snmpd.config revision 315593
1145184Sglebius# $FreeBSD: stable/10/etc/snmpd.config 315593 2017-03-19 22:14:22Z ngie $ 2145184Sglebius# 3145184Sglebius# Example configuration file for bsnmpd(1). 4145184Sglebius# 5145184Sglebius 6145184Sglebius# 7145184Sglebius# Set some common variables 8145184Sglebius# 9145184Sglebiuslocation := "Room 200" 10155768Scericontact := "sysmeister@example.com" 11145184Sglebiussystem := 1 # FreeBSD 12155458Sglebiustraphost := localhost 13145184Sglebiustrapport := 162 14145184Sglebius 15216300Ssyrinx# 16216300Ssyrinx# Set the SNMP engine ID. 17216300Ssyrinx# 18216300Ssyrinx# The snmpEngineID object required from the SNMPv3 Framework. If not explicitly set via 19216300Ssyrinx# this configuration file, an ID is assigned based on the value of the 20216300Ssyrinx# kern.hostid variable 21216300Ssyrinx# engine := 0x80:0x10:0x08:0x10:0x80:0x25 22216300Ssyrinx# snmpEngineID = $(engine) 23216300Ssyrinx 24145184Sglebius# Change this! 25145184Sglebiusread := "public" 26165685Smaxim# Uncomment begemotSnmpdCommunityString.0.2 below that sets the community 27165685Smaxim# string to enable write access. 28145184Sglebiuswrite := "geheim" 29145184Sglebiustrap := "mytrap" 30145184Sglebius 31216595Ssyrinx# 32216300Ssyrinx# Declarations for SNMP-USER-BASED-SM-MIB authentication and privacy options 33216595Ssyrinx# 34216595Ssyrinx 35216300SsyrinxNoAuthProtocol := 1.3.6.1.6.3.10.1.1.1 36216300SsyrinxHMACMD5AuthProtocol := 1.3.6.1.6.3.10.1.1.2 37216300SsyrinxHMACSHAAuthProtocol := 1.3.6.1.6.3.10.1.1.3 38216300SsyrinxNoPrivProtocol := 1.3.6.1.6.3.10.1.2.1 39216300SsyrinxDESPrivProtocol := 1.3.6.1.6.3.10.1.2.2 40216300SsyrinxAesCfb128Protocol := 1.3.6.1.6.3.10.1.2.4 41216300Ssyrinx 42145184Sglebius# 43216595Ssyrinx# Enumerations from SNMP-FRAMEWORK-MIB 44216595Ssyrinx# 45216595Ssyrinx 46216595Ssyrinx# Security models 47216595SsyrinxsecurityModelAny := 0 48216595SsyrinxsecurityModelSNMPv1 := 1 49216595SsyrinxsecurityModelSNMPv2c := 2 50216595SsyrinxsecurityModelUSM := 3 51216595Ssyrinx 52216595Ssyrinx# Message Processing models 53216595SsyrinxMPmodelSNMPv1 := 0 54216595SsyrinxMPmodelSNMPv2c := 1 55216595SsyrinxMPmodelSNMPv3 := 3 56216595Ssyrinx 57216595Ssyrinx# Security levels 58216595SsyrinxnoAuthNoPriv := 1 59216595SsyrinxauthNoPriv := 2 60216595SsyrinxauthPriv := 3 61216595Ssyrinx 62216595Ssyrinx 63216300Ssyrinx# SNMPv3 USM User definition 64216300Ssyrinx# 65216300Ssyrinx# The localized hex password for a user may be obtained by setting SNMPUSER, SNMPPASSWD, 66216300Ssyrinx# SNMPAUTH and SNMPPRIV environment variables to the desired parameters and invoking 67216300Ssyrinx# 'bsnmpget -v 3 -D -K -o verbose' against the running bsnmpd(1). For other 68216300Ssyrinx# usages refer to the bsnmpget(1) manual page. The following lines define a user "bsnmp" 69216595Ssyrinx# with a private password "bsnmptest", localized for the above engine ID. 70216300Ssyrinx# 71216595Ssyrinx#user1 := "bsnmp" 72216595Ssyrinx#user1passwd := 0x22:0x98:0x1a:0x6e:0x39:0x93:0x16:0x5e:0x6a:0x21:0x1b:0xd8:0xa9:0x81:0x31:0x05:0x16:0x33:0x38:0x60 73216300Ssyrinx 74216300Ssyrinx# 75145184Sglebius# Configuration 76145184Sglebius# 77145184Sglebius%snmpd 78145184SglebiusbegemotSnmpdDebugDumpPdus = 2 79145184SglebiusbegemotSnmpdDebugSyslogPri = 7 80145184Sglebius 81154186Sharti# 82154186Sharti# Set the read and write communities. 83154186Sharti# 84154186Sharti# The default value of the community strings is NULL (note, that this is 85154186Sharti# different from the empty string). This disables both read and write access. 