Using DTLS - Revision history

Ralawees: fixed simple "suing > using" typo

2015-01-26T11:40:40Z

fixed simple "suing > using" typo

2011-03-16T04:01:48Z

‎Setting the Server's Certificate

2011-01-30T13:43:43Z

‎Setting the Server's Certificate

2010-09-14T22:45:55Z

‎Examining the Fingerprints

2010-09-14T22:43:37Z

‎Debugging

2010-08-25T20:14:04Z

2010-08-12T03:28:55Z

my -> our

2010-08-12T03:27:35Z

-T *_fingerprint -> -T *_identity

@@ Line 121: / Line 121: @@
 === Recognizing Client Certificates ===
-You must configure a mapping for a SNMPv3 user name. You can specify the user name directly (using the --sn flag), or use a field from the certificate (like the common name suing the --cn flag). Here are two examples. The first specifies that the common name from
+You must configure a mapping for a SNMPv3 user name. You can specify the user name directly (using the --sn flag), or use a field from the certificate (like the common name using the --cn flag). Here are two examples. The first specifies that the common name from
 the certificate should be used as the user name, while the second specifies the user name directly (''SnmpAdmin''):

@@ Line 117: / Line 117: @@
 By default, [[snmpd]] will search for a certificate named ''snmpd.crt'' and if found, use that certificate. If another tag was specified for the server certificate, the [[snmpd]] server needs to be configured with its key.  To do this, add the following line to the snmpd.conf file using the correct fingerprint from your fingerprint list (see above for how to list fingerprints).
-   [snmp] defX509ServerPub 2A:10:4A:09:3C:7C:DF:E9:11:0F:73:D9:C6:58:90:74:3C:E3:6A:CC
+   [snmp] serverCert 2A:10:4A:09:3C:7C:DF:E9:11:0F:73:D9:C6:58:90:74:3C:E3:6A:CC
 === Recognizing Client Certificates ===

@@ Line 115: / Line 115: @@
 === Setting the Server's Certificate ===
-By default, [[snmpd]] will search for a certificate named ''snmpd.crt'' and if found, use that certificate. If another tag was specified for the server certificate, the [[snmpd]] server needs to be configured with its key.  To do this, use the following line to the snmpd.conf file using the correct fingerprint from your fingerprint list (see above for how to list fingerprints).
+By default, [[snmpd]] will search for a certificate named ''snmpd.crt'' and if found, use that certificate. If another tag was specified for the server certificate, the [[snmpd]] server needs to be configured with its key.  To do this, add the following line to the snmpd.conf file using the correct fingerprint from your fingerprint list (see above for how to list fingerprints).
    [snmp] defX509ServerPub 2A:10:4A:09:3C:7C:DF:E9:11:0F:73:D9:C6:58:90:74:3C:E3:6A:CC

@@ Line 99: / Line 99: @@
   certs/snmpd.crt:
   SHA1 Fingerprint=2A:10:4A:09:3C:7C:DF:E9:11:0F:73:D9:C6:58:90:74:3C:E3:6A:CC
 == Configuring Servers ==

← Older revision		Revision as of 22:43, 14 September 2010
Line 188:		Line 188:

	# snmpget -Dtsm,dtls,tls,openssl,cert ...		# snmpget -Dtsm,dtls,tls,openssl,cert ...
		+
		+	=== Where to find/install certificates? ===
		+	The library will search for a <i>tls</i> directory in each path in the SNMPCONFPATH. The
		+	default path is
		+	$PREFIX/etc/snmp:$PREFIX/share/snmp:$PREFIX/lib/snmp:$HOME/.snmp
		+
		+	Note that the Net-SNMP default for PREFIX is /usr/local, but most distributions use a
		+	prefix of /usr.
		+
		+	You can find the SNMPCONF path for your installation two ways.
		+
		+	If your distribution include the <i>net-snmp-config</i> utility:
		+	net-snmp-config --snmpconfpath
		+
		+	Otherwise, assuming debugging was not disabled, you can use this command:
		+	snmpget -Lo -Dread_config -H 2>&1 \|grep "config path"\|head -n 1
		+
		+	=== Which certificates/keys are being loaded? ===
		+	You can see what the tools are doing by turning on debug. The following
		+	command will show which directories are being scanned and which
		+	certificates/keys are being picked up:
		+
		+	snmpget -Lo -Dcert:index:dir -H \| grep cert
		+
		+	You can also list the certificates using the net-snmp-cert utility:
		+
		+	net-snmp-cert showcerts
		+
		+	=== How can I get the fingerprints for a certificate? ===
		+	Many of the configuration files use certificate fingerprints, which you can
		+	find using the net-snmp-cert utility:
		+
		+	net-snmp-cert showcerts --subject --fingerprint

← Older revision		Revision as of 20:14, 25 August 2010
Line 1:		Line 1:
−	"[[SNMP]] over [[DTLS]] over [[UDP]]" and "[[SNMP]] over [[TLS]] over [[TCP]]" are supported in Net-SNMP 5.6 and beyond (5.5 had preliminary experimental support that shouldn't be considered complete). This page describes what is necessary to configure the software to use it.	+	"[[SNMP]] over [[DTLS]] over [[UDP]]" and "[[SNMP]] over [[TLS]] over [[TCP]]" ([[rfc:5953\|RFC5953]]) are supported in Net-SNMP 5.6 and beyond (5.5 had preliminary experimental support that shouldn't be considered complete). This page describes what is necessary to configure the software to use it.

	'''Note: these instructions are preliminary and are subject to change until the release of the 5.6 software'''		'''Note: these instructions are preliminary and are subject to change until the release of the 5.6 software'''

@@ Line 145: / Line 145: @@
   # snmpget -v 3 --defSecurityModel=tsm -u joecool -l authPriv \
-            -T my_identity=56:E4:53:CE:D4:52:87:A7:74:11:BE:BA:9F:37:11:23:4A:77:CE:83 \
+            -T our_identity=56:E4:53:CE:D4:52:87:A7:74:11:BE:BA:9F:37:11:23:4A:77:CE:83 \
             -T their_identity=2A:10:4A:09:3C:7C:DF:E9:11:0F:73:D9:C6:58:90:74:3C:E3:6A:CC \
             dtlsudp:localhost:10161 sysContact.0