What type of information about a *nix system can you get from running the snmpwalk command?

Follow through this tutorial to learn how to install and configure SNMP on Rocky Linux 8. SNMP stands for Simple Network Management Protocol. It is an Internet Standard protocol that provides an agentless method of managing and monitoring of network devices and servers for health information, system metrics such as CPU load, Physical Memory usage, number of running processes, service states or any other metric that support polling over the SNMP protocol.

Installing Net-SNMP on Rocky Linux 8

The Net-SNMP is a suite of applications which provides an agent and utilities that enables retrieval of data from systems using the SNMP protocol.

Before you can install Net-SNMP, ensure your system packages are up-to-date.

dnf update

To install Net-SNMP (SNMP agent, SNMP daemon and other SNMP utilities) on Rocky Linux 8, simply execute the command below;

dnf install net-snmp net-snmp-libs net-snmp-utils

Running SNMP Daemon on Rocky Linux 8

When installed, Net-SNMP creates a SystemD service called snmpd. The service can be managed using the systemctl command.

For example, to start and enable it to run on system boot;

systemctl enable --now snmpd

To check the status;

systemctl status snmpd● snmpd.service - Simple Network Management Protocol (SNMP) Daemon. Loaded: loaded (/usr/lib/systemd/system/snmpd.service; enabled; vendor preset: disabled) Active: active (running) since Fri 2021-08-06 23:14:51 EAT; 4s ago Main PID: 6113 (snmpd) Tasks: 1 (limit: 4938) Memory: 7.7M CGroup: /system.slice/snmpd.service └─6113 /usr/sbin/snmpd -LS0-6d -f Aug 06 23:14:48 nfs.kifarunix-demo.com systemd[1]: Starting Simple Network Management Protocol (SNMP) Daemon.... Aug 06 23:14:51 nfs.kifarunix-demo.com snmpd[6113]: NET-SNMP version 5.8 Aug 06 23:14:51 nfs.kifarunix-demo.com systemd[1]: Started Simple Network Management Protocol (SNMP) Daemon..

To restart SNMP daemon;

systemctl restart snmpd

Configure SNMP on Rocky Linux 8

Once the installation of Net-SNMP is done, proceed to configure it to enable you to remotely poll your system metrics.

The default configuration file of the Net-SNMP agent daemon is is /etc/snmp/snmpd.conf. The file is highly commented and thus, we will only make a few changes. As a result, make a copy of the original file before you can proceed.

cp /etc/snmp/snmpd.conf{,orig}

Configure System Information

By default, Net-SNMP provides basic information such the hostname, the location, the administrator contact information about the system. This information is provided by the values of the objects sysName, sysLocation and sysContact respectively.

To list the default system information using SNMP, simply use snmpwalk command with the default version 2 community string, public. Ensure that SNMP daemon is running before you can run the command below;

snmpwalk -v2c -c public localhost system

You can even try using the server IP;

snmpwalk -v2c -c public 192.168.60.19 systemSNMPv2-MIB::sysDescr.0 = STRING: Linux rocky8.kifarunix-demo.com 4.18.0-305.10.2.el8_4.x86_64 #1 SMP Tue Jul 20 20:34:55 UTC 2021 x86_64 SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (467) 0:00:04.67 SNMPv2-MIB::sysContact.0 = STRING: Root <[email protected]> (configure /etc/snmp/snmp.local.conf) SNMPv2-MIB::sysName.0 = STRING: rocky8.kifarunix-demo.com SNMPv2-MIB::sysLocation.0 = STRING: Unknown (edit /etc/snmp/snmpd.conf) SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORID.1 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance SNMPv2-MIB::sysORID.2 = OID: SNMP-MPD-MIB::snmpMPDCompliance SNMPv2-MIB::sysORID.3 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance SNMPv2-MIB::sysORID.4 = OID: SNMPv2-MIB::snmpMIB SNMPv2-MIB::sysORID.5 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup SNMPv2-MIB::sysORID.6 = OID: TCP-MIB::tcpMIB SNMPv2-MIB::sysORID.7 = OID: IP-MIB::ip SNMPv2-MIB::sysORID.8 = OID: UDP-MIB::udpMIB

To update the system information, simply open the SNMPD configuration file, /etc/snmp/snmpd.conf and adjust the values of the above objects;

vim /etc/snmp/snmpd.conf

Note that the value of the sysName object is set to system hostname by default. Hence, sysLocation and sysContact can be set in the configuration file under System contact information section.

