Enable SNMP v3 on Dell iDRAC9

Posted on December 16, 2024 by admin

First go to iDRAC Settings > Services > SNMP Agent.

Change you SNMP Community Name. (This is not used for SNMPv3)
Enable SNMPv3.

Next go to iDRAC Settings > Users.

Edit the current user, or create a new user. Scroll down to SNMP V3 Settings.

Change SNMP v3 to Enabled.
Enable Passphrase.
Set Authentication and Privacy Passphrases.
Save.

Add your iDRAC to your monitoring software. You can verify everything works from a Linux machine that has the SNMP utils installed.

snmpwalk -v3 -a SHA1 -A "snmpv3userpass" -x AES -X "snmpv3userpass" -l authPriv -u root 192.168.1.100

Configure SNMPv3 on Cisco Router

Posted on July 31, 2023 by admin

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-16/snmp-xe-16-book/nm-snmp-cfg-snmp-support.html

How to configure SNMP v3 on Cisco Switch, Router, ASA, Nexus (bestmonitoringtools.com)

Enter configuration mode

enable
conf t

Everything in bold you should look at changing.

snmp-server view ViewDefault iso include
snmp-server group GroupName v3 priv read ViewDefault
snmp-server location address
snmp-server user MyUsername GroupName v3 auth sha AuthPass1 priv aes 128 PrivPass

Exit and save changes

exit
write

Now we can verify the snmp details with

show snmp

Bulk Update SNMP v3 Settings for Devices in LibreNMS

Posted on February 3, 2023 by admin

With support for DES being dropped, you may be faced with having to upgrade device settings to AES. In this post we’ll explore changing the settings in LibreNMS for all Mikrotik devices and then touch on making changes to a group of Mikrotik devices.

Upgrading SNMP Settings for Devices in LibreNMS

In LibreNMS, we can go to Device -> Device Settings (Gear on the right hand side) -> SNMP, to set the SNMP settings for that device.

Since this would get rather boring to change on multiple devices, and these settings are all in a MySQL database, we can skip using the mouse and use a few MySQL commands to update multiple devices at once.

Log into the LibreNMS server over ssh and then connect to the MySQL database

mysql -u librenms -p librenms

First we can get a list of all the devices (Mikrotik routers in this example) and show the hostname with the SNMP authentication and cryptography algorithms.

select hostname,authalgo,cryptoalgo from devices where os="routeros";

Now if we want to update the cryptography settings for all of our Mikorotik devices, we can do the following.

update devices cryptoalgo set cryptoalgo="AES"  where os="routeros";

This will set all of the devices to use AES for the cryptography algorithm.

We can also change the authentication algorithm to SHA with this

update devices authalgo set authalgo="SHA"  where os="routeros";

Bulk updating of Network Devices

The bottom “script” can be used for changing SNMP settings on multiple Mikrotik devices.

Create a mikrotik.lst file with all the IP addresses of all the devices you need to update. Can you use the above MySQL commands to get a list from LibreNMS.

Change the following options in the script

routerpassword to the Mikrotik password
admin to your username
encryptionpassword to your SNMP encryption password
authpassword to your authentication password
addresses=192.168.0.0/16 to the list of IP addresses that should be able to access SNMP info on the mikrotik device. AKA your LibreNMS server.
SNMPname to your SNMP username

for ip in `cat mikrotik.lst` 
do 
echo $ip 
timeout 15 sshpass -p 'routerpassword' ssh -o StrictHostKeyChecking=no admin@${ip} -p1022 '/snmp community set addresses=192.168.0.0/16 authentication-protocol=SHA1 authentication-password=authpassword encryption-protocol=AES encryption-password=encryptionpassword security=private read-access=yes write-access=no SNMPname'
done

Copy and paste the above “code” in a shell script file.

nano mikrotik.sh
chmod +x mikrotik.sh 
./mikrotik.sh

The script should run and update all the SNMP settings on all the devices in mikrotik.lst

OIDs for UI / Ubiquiti Solar Charge Controller

Posted on November 21, 2022 by admin

Here is a list of OIDs for Ubiquiti’s solar charge controller. You can download the

