README.snmpv3

How to setup SNMPv3, a very brief document for Dave to elaborate and
do a better job on since I suck at writing documentation and he
doesn't ;-) --Wes:

Note: SHA authentication and DES encryption support is only available
if you have OpenSSL installed.

CREATING THE FIRST USER:

  First off, you need to add snmpd.conf VACM entries to allow you to
  use the SNMPv3 users you are going to create.  So, in your
  /usr/local/share/snmp/snmpd.conf file (you may have to create it)
  put the following line:

    rwuser myuser

  Then, you need to actually create your new user and specify their
  authentication type and pass phrase.  You can do this by putting the
  following line in your /var/ucd-snmp/snmpd.conf file (you may have
  to create it):

    createUser myuser MD5 my_password DES

  WARNING: SNMPv3 pass phrases must be at least 8 characters long!

  Now, you have a user "myuser" which can write to everything using
  MD5 authentication and DES encryption if the above 2 lines are in
  place.  You can optionally add a second pass phrase after the DES
  keyword if you want it to be different from the authentication
  pass phrase.

  Start the agent and test your setup:
    /usr/local/sbin/snmpd
       [...wait a few seconds...]
    snmpget -v 3 -u myuser -l authNoPriv -a MD5 -A my_password localhost sysUpTime.0

  SECURITY CONSIDERATIONS: By placing the "createUser" line in
  /var/ucd-snmp/snmpd.conf instead of
  /usr/local/share/snmp/snmpd.conf, the password will be automatically
  erased from the file the next time the agent shuts down.  This way,
  only the derived secret key will remembered.  Even better is that
  actually only the localized secret key will be remembered and if the
  machine is broken into it'll be impossible to use this localized key
  to get access to any of your other hosts.

CREATING A SECOND USER:

  Start the agent (if you haven't yet).

  Now, lets create a second user using the first user (just for fun)
  for both authentication purposes and as a template (or "cloning
  source"):

    snmpusm -v 3 -u myuser -l authNoPriv -a MD5 -A my_password localhost create wes myuser

  The above should have created the user "wes" with the same password as
  the "myuser" user.  So then, you need to change his password using:

    snmpusm -v 3 -u wes -l authNoPriv -a MD5 -A my_password localhost passwd -CO my_password -CN new_passphrase

  See, wasn't that easy?  You can now create users.  Wheeee....

  But, you'll have to add a configuration line that allows them access
  to do things.  Do this with another "rwuser" line in your
  /usr/local/share/snmp/snmpd.conf file (you'll need to stop and start 
  the agent again, or send the agent a SIGHUP signal):

    rwuser wes

  Or, optional use the "rouser" token to only grant them read-only access.

  Now, test your new user:

    snmpget -v 3 -u wes -l authNoPriv -a MD5 -A new_passphrase localhost sysUpTime.0

FURTHER STUDIES:

  The information about the newly created users is stored in
  /var/ucd-snmp/snmpd.conf, in the form of configuration lines, when the
  agent is shut down so that it is usable in next run in the future.

  Also since that the passkeys stored in /var/ucd-snmp/snmpd.conf are
  locked to a given engineID, which by default is based off of your
  IPv4 address.  This means that:

  1) You can't copy/rdist the /var/ucd-snmp/snmpd.conf around.
  2) If you change the IP address of your machine your entire user
     database needs to be re-created.  wheeee.

Tired of all those command line options?
----------------------------------------
put something like this in your ~/.snmp/snmp.conf file (make it
readable only by you!!!):

  defSecurityName wes
  defContext none
  defAuthType MD5
  defSecurityLevel authNoPriv
  defAuthPassphrase new_passphrase
  defVersion 3

And this is in place the above example line boils down to:

  snmpget localhost sysUpTime.0

Which is about as simple as I can make it for ya ;-)