Comment these default lines below;

#syslocation Unknown (edit /etc/snmp/snmpd.conf)
#syscontact Root <[email protected]> (configure /etc/snmp/snmp.local.conf)

Such that it may look like as shown in the configuration below;

############################################################################### # System contact information # # It is also possible to set the sysContact and sysLocation system # variables through the snmpd.conf file: # Comment the default lines below #syslocation Unknown (edit /etc/snmp/snmpd.conf) #syscontact Root <[email protected]> (configure /etc/snmp/snmp.local.conf) syslocation Serverfarm, DC2, Rack 3 syscontact Kifarunix-Admin <[email protected]>

Save the configuration file and reload SNMPD to effect the changes.

systemctl reload snmpd

Verify the changes;

snmpwalk -v2c -c public localhost systemSNMPv2-MIB::sysDescr.0 = STRING: Linux rocky8.kifarunix-demo.com 4.18.0-305.10.2.el8_4.x86_64 #1 SMP Tue Jul 20 20:34:55 UTC 2021 x86_64 SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (75513) 0:12:35.13 SNMPv2-MIB::sysContact.0 = STRING: Kifarunix-Admin <[email protected]> SNMPv2-MIB::sysName.0 = STRING: rocky8.kifarunix-demo.com SNMPv2-MIB::sysLocation.0 = STRING: Serverfarm, DC2, Rack 3 SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00

Configuring SNMP Authentication

SNMP supports three versions of SNMP protocol; version 1, 2c and 3.

Both version 1 and 2c provides authentication using community string, a shared secret between the agent and the client that is passed in clear text over the network.
Version 3 supports user authentication and message encryption using a variety of protocols and is thus a bit more secure.

Configuring SNMP Version 2c Community on Rocky Linux 8

As stated above, SNMP v2 provides access using a permission directive, a community string and the source Address. The source address can be IP of the Nagios Server (SNMP server). This directive should be set in the format;

directive community [source [OID]]

where directive can be rocommunity (provides read-only access) or rwcommunity (provides read-write access), OID is the optional SNMP tree to provide access to.

To configure SNMP v2c, for example, to allow a read-only access from a specific source host, like the monitoring servers such as Nagios, to system objects using the community string, monsvronly, simply enter the line below in the snmpd config file.

rocommunity monsvronly 192.168.58.8

You can use the command below;

echo -e "# SNMP version 2c community\nrocommunity monsvronly 192.168.58.8" >> /etc/snmp/snmpd.conf

Where 192.168.58.8 is the IP of the remote server allowed access.

To allow from localhost, add the line;

rocommunity monsvronly 127.0.0.1

Configure SNMP Daemon Connection Port

By default, SNMP daemon agent receives requests on UDP port 161. SNMPd however does not open this port by default.

To configure SNMPd to listen on a loopback and an IP interface over UDP port 161, you need to edit the snmpd systemd start-up script, /lib/systemd/system/snmpd.service as shown below;

Replace the line:

ExecStart=/usr/sbin/snmpd $OPTIONS -f

With;

ExecStart=/usr/sbin/snmpd $OPTIONS -f udp:127.0.0.1:161 udp:192.168.60.19:161

Where 192.168.60.19 is the server interface IP.

By running the command below;

sed -i '/$OPTIONS -f/ s/$/ udp:127.0.0.1:161 udp:192.168.56.9:161/' /lib/systemd/system/snmpd.service

Such that you configuration looks like;

cat /lib/systemd/system/snmpd.service[Unit] Description=Simple Network Management Protocol (SNMP) Daemon. After=syslog.target network-online.target [Service] Type=notify Environment=OPTIONS="-LS0-6d" EnvironmentFile=-/etc/sysconfig/snmpd ExecStart=/usr/sbin/snmpd $OPTIONS -f udp:127.0.0.1:161 udp:192.168.60.19:161 ExecReload=/bin/kill -HUP $MAINPID [Install] WantedBy=multi-user.target

Save the configuration file and reload systemd units;

systemctl daemon-reload

Restart SNMP daemon.

systemctl restart snmpd

Verify that the UDP port 161 is open.

netstat -alun | grep 161UNCONN 0 0 192.168.60.19:161 0.0.0.0:* UNCONN 0 0 127.0.0.1:161 0.0.0.0:*

Open SNMP Port on FirewallD

If firewalld is running, run the commands below to open SNMPd port

firewall-cmd --add-port=161/udp --permanent firewall-cmd --reload

Verify Connectivity

Test connectivity from the allowed remote host.

Check if the UDP port is reachable on the server.

nc -uvz 192.168.60.19 161Ncat: Version 7.70 ( //nmap.org/ncat ) Ncat: Connected to 192.168.60.19:161. Ncat: UDP packet sent successfully Ncat: 1 bytes sent, 0 bytes received in 2.03 seconds.

Test that you can query the SNMP objects on the server using the snmpwalk and read the first 10 lines of the output.

snmpwalk -v2c -c monsvronly 192.168.60.19 | head -10

Ensure you are running the command above from the allowed host.

SNMPv2-MIB::sysDescr.0 = STRING: Linux rocky8.kifarunix-demo.com 4.18.0-305.10.2.el8_4.x86_64 #1 SMP Tue Jul 20 20:34:55 UTC 2021 x86_64 SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (486) 0:00:04.86 SNMPv2-MIB::sysContact.0 = STRING: Kifarunix-Admin <[email protected]> SNMPv2-MIB::sysName.0 = STRING: rocky8.kifarunix-demo.com SNMPv2-MIB::sysLocation.0 = STRING: Serverfarm, DC2, Rack 3 SNMPv2-MIB::sysORLastChange.0 = Timeticks: (1) 0:00:00.01 SNMPv2-MIB::sysORID.1 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance SNMPv2-MIB::sysORID.2 = OID: SNMP-MPD-MIB::snmpMPDCompliance SNMPv2-MIB::sysORID.3 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance ...