Top interesting ones are

Battery Voltage 1.3.6.1.4.1.41112.1.11.1.1.2
Panel Voltage 1.3.6.1.4.1.41112.1.11.1.2.2

snmptranslate -Pu -Tz -m ./UBNT-MIB:./UBNT-SUNMAX-MIB
"org"                   "1.3"
"dod"                   "1.3.6"
"internet"                      "1.3.6.1"
"directory"                     "1.3.6.1.1"
"mgmt"                  "1.3.6.1.2"
"mib-2"                 "1.3.6.1.2.1"
"transmission"                  "1.3.6.1.2.1.10"
"experimental"                  "1.3.6.1.3"
"private"                       "1.3.6.1.4"
"enterprises"                   "1.3.6.1.4.1"
"ubnt"                  "1.3.6.1.4.1.41112"
"ubntMIB"                       "1.3.6.1.4.1.41112.1"
"ubntORTable"                   "1.3.6.1.4.1.41112.1.1"
"ubntOREntry"                   "1.3.6.1.4.1.41112.1.1.1"
"ubntORIndex"                   "1.3.6.1.4.1.41112.1.1.1.1"
"ubntORID"                      "1.3.6.1.4.1.41112.1.1.1.2"
"ubntORDescr"                   "1.3.6.1.4.1.41112.1.1.1.3"
"ubntSnmpInfo"                  "1.3.6.1.4.1.41112.1.2"
"ubntSnmpGroups"                        "1.3.6.1.4.1.41112.1.2.1"
"ubntORInfoGroup"                       "1.3.6.1.4.1.41112.1.2.1.1"
"ubntORCompliance"                      "1.3.6.1.4.1.41112.1.2.1.2"
"ubntAirosGroups"                       "1.3.6.1.4.1.41112.1.2.2"
"ubntAirFiberGroups"                    "1.3.6.1.4.1.41112.1.2.3"
"ubntEdgeMaxGroups"                     "1.3.6.1.4.1.41112.1.2.4"
"ubntUniFiGroups"                       "1.3.6.1.4.1.41112.1.2.5"
"ubntAirVisionGroups"                   "1.3.6.1.4.1.41112.1.2.6"
"ubntMFiGroups"                 "1.3.6.1.4.1.41112.1.2.7"
"ubntUniTelGroups"                      "1.3.6.1.4.1.41112.1.2.8"
"ubntAFLTUGroups"                       "1.3.6.1.4.1.41112.1.2.9"
"ubntSunMaxGroups"                      "1.3.6.1.4.1.41112.1.2.10"
"sunMaxCompliances"                     "1.3.6.1.4.1.41112.1.2.10.1"
"sunMaxGroups"                  "1.3.6.1.4.1.41112.1.2.10.2"
"ubntAirFIBER"                  "1.3.6.1.4.1.41112.1.3"
"ubntEdgeMax"                   "1.3.6.1.4.1.41112.1.5"
"ubntUniFi"                     "1.3.6.1.4.1.41112.1.6"
"ubntAirVision"                 "1.3.6.1.4.1.41112.1.7"
"ubntMFi"                       "1.3.6.1.4.1.41112.1.8"
"ubntUniTel"                    "1.3.6.1.4.1.41112.1.9"
"ubntAFLTU"                     "1.3.6.1.4.1.41112.1.10"
"ubntSunMax"                    "1.3.6.1.4.1.41112.1.11"
"sunMaxMIB"                     "1.3.6.1.4.1.41112.1.11.1"
"sunMaxBatteryStats"                    "1.3.6.1.4.1.41112.1.11.1.1"
"sunMaxBatCurrent"                      "1.3.6.1.4.1.41112.1.11.1.1.1"
"sunMaxBatVoltage"                      "1.3.6.1.4.1.41112.1.11.1.1.2"
"sunMaxBatPower"                        "1.3.6.1.4.1.41112.1.11.1.1.3"
"sunMaxBatTemp"                 "1.3.6.1.4.1.41112.1.11.1.1.4"
"sunMaxPvPanelStats"                    "1.3.6.1.4.1.41112.1.11.1.2"
"sunMaxPVCurrent"                       "1.3.6.1.4.1.41112.1.11.1.2.1"
"sunMaxPVVoltage"                       "1.3.6.1.4.1.41112.1.11.1.2.2"
"sunMaxPVPower"                 "1.3.6.1.4.1.41112.1.11.1.2.3"
"sunMaxOutPutStats"                     "1.3.6.1.4.1.41112.1.11.1.3"
"sunMaxOutCurrent"                      "1.3.6.1.4.1.41112.1.11.1.3.1"
"sunMaxOutVoltage"                      "1.3.6.1.4.1.41112.1.11.1.3.2"
"sunMaxOutPower"                        "1.3.6.1.4.1.41112.1.11.1.3.3"
"security"                      "1.3.6.1.5"
"snmpV2"                        "1.3.6.1.6"
"snmpDomains"                   "1.3.6.1.6.1"
"snmpProxys"                    "1.3.6.1.6.2"
"snmpModules"                   "1.3.6.1.6.3"
"zeroDotZero"                   "0.0"

