmDHKickstartTable
.1.3.6.1.3.101.1.2.1
usmDHKickstartEntry
usmDHKickstartIndex
 .1.3.6.1.3.101.1.2.1.1
usmDHKickstartIndex
Integer32
 .1.3.6.1.3.101.1.2.1.1.1
usmDHKickstartMyPublic
OctetString
 .1.3.6.1.3.101.1.2.1.1.2
usmDHKickstartMgrPublic
OctetString
 .1.3.6.1.3.101.1.2.1.1.3
usmDHKickstartSecurityName
SNMP-FRAMEWORK-MIBSnmpAdminString
 .1.3.6.1.3.101.1.2.1.1.4
usmDHKeyConformance
.1.3.6.1.3.101.2
usmDHKeyMIBCompliances
.1.3.6.1.3.101.2.1
usmDHKeyMIBGroups
.1.3.6.1.3.101.2.2
Dependencies (5) 5 direct Show tree and compile order Hide dependency details

Each imported module is resolved in the importing module's source directory first, then through the normal default-variant rules.

Dependency tree
Dependency-first compile order
  1. SNMPv2-SMIrfc
  2. SNMPv2-CONFrfc
  3. SNMPv2-TCrfc
  4. SNMP-FRAMEWORK-MIBrfc
  5. SNMP-USER-BASED-SM-MIBrfc
  6. SNMP-USM-DH-OBJECTS-MIBrfcselected
Type Definitions (1)
DHKeyChange
OctetString
Conformance Groups (3)
usmDHKeyMIBBasicGroup
usmDHUserAuthKeyChange usmDHUserOwnAuthKeyChange usmDHUserPrivKeyChange usmDHUserOwnPrivKeyChange
.1.3.6.1.3.101.2.2.1
usmDHKeyParamGroup
usmDHParameters
The mandatory object for all MIBs which use the DHKeyChange
textual convention.
 .1.3.6.1.3.101.2.2.2
usmDHKeyKickstartGroup
usmDHKickstartMyPublic usmDHKickstartMgrPublic usmDHKickstartSecurityName
The objects used for kickstarting one or more SNMPv3 USM
associations via a configuration file or other out of band,
non-confidential access.
 .1.3.6.1.3.101.2.2.3
Compliance Statements (1)

OID .1.3.6.1.3.101.2.1.1
The compliance statement for this module.
Required groups
optional usmDHKeyMIBBasicGroup This group MAY be implemented by any agent which
implements the usmUserTable and which wishes to provide the
ability to change user and agent authentication and privacy
keys via Diffie-Hellman key exchanges.
optional usmDHKeyParamGroup This group MUST be implemented by any agent which
implements a MIB containing the DHKeyChange Textual
Convention defined in this module.
optional usmDHKeyKickstartGroup This group MAY be implemented by any agent which
implements the usmUserTable and which wishes the ability to
populate the USM table based on out-of-band provided DH
ignition values.

Any agent implementing this group is expected to provide
preinstalled entries in the vacm tables as follows:

In the usmUserTable: This entry allows access to the
system and dhKickstart groups

usmUserEngineID localEngineID
usmUserName 'dhKickstart'
usmUserSecurityName 'dhKickstart'
usmUserCloneFrom ZeroDotZero
usmUserAuthProtocol none
usmUserAuthKeyChange ''
usmUserOwnAuthKeyChange ''
usmUserPrivProtocol none
usmUserPrivKeyChange ''
usmUserOwnPrivKeyChange ''
usmUserPublic ''
usmUserStorageType permanent
usmUserStatus active

In the vacmSecurityToGroupTable: This maps the initial
user into the accessible objects.

vacmSecurityModel 3 (USM)
vacmSecurityName 'dhKickstart'
vacmGroupName 'dhKickstart'
vacmSecurityToGroupStorageType permanent
vacmSecurityToGroupStatus active

In the vacmAccessTable: Group name to view name translation.

vacmGroupName 'dhKickstart'
vacmAccessContextPrefix ''
vacmAccessSecurityModel 3 (USM)
vacmAccessSecurityLevel noAuthNoPriv
vacmAccessContextMatch exact
vacmAccessReadViewName 'dhKickRestricted'
vacmAccessWriteViewName ''
vacmAccessNotifyViewName 'dhKickRestricted'
vacmAccessStorageType permanent
vacmAccessStatus active

In the vacmViewTreeFamilyTable: Two entries to allow the
initial entry to access the system and kickstart groups.

vacmViewTreeFamilyViewName 'dhKickRestricted'
vacmViewTreeFamilySubtree 1.3.6.1.2.1.1 (system)
vacmViewTreeFamilyMask ''

vacmViewTreeFamilyType 1
vacmViewTreeFamilyStorageType permanent
vacmViewTreeFamilyStatus active

vacmViewTreeFamilyViewName 'dhKickRestricted'
vacmViewTreeFamilySubtree (usmDHKickstartTable OID)
vacmViewTreeFamilyMask ''
vacmViewTreeFamilyType 1
vacmViewTreeFamilyStorageType permanent
vacmViewTreeFamilyStatus active
Object refinements
ObjectAccessSyntaxDescription
usmDHParameters readonly
It is compliant to implement this object as read-only for
any device.