86154186Sharti# To enable read access only the read community string must be set. Setting 87154186Sharti# the write community string enables both read and write access with that 88154186Sharti# string. 89154186Sharti# 90154186Sharti# Be sure to understand the security implications of SNMPv2 - the community 91154186Sharti# strings are readable on the wire! 92154186Sharti# 93145184SglebiusbegemotSnmpdCommunityString.0.1 = $(read) 94154186Sharti# begemotSnmpdCommunityString.0.2 = $(write) 95145184SglebiusbegemotSnmpdCommunityDisable = 1 96145184Sglebius 97145184Sglebius# open standard SNMP ports 98163823ShartibegemotSnmpdPortStatus.0.0.0.0.161 = 1 99145184Sglebius 100145184Sglebius# open a unix domain socket 101145184SglebiusbegemotSnmpdLocalPortStatus."/var/run/snmpd.sock" = 1 102145184SglebiusbegemotSnmpdLocalPortType."/var/run/snmpd.sock" = 4 103145184Sglebius 104145184Sglebius# send traps to the traphost 105145184SglebiusbegemotTrapSinkStatus.[$(traphost)].$(trapport) = 4 106145184SglebiusbegemotTrapSinkVersion.[$(traphost)].$(trapport) = 2 107145184SglebiusbegemotTrapSinkComm.[$(traphost)].$(trapport) = $(trap) 108145184Sglebius 109145184SglebiussysContact = $(contact) 110145184SglebiussysLocation = $(location) 111145184SglebiussysObjectId = 1.3.6.1.4.1.12325.1.1.2.1.$(system) 112145184Sglebius 113145184SglebiussnmpEnableAuthenTraps = 2 114145184Sglebius 115310876Sngie# Uncomment `begemotSnmpdModulePath.".." = ".."' entries below to enable 116310876Sngie# modules 117310876Sngie 118145184Sglebius# 119313224Sngie# Control configuration for the modules in the module specific sections, e.g. 120313224Sngie# the "usm" module (begemotSnmpdModulePath."usm") can be controlled in the 121313224Sngie# %usm specific section. You must uncomment the section specific header in 122313224Sngie# order to use the enclosed variables, e.g. `usmUserStatus.$(engine).$(user1)` 123313224Sngie# can only be used if %usm is uncommented. 124313224Sngie# 125315593Sngie# Modules are loaded in the order listed, so they must be before any 126315593Sngie# dependent modules, e.g. "mibII" vs "bridge". 127315593Sngie# 128313224Sngie 129313224Sngie# 130315593Sngie# MIB-2 module 131315593Sngie# 132315593SngiebegemotSnmpdModulePath."mibII" = "/usr/lib/snmp_mibII.so" 133315593Sngie 134315593Sngie# 135310876Sngie# Bridge module 136310876Sngie# This requires the mibII module. 137310876Sngie# 138310876Sngie#begemotSnmpdModulePath."bridge" = "/usr/lib/snmp_bridge.so" 139310876Sngie 140310876Sngie# 141310876Sngie# Host resources module 142310876Sngie# This requires the mibII module. 143310876Sngie# 144310876Sngie#begemotSnmpdModulePath."hostres" = "/usr/lib/snmp_hostres.so" 145310876Sngie 146310876Sngie# 147310876Sngie# Netgraph module 148310876Sngie# 149310876Sngie#begemotSnmpdModulePath."netgraph" = "/usr/lib/snmp_netgraph.so" 150310876Sngie 151310876Sngie# 152310876Sngie# pf(4) module 153310876Sngie# 154310876Sngie#begemotSnmpdModulePath."pf" = "/usr/lib/snmp_pf.so" 155310876Sngie 156310876Sngie# 157310876Sngie# SNMPv3 Notification Targets 158310876Sngie# 159310876Sngie# begemotSnmpdModulePath."target" = "/usr/lib/snmp_target.so" 160310876Sngie 161310876Sngie# 162216300Ssyrinx# SNMPv3 User-based security module - must be loaded for SNMPv3 USM 163216300Ssyrinx# 164216300Ssyrinx#begemotSnmpdModulePath."usm" = "/usr/lib/snmp_usm.so" 165216300Ssyrinx 166216300Ssyrinx# 167310876Sngie# SNMPv3 View-based Access Control module 168310876Sngie# 169310876Sngie#begemotSnmpdModulePath."vacm" = "/usr/lib/snmp_vacm.so" 170310876Sngie 171310876Sngie# 172310876Sngie# Wireless module 173310876Sngie# This requires the mibII module. 