Get battery voltage

We can get the battery voltage from the controller with the following SNMP walk command. Change the community “ubnt” to your SNMP community.

snmpwalk -c ubnt -v2c 10.96.1.9 1.3.6.1.4.1.41112.1.11.1.1.2

Return value is

SNMPv2-SMI::enterprises.41112.1.11.1.1.2.0 = INTEGER: 24990

You may need to add a zero if you are trying to add the OID in LibreNMS for a custom OID.

Custom OID not not working but snmpwalk test does?
byu/tb808 inLibreNMS

Hardening SNMP on Debian

Posted on June 23, 2022 by admin

Hardening SNMP on Debian by disabling SNMP v1 and v2c, and configuring SNMP v3.

Modify /etc/snmp/snmpd.conf

First we’ll want to open up the /etc/snmp/snmpd.conf file and comment out all lines that begin with

rocommunity
view
rouser authPriv <– “This may be the last line by default, we don’t need it”

Alternatively, you can copy and paste the following sed commands instead of manually editing the file.

sudo sed -i 's/^rocommunity/# rocommunityc/g' /etc/snmp/snmpd.conf
sudo sed -i 's/^view/# view/g' /etc/snmp/snmpd.conf
sudo sed -i 's/^rouser authPriv/# rouser authPriv/g' /etc/snmp/snmpd.conf

Create SNMP v3 User

We can create a SNMP v3 user with the following command. There it will ask you for the username and passwords.

sudo net-snmp-create-v3-user -ro -a SHA-512 -x AES

You may receive an error about not being able to touch /snmp/snmpd.conf. I am not sure why Debian is attempting to create that file. Take the “rouser snmpuser” line and add it to the end of the /etc/snmp/snmpd.conf config.

Now we can start SNMPD

sudo systemctl start snmpd

Troubleshooting

My created user is not working! This could result from two different issues.

It appears that Debian/SNMP doesn’t like pass phrases with special characters. You can try using a different password or escaping the special characters in “/var/lib/snmp/snmpd.conf” file before starting SNMPD.
The user didn’t get added to /etc/snmp/snmpd.conf To fix, add “rouser snmpuser” (Change snmpuser to your snmp username) to the bottom of the config file.

Hardening SNMP on CentOS/RedHat/Fedora Etc.

Posted on June 23, 2022 by admin

These steps should be similar across Red Hat type distros.

Before we proceed, lets stop SNMP

sudo systemctl stop snmpd

Disable SNMP Versions 1 and 2c

First we are going to disable SNMP v1 and v2c

You can manually edit the /etc/snmp/snmpd.conf file and comment out or delete every line starting with com2sec, group, access. Or you can run the following sed commands to change it for you.

sudo sed -i 's/^com2sec/# com2sec/g' /etc/snmp/snmpd.conf
sudo sed -i 's/^group/# group/g' /etc/snmp/snmpd.conf
sudo sed -i 's/^access/# access/g' /etc/snmp/snmpd.conf

https://serverfault.com/questions/376688/how-to-disable-version-1-and-version-2c-in-snmpd

Create SNMP Version 3 User

Follow the prompts to create a SNMP v3 user.

sudo net-snmp-create-v3-user -ro -a SHA -x AES

Start SNMP

sudo systemctl start snmpd

You should be good to go.

If you are running a firewall, you will need to allow an exception for SNMP, UDP port 161. You may also need to allow an SELinux exception. Check out the last portion of both these articles.

Setting up SNMP V3 on CentOS

Allowing SNMP Through Firewall

semanage Allow and Delete ports in CentOS

SNMPv3 snmpwalk Mikrotik

Posted on July 16, 2019 by admin

Change AuthPass and CryptoPass to their respective passwords.
If needed, change MD5 to SHA1 and DES to AES.

 snmpwalk -v3 -a MD5 -A AuthPass -x DES -X CryptoPass -l authPriv -u privUser localhost

Configure AirOS SNMP settings over ssh

Posted on May 24, 2019 by admin

In this post we’ll see how we can configure AirOS SNMP settings from the command line.

ubntmod command with save without rebooting.