Configuring SNMP Version 3 on Rocky Linux 8

SNMP v3 uses a username, permission, security level, authentication and privacy passphrases to allow access.

As a result, you need to create user for authenticating. When created, the user is added to the following configuration files; /etc/snmp/snmpd.conf and /var/lib/net-snmp/snmpd.conf.

Before you can proceed, make a copy of the original configuration file just like we did above.

cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

Comment the snmp V2 configuration lines added above;

sed -i '/^rocommunity/ s/^/#/' /etc/snmp/snmpd.conf

Stop SNMP daemon

systemctl stop snmpd

Create a read-only authentication user using the net-snmp-create-v3-user command. The command syntax is;

net-snmp-create-v3-user [-ro] [-A authpass] [-a MD5|SHA] [-X privpass][-x DES|AES] [username]

For example;

net-snmp-create-v3-user -ro -A [email protected] -a SHA -X [email protected] -x AES snmpadmin

Sample command output;

adding the following line to /var/lib/net-snmp/snmpd.conf: createUser snmpadmin SHA "[email protected]" AES "[email protected]" adding the following line to /etc/snmp/snmpd.conf: rouser snmpadmin

Start SNMP daemon

systemctl start snmpd

Enable SNMP daemon to run on system reboot.

systemctl enable snmpd

Configure inbound Firewall rules to UDP port 161 as we did above.

Test to verify that everything is working as expected.

snmpwalk -v3 -a SHA -A [email protected] -x AES -X [email protected] -l authPriv -u snmpadmin localhost | headSNMPv2-MIB::sysDescr.0 = STRING: Linux rocky8.kifarunix-demo.com 4.18.0-305.10.2.el8_4.x86_64 #1 SMP Tue Jul 20 20:34:55 UTC 2021 x86_64 SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (1775) 0:00:17.75 SNMPv2-MIB::sysContact.0 = STRING: Kifarunix-Admin <[email protected]> SNMPv2-MIB::sysName.0 = STRING: rocky8.kifarunix-demo.com SNMPv2-MIB::sysLocation.0 = STRING: Serverfarm, DC2, Rack 3 SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORID.1 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance SNMPv2-MIB::sysORID.2 = OID: SNMP-MPD-MIB::snmpMPDCompliance SNMPv2-MIB::sysORID.3 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance

Verify from remote host;

snmpwalk -v3 -a SHA -A [email protected] -x AES -X [email protected] -l authPriv -u snmpadmin 192.168.60.19 | headSNMPv2-MIB::sysDescr.0 = STRING: Linux rocky8.kifarunix-demo.com 4.18.0-305.10.2.el8_4.x86_64 #1 SMP Tue Jul 20 20:40:55 UTC 2021 x86_64 SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (22366) 0:03:43.66 SNMPv2-MIB::sysContact.0 = STRING: Kifarunix-Admin <[email protected]> SNMPv2-MIB::sysName.0 = STRING: rocky8.kifarunix-demo.com SNMPv2-MIB::sysLocation.0 = STRING: Serverfarm, DC2, Rack 3 SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORID.1 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance SNMPv2-MIB::sysORID.2 = OID: SNMP-MPD-MIB::snmpMPDCompliance SNMPv2-MIB::sysORID.3 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance

Magnificent!!! SNMP is configured!

That concludes our guide on how to install and configure SNMP on Rocky Linux 8.

You can now poll your system metrics from your remote monitoring server.

What advanced port scanning tool can allow a security tester?

NMap is the acronym for Network Mapper. It is one of the top tools for port scanning and network discovery. This free and open-source tool is useful for system administrators, DevOps, and network engineers. The tool helps them in security auditing on local and remote networks.

What version of Windows Server has completely eliminated the option for Telnet server?

As Dave mentioned, Telnet was not included in windows server 2016.

What tool can allow a security tester to bypass filtering devices by injecting crafted IP packets into a network?

Hping is a powerful tool that you can use to bypass filtering devices by injecting crafted or otherwise modified IP packets or to port scan and perform just about any type of scan that Nmap can.

What feature implemented in Windows 8.1 prevents the execution of non trusted?

In Windows 8, the SmartScreen feature is integrated with the Operating System. The integration of SmartScreen filtering with the base Operating System prevents the execution of applications, which are considered unsafe by the Windows OS.

zusammenhängende Posts

What type of switch memory is used to store the configuration used by the switch when it is up and working group of answer choices RAM ROM Flash Nvram?

What type of tool can be used to compare results and verify a new tool by viewing data in its raw format?

4. this measure of central location is more frequent used as a measure of what type of data?

What is a special character that can represent one or more characters in the criterion of a query data type wildcard comparison operator autonumber?

In which maintenance type are changes made to a system to evolve its functionality to changing business needs or technologies?

What type of installation should you perform if you want to install a 64 bit version of Windows on a computer that already has a 32 bit OS installed quizlet?

Which type of contract stipulates a fixed price and includes an additional motivation or bonus for early completion or some other measure of good performance?