174310876Sngie# 175310876Sngie#begemotSnmpdModulePath."wlan" = "/usr/lib/snmp_wlan.so" 176310876Sngie 177310876Sngie# 178216300Ssyrinx# SNMPv3 USM User definition. 179216300Ssyrinx# 180216300Ssyrinx 181216300Ssyrinx#%usm 182216300Ssyrinx 183216300Ssyrinx# 184216300Ssyrinx# The following block creates a user with name "bsnmp" and sets privacy 185216300Ssyrinx# and encryption options to SHA256 message digests and AES encryption 186216300Ssyrinx# for this user. 187310568Sngie# 188216300Ssyrinx# usmUserStatus.$(engine).$(user1) = 5 189216300Ssyrinx# usmUserAuthProtocol.$(engine).$(user1) = $(HMACSHAAuthProtocol) 190216300Ssyrinx# usmUserAuthKeyChange.$(engine).$(user1) = $(user1passwd) 191216300Ssyrinx# usmUserPrivProtocol.$(engine).$(user1) = $(AesCfb128Protocol) 192216300Ssyrinx# usmUserPrivKeyChange.$(engine).$(user1) = $(user1passwd) 193216300Ssyrinx# usmUserStatus.$(engine).$(user1) = 1 194216300Ssyrinx# 195216300Ssyrinx 196216300Ssyrinx# 197216300Ssyrinx# The following block creates a user with name "public" with no authentication 198216301Ssyrinx# or encryption options. 199216300Ssyrinx# 200216300Ssyrinx# usmUserStatus.$(engine).$(read) = 5 201216300Ssyrinx# usmUserAuthProtocol.$(engine).$(read) = $(NoAuthProtocol) 202216300Ssyrinx# usmUserPrivProtocol.$(engine).$(read) = $(NoPrivProtocol) 203216300Ssyrinx# usmUserStatus.$(engine).$(read) = 1 204216300Ssyrinx# 205216300Ssyrinx 206216300Ssyrinx# 207216300Ssyrinx# Definition of view-based access control entries. 208216300Ssyrinx# 209216300Ssyrinx#%vacm 210216300Ssyrinx 211216300Ssyrinx# Definition of a SNMPv1 group 212216595Ssyrinx# vacmSecurityToGroupStatus.$(securityModelSNMPv1).$(read) = 4 213216595Ssyrinx# vacmGroupName.$(securityModelSNMPv1).$(read) = $(read) 214216300Ssyrinx 215216300Ssyrinx# Definition of SNMPv2 group 216216595Ssyrinx# vacmSecurityToGroupStatus.$(securityModelSNMPv2c).$(write) = 4 217216595Ssyrinx# vacmGroupName.$(securityModelSNMPv2c).$(write) = $(write) 218216300Ssyrinx 219216300Ssyrinx# Definition of SNMPv3 group with users "bsnmp" and "public" 220216595Ssyrinx# vacmSecurityToGroupStatus.$(securityModelUSM).$(user1) = 4 221216595Ssyrinx# vacmGroupName.$(securityModelUSM).$(user1) = $(write) 222216595Ssyrinx# vacmSecurityToGroupStatus.$(securityModelUSM).$(read) = 4 223216595Ssyrinx# vacmGroupName.$(securityModelUSM).$(read) = $(write) 224216300Ssyrinx 225310568Sngie# 226216300Ssyrinx# The OID of the .iso.org.dod.internet subtree 227216300Ssyrinx# 228216300Ssyrinx# internetoid := 1.3.6.1 229216300Ssyrinx# internetoidlen := 4 230216300Ssyrinx 231216300Ssyrinx# 232216300Ssyrinx# Definitions of two views 233216300Ssyrinx# 234216300Ssyrinx# vacmViewTreeFamilyStatus."internet".$(internetoidlen).$(internetoid) = 4 235216300Ssyrinx# vacmViewTreeFamilyStatus."restricted".$(internetoidlen).$(internetoid) = 4 236216300Ssyrinx 237216300Ssyrinx# 238216300Ssyrinx# Access control 239216300Ssyrinx# 240216300Ssyrinx 241216300Ssyrinx# 242216300Ssyrinx# Read-only access for SNMPv1 users 243216300Ssyrinx# 244216595Ssyrinx# vacmAccessStatus.$(read)."".$(securityModelSNMPv1).$(noAuthNoPriv) = 4 245216595Ssyrinx# vacmAccessReadViewName.$(read)."".$(securityModelSNMPv1).$(noAuthNoPriv) = "internet" 246216300Ssyrinx 247216300Ssyrinx# 248310568Sngie# Read-write access for SNMPv2 users 249216300Ssyrinx# 250216595Ssyrinx# vacmAccessStatus.$(write)."".$(securityModelSNMPv2c).$(noAuthNoPriv) = 4 251216595Ssyrinx# vacmAccessReadViewName.