How to setup SNMPv3, a very brief document for Dave to elaborate and do a better job on since I suck at writing documentation and he doesn't ;-) --Wes: Note: SHA authentication and DES encryption support is only available if you have OpenSSL installed. CREATING THE FIRST USER: First off, you need to add snmpd.conf VACM entries to allow you to use the SNMPv3 users you are going to create. So, in your /usr/local/share/snmp/snmpd.conf file (you may have to create it) put the following line: rwuser myuser Then, you need to actually create your new user and specify their authentication type and pass phrase. You can do this by putting the following line in your /var/ucd-snmp/snmpd.conf file (you may have to create it): createUser myuser MD5 my_password DES WARNING: SNMPv3 pass phrases must be at least 8 characters long! Now, you have a user "myuser" which can write to everything using MD5 authentication and DES encryption if the above 2 lines are in place. You can optionally add a second pass phrase after the DES keyword if you want it to be different from the authentication pass phrase. Start the agent and test your setup: /usr/local/sbin/snmpd [...wait a few seconds...] snmpget -v 3 -u myuser -l authNoPriv -a MD5 -A my_password localhost sysUpTime.0 SECURITY CONSIDERATIONS: By placing the "createUser" line in /var/ucd-snmp/snmpd.conf instead of /usr/local/share/snmp/snmpd.conf, the password will be automatically erased when the agent starts up. This way, only the derived secret key will remembered. Even better is that actually only the localized secret key will be remembered and if the machine is broken into it'll be impossible to use this localized key to get access to any of your other hosts. CREATING A SECOND USER: Start the agent (if you haven't yet). Now, lets create a second user using the first user (just for fun) for both authentication purposes and as a template (or "cloning source"): snmpusm -v 3 -u myuser -l authNoPriv -a MD5 -A my_password localhost create wes myuser The above should have created the user "wes" with the same password as the "myuser" user. So then, you need to change his password using: snmpusm -v 3 -u wes -l authNoPriv -a MD5 -A my_password localhost passwd -CO my_password -CN new_passphrase See, wasn't that easy? You can now create users. Wheeee.... But, you'll have to add a configuration line that allows them access to do things. Do this with another "rwuser" line in your /usr/local/share/snmp/snmpd.conf file (you'll need to stop and start the agent again, or send the agent a SIGHUP signal): rwuser wes Or, optional use the "rouser" token to only grant them read-only access. Now, test your new user: snmpget -v 3 -u wes -l authNoPriv -a MD5 -A new_passphrase localhost sysUpTime.0 FURTHER STUDIES: The information about the newly created users is stored in /var/ucd-snmp/snmpd.conf, in the form of configuration lines, when the agent is shut down so that it is usable in next run in the future. Also since that the passkeys stored in /var/ucd-snmp/snmpd.conf are locked to a given engineID, which by default is based off of your IPv4 address. This means that: 1) You can't copy/rdist the /var/ucd-snmp/snmpd.conf around. 2) If you change the IP address of your machine your entire user database needs to be re-created. wheeee. Tired of all those command line options? ---------------------------------------- put something like this in your ~/.snmp/snmp.conf file (make it readable only by you!!!): defSecurityName wes defContext none defAuthType MD5 defSecurityLevel authNoPriv defAuthPassphrase new_passphrase defVersion 3 And this is in place the above example line boils down to: snmpget localhost sysUpTime.0 Which is about as simple as I can make it for ya ;-)