TUT:Security - Revision history

Wes: Reverted edits by Peanuter (talk) to last revision by Wes

2013-01-21T14:26:06Z

Reverted edits by Peanuter (talk) to last revision by Wes

2013-01-21T03:20:20Z

‎SNMPv1 and SNMPv2c: Insecure!!!

2011-06-30T21:25:24Z

‎Tunneling SNMPv3: typo

2011-02-18T18:53:28Z

‎Tunneling SNMPv3: Added missing word

2010-12-16T19:45:47Z

link to snmp over ssh performance paper

2010-12-16T18:48:13Z

‎Tunneling SNMPv3

2010-06-29T17:08:13Z

‎Ok, but what should I pick?

2010-06-29T17:07:49Z

‎Using Secure SNMP

2010-06-22T00:22:03Z

‎Tunneling SNMPv3

← Older revision		Revision as of 14:26, 21 January 2013
Line 23:		Line 23:

	This was obviously a problem so SNMPv3 was later developed to secure the protocol.		This was obviously a problem so SNMPv3 was later developed to secure the protocol.
−
−	For further information on security weaknesses within SNMPv1 and different opensource ways to audit SNMPv1 check out this post. [http://peanuter.darpanet.org/?p=17 Simple Network Management Protocol – SNMPv1 Threat Assessment]

	== SNMPv3: Making it secure ==		== SNMPv3: Making it secure ==

← Older revision		Revision as of 03:20, 21 January 2013
Line 23:		Line 23:

	This was obviously a problem so SNMPv3 was later developed to secure the protocol.		This was obviously a problem so SNMPv3 was later developed to secure the protocol.
		+
		+	For further information on security weaknesses within SNMPv1 and different opensource ways to audit SNMPv1 check out this post. [http://peanuter.darpanet.org/?p=17 Simple Network Management Protocol – SNMPv1 Threat Assessment]

	== SNMPv3: Making it secure ==		== SNMPv3: Making it secure ==

@@ Line 76: / Line 76: @@
 * [[rfc:5592|RFC5592]] - Secure Shell Transport Model for the Simple Network Management Protocol (SNMP)
 * [[rfc:5608|RFC5608]] - Remote Authentication Dial-In User Service (RADIUS) Usage for Simple Network Management Protocol (SNMP) Transport Models.
-* [[rfc:5953:RFC5953]] - Transport Layer Security (TLS) Transport Model for the Simple Network Management Protocol (SNMP)
+* [[rfc:5953|RFC5953]] - Transport Layer Security (TLS) Transport Model for the Simple Network Management Protocol (SNMP)
 These RFCs provide the framework for tunneling SNMPv3 packets over [[SSH]], [[TLS]] and [[DTLS]].  The SSH protocol uses existing SSH authentication and encryption methods (like SSH keys and/or usernames and passwords) to secure it's traffic.  And the TLS and DTLS protocols use X.509 certificates for securing it's traffic.

@@ Line 86: / Line 86: @@
 Net-SNMP 5.6 also contains minimal support for using SNMP over SSH, but the support is limited because of the lack of available SSH server-side libraries and is implemented through a specialized shell "hack" when attached to a OpenSSH sshd server.
-There is about the performance impacts of using SSH available [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.109.8294&rep=rep1&type=pdf here] (also available as slides from an IETF presentation [http://www.ietf.org/proceedings/67/slides/isms-3.pdf here]).
+There is information about the performance impacts of using SSH available [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.109.8294&rep=rep1&type=pdf here] (also available as slides from an IETF presentation [http://www.ietf.org/proceedings/67/slides/isms-3.pdf here]).
 == Kerberos SNMPv3 ==
 Wes Hardaker and Ken Horstein started work in the IETF to implement a kerberos security model for SNMPv3.  Although Net-SNMP contains a prototype implementation of this, the work was never finished within the IETF nor within the Net-SNMP implementation and is not yet ready for real-world use.

@@ Line 85: / Line 85: @@
 Net-SNMP 5.6 also contains minimal support for using SNMP over SSH, but the support is limited because of the lack of available SSH server-side libraries and is implemented through a specialized shell "hack" when attached to a OpenSSH sshd server.
 == Kerberos SNMPv3 ==
 Wes Hardaker and Ken Horstein started work in the IETF to implement a kerberos security model for SNMPv3.  Although Net-SNMP contains a prototype implementation of this, the work was never finished within the IETF nor within the Net-SNMP implementation and is not yet ready for real-world use.

@@ Line 56: / Line 56: @@
 Pick the best one for your situation of course!  Some helpful starting hints though:
-* If entirely using Net-SNMP products: use [[Using DTLS|SNMPv3 over (D)TLS]]
+* If entirely using Net-SNMP products, or products that support TLS: use [[Using DTLS|SNMPv3 over (D)TLS]]
 * If talking to legacy SNMPv3 devices: use [[TUT:SNMPv3_Options|SNMPv3/USM]]
 * If talking to SNMPv1/SNMPv2c only devices: call the vendor and complain!  Seriously.

@@ Line 51: / Line 51: @@
 | Securing SNMP with Kerberos (even less supported)
 |}
 == SNMPv3 with USM ==

@@ Line 74: / Line 74: @@
 Net-SNMP 5.6 contains robust support for using SNMP over TLS and DTLS.
-See the [[TUT:Using TLS|Using TLS tutorial]]) for details on seting up and using SNMP over TLS and DTLS.
+See the [[TUT:Using TLS|Using TLS tutorial]] for details on seting up and using SNMP over TLS and DTLS.
 Net-SNMP 5.6 also contains minimal support for using SNMP over SSH, but the support is limited because of the lack of available SSH server-side libraries and is implemented through a specialized shell "hack" when attached to a OpenSSH sshd server.