$(write)."".$(securityModelSNMPv2c).$(noAuthNoPriv) = "internet" 252216595Ssyrinx# vacmAccessWriteViewName.$(write)."".$(securityModelSNMPv2c).$(noAuthNoPriv) = "internet" 253216300Ssyrinx 254216300Ssyrinx# 255216300Ssyrinx# Read-write-notify access for SNMPv3 USM users with noAuthNoPriv 256216300Ssyrinx# 257216300Ssyrinx# vacmAccessStatus.$(write)."".3.$(noAuthNoPriv) = 4 258216595Ssyrinx# vacmAccessReadViewName.$(write)."".$(securityModelUSM).$(noAuthNoPriv) = "internet" 259216595Ssyrinx# vacmAccessWriteViewName.$(write)."".$(securityModelUSM).$(noAuthNoPriv) = "internet" 260216595Ssyrinx# vacmAccessNotifyViewName.$(write)."".$(securityModelUSM).$(noAuthNoPriv) = "internet" 261216300Ssyrinx 262216300Ssyrinx# 263216300Ssyrinx#Read-write-notify access to restricted for SNMPv3 USM users with authPriv 264216300Ssyrinx# 265310876Sngie# vacmAccessStatus.$(write)."".$(securityModelUSM).$(authPriv) = 4 266310876Sngie# vacmAccessReadViewName.$(write)."".$(securityModelUSM).$(authPriv) = "restricted" 267310876Sngie# vacmAccessWriteViewName.$(write)."".$(securityModelUSM).$(authPriv) = "restricted" 268310876Sngie# vacmAccessNotifyViewName.$(write)."".$(securityModelUSM).$(authPriv) = "restricted" 269216300Ssyrinx 270216595Ssyrinx#%target 271216595Ssyrinx# Send notifications to target tag "test" 272216595Ssyrinx# tag := "test" 273216595Ssyrinx# snmpNotifyRowStatus.$(tag) = 4 274216595Ssyrinx# snmpNotifyTag.$(tag) = $(tag) 275216595Ssyrinx 276216595Ssyrinx# tagremote := "testremote" 277216595Ssyrinx# snmpNotifyRowStatus.$(tagremote) = 4 278216595Ssyrinx# snmpNotifyTag.$(tagremote) = $(tagremote) 279216595Ssyrinx 280216595Ssyrinx# 281216595Ssyrinx# Specify the target parameters for the notifications - send with the credentials 282216595Ssyrinx# of user "bsnmp" 283216595Ssyrinx# 284216595Ssyrinx# snmpTargetParamsRowStatus.$(tag) = 5 285216595Ssyrinx# snmpTargetParamsMPModel.$(tag) = $(MPmodelSNMPv3) 286216595Ssyrinx# snmpTargetParamsSecurityModel.$(tag) = $(securityModelUSM) 287216595Ssyrinx# snmpTargetParamsSecurityName.$(tag) = $(user1) 288216595Ssyrinx# snmpTargetParamsSecurityLevel.$(tag) = $(authPriv) 289216595Ssyrinx# snmpTargetParamsRowStatus.$(tag) = 1 290216595Ssyrinx 291216595Ssyrinx# 292216595Ssyrinx# Define the notifications' target address - port 162 on localhost 293216595Ssyrinx# 294216595Ssyrinx# snmpTargetAddrRowStatus.$(tag) = 5 295216595Ssyrinx# snmpTargetAddrTAddress.$(tag) = 0x7f:0x0:0x0:0x1:0x0:0xa2 296216595Ssyrinx# snmpTargetAddrTagList.$(tag) = "test notification" 297216595Ssyrinx# snmpTargetAddrParams.$(tag) = $(tag) 298216595Ssyrinx# snmpTargetAddrRowStatus.$(tag) = 1 299216595Ssyrinx 300216595Ssyrinx# 301216595Ssyrinx# Define the notifications' target address - port 162 on 10.0.0.1 302216595Ssyrinx# 303216595Ssyrinx# snmpTargetAddrRowStatus.$(tagremote) = 5 304216595Ssyrinx# snmpTargetAddrTAddress.$(tagremote) = 0x0a:0x00:0x00:0x1:0x0:0xa2 305216595Ssyrinx# snmpTargetAddrTagList.$(tagremote) = $(tagremote) 306216595Ssyrinx# snmpTargetAddrParams.$(tagremote) = $(tag) 307216595Ssyrinx# snmpTargetAddrRowStatus.$(tagremote) = 1 308216595Ssyrinx 309216595Ssyrinx# Force a polling rate for the 64-bit interface counters in case 310216595Ssyrinx# the automatic computation is wrong (which may be the case if an interface 311216595Ssyrinx# announces the wrong bit rate via its MIB). 312216595Ssyrinx#%mibII 313216595Ssyrinx#begemotIfForcePoll = 2000 314216595Ssyrinx 315145184Sglebius#%netgraph 316145184Sglebius#begemotNgControlNodeName = "snmpd" 317