View source for TUT:Using TLS

"SNMP over DTLS over UDP" and "SNMP over TLS over TCP" are supported in Net-SNMP 5.6 and beyond. This page describes how
to use [[DTLS]] or [[TLS]] for the end user. For information on the administering and configuring the agent with DTLS/TLS support,
see [[Using_DTLS]].

== DTLS vs TLS ==

[[TLS]] and [[DTLS]] are both protocols that protect packets in transit.  The first runs over [[TCP]] and the second over [[UDP]], which both have unique advantages (and a discussion of those advantages is beyond scope of this tutorial).  

Below you'll find examples that use both the ''dtlsudp:'' prefix and the ''tlstcp:'' prefix.  Our ''test.net-snmp.org'' server will respond to both transports so you can try them both out.

== Required Build Options ==

You must have added these options when configure was run to make the following tutorial work:

  --with-security-modules=tsm --with-transports="DTLSUDP TLSTCP"

== Zero-config Example ==

This section assumes you already have your certificate(s) in place and know the fingerprints for your
identity and that of the remote server. More information on obtaining and setting up that information
is discussed below.

 snmpget -t 10 -T my_fingerprint=CD:74:45:C9:A3:A3:55:0A:6C:37:03:B2:49:38:B1:01:99:95:8E:43 \
         -T their_fingerprint=CA:B8:0A:B3:6B:4C:21:2A:F2:92:CD:0B:6B:DF:6A:9F:23:D6:30:4B \
         -v 3 -l authPriv dtlsudp:test.net-snmp.org:10161 sysUpTime.0

In this example, ''test.net-snmp.org'' is the host name of the agent to query, using version 3 of the SNMP protocol and the transport security model, and an authPriv message protected a dtls connection using the certificates identified by the given fingerprints.  The OID being requested is <tt>sysUpTime.0</tt> from the MIB module <tt>SNMPv2-MIB</tt>.

== Obtaining and using test.net-snmp.org certificates ==

You will need the certificates for the Net-SNMP test server and test user for this tutorial. A compressed tarball is avaialable [http://www.net-snmp.org/tutorial/tutorial-5/certificates/tutorial-.snmp.tar.gz here], along with its [http://www.net-snmp.org/tutorial/tutorial-5/certificates/tutorial-.snmp.tar.gz.asc gpg signature].

Once you have the <tt>tutorial-.snmp</tt> tarball, uncompress it in your home directory:

 $ tar xvfz tutorial-.snmp.tar.gz
 
 .snmp/
 .snmp/snmp.conf.tutorial
 .snmp/tls/
 .snmp/tls/newcerts/
 .snmp/tls/private/
 .snmp/tls/private/tutorial-joecool.key
 .snmp/tls/ca-certs/
 .snmp/tls/ca-certs/tutorial-CA.crt
 .snmp/tls/openssl.conf
 .snmp/tls/certs/
 .snmp/tls/certs/tutorial-joecool.crt
 .snmp/tls/certs/tutorial-agent.crt

You can use net-snmp-cert to show you the certificates (and their fingerprints):

 $ net-snmp-cert showcert
 /home/dummy/.snmp/tls:
 
 certs/tutorial-agent.crt:
 subject= /C=US/ST=California/O=Net-SNMP Developers/OU=SNMP-TLS/CN=tutorial-agent/emailAddress=tutorial-agent@test.net-snmp.org
 
 
 certs/tutorial-joecool.crt:
 subject= /C=US/ST=California/O=Net-SNMP Developers/OU=SNMP-TLS/CN=Joe Cool/emailAddress=joe.cool@test.net-snmp.org

 $ net-snmp-cert showcert --fingerprint
 /home/dummy/.snmp/tls:
 
 certs/tutorial-agent.crt:
 SHA1 Fingerprint=CA:B8:0A:B3:6B:4C:21:2A:F2:92:CD:0B:6B:DF:6A:9F:23:D6:30:4B
 
 
 certs/tutorial-joecool.crt:
 SHA1 Fingerprint=CD:74:45:C9:A3:A3:55:0A:6C:37:03:B2:49:38:B1:01:99:95:8E:43

Now that you have the certificates, you can query the test agent:

 snmpget -T my_fingerprint=CD:74:45:C9:A3:A3:55:0A:6C:37:03:B2:49:38:B1:01:99:95:8E:43 \
         -T their_fingerprint=CA:B8:0A:B3:6B:4C:21:2A:F2:92:CD:0B:6B:DF:6A:9F:23:D6:30:4B \
         -v 3 tlstcp:test.net-snmp.org:10161 sysContact.0

That's a long ugly command line, so you might want to add some defaults in your configuration file, snmp.conf.
There is an included snmp.conf file, but to ensure that we don't overwrite any existing snmp.conf it
must be appended to your existing configuration file.

 $ cat $HOME/.snmp/snmp.conf.tutorial >> $HOME/.snmp/snmp.conf

Now try this much simpler query:

 $ snmpget -v 3 tlstcp:test.net-snmp.org:10161 sysContact.0
 SNMPv2-MIB::sysContact.0 = STRING: Net-SNMP Coders <net-snmp-coders@lists.sourceforge.net>

<hr>

{{TUT:LIST}}