./ubntmod.sh -i 192.168.1.20 -s "private;monitor@incredigeek.com;[30.69636, -88.04811]" -X '/usr/etc/rc.d/rc.softrestart save'

Alternative manual method.

ssh ubnt@192.168.1.20

Open config file

vi /tmp/system.cfg

Find the SNMP settings and modify as needed. Example below

snmp.community=private
snmp.contact=monitor@incredigeek.com
snmp.location=[30.69636, -88.04811]

Save and exit file with :x

Apply settings

/usr/etc/rc.d/rc.softrestart save

cnMaestro configuration for SNMPv3

Posted on May 18, 2019 by admin

The following works for setting the snmpv3 configuration on cambium 450i 900’s. Once applied it’ll run change the SNMP settings and reboot the radio.

You’ll need to find the hashed password which can be found in a config backup.
Change the SNMP username/community as needed.

{
     "userParameters": {
         "snmpConfig": {
             "user2Group": 0,
             "snmpv3EngineId": "007000a9840a003e464e7a",
             "rwAuthPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "commStringROnly": "rocommunitystring2",
             "user2PrivPassword": "",
             "user1AuthPassword": "",
             "snmpv3AuthProt": 0,
             "snmpv3TrapEnable": 0,
             "snmpv3PrivProt": 0,
             "snmpMibPerm": 1,
             "roAuthPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "commStringRW": "communitystring",
             "userGroup1": 0,
             "user1Enable": 0,
             "snmpv3SecLvl": 2,
             "user2Enable": 0,
             "rwUserName": "Canopy",
             "roUserName": "snmpv3user",
             "roPrivPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "userName1": "",
             "snmpPort": 161,
             "rwUserEnable": 0,
             "trapDomainNameAppend": 0,
             "rwPrivPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "user1PrivPassword": "",
             "userName2": "",
             "user3PrivPassword": "",
             "user2AuthPassword": "",
             "userName3": "",
             "user3Enable": 0,
             "snmpTrapPort": 162,
             "user3AuthPassword": "",
             "user3Group": 0,
             "trapDelayAfterBootup": 5,
             "snmpIpAccessFilter": [
                 {
                     "address": "192.168.0.0",
                     "netmask": 24
                 },
                 {
                     "address": "10.0.1.0",
                     "netmask": 24
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 }
             ],
             "snmpTrapAddresses": [
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0"
             ]
         },
 }

Setup SNMPv3 on Mikrotik Router

Posted on December 21, 2018 by admin

Setting up SNMP via WinBox is straight forward, the following commands are how to set it up from the command line with some troubleshooting info at the end.

Setup SNMPv3

Setup Community (Change v3Private,encpass, and authpass to their respective names or passwords)

snmp community add name=v3Private encryption-protocol=AES encryption-password=encpass authentication-protocol=SHA1 authentication-password=authpass security=private

Enable and set SNMP community (Trap Community needs to match the above command. Change contact and the location as needed.)

snmp set contact=admin@incredigeek.com location=DeviceLocation trap-community=V3Private

Troubleshooting

Sometimes, for no apparent reason it seems, routerOS will have issues using the default community. Work around is to create and use a new community.

Cannot connect with AES encryption

AES doesn’t always seem to work reliably. Seems to work on some and not other. Work around is to use DES.

Note that DES is deprecated on newer systems. For example, you will not be able to read the SNMP details on a router that uses DES from a machine running AlmaLinux 9. AES seems to be working fine now in 2023.

Log shows Permission Denied

Double check the allowed from addresses, user, and passwords

Incredigeek

Tag Archives: snmp

Enable SNMP v3 on Dell iDRAC9

Configure SNMPv3 on Cisco Router

Bulk Update SNMP v3 Settings for Devices in LibreNMS

Upgrading SNMP Settings for Devices in LibreNMS

Bulk updating of Network Devices

OIDs for UI / Ubiquiti Solar Charge Controller

Get battery voltage

Hardening SNMP on Debian

Modify /etc/snmp/snmpd.conf

Create SNMP v3 User

Troubleshooting

Hardening SNMP on CentOS/RedHat/Fedora Etc.

Disable SNMP Versions 1 and 2c

Create SNMP Version 3 User

SNMPv3 snmpwalk Mikrotik

Configure AirOS SNMP settings over ssh

cnMaestro configuration for SNMPv3

Setup SNMPv3 on Mikrotik Router

Setup SNMPv3

Troubleshooting