Conference azur::mcc

  In addition I have installed the SNMP V1.1 AM 

	A nit, there isn't a 1.1 SNMP AM.  Just 1.0.  You have DECmcc 1.1.


1) What SNMP parameters does ULTRIX allow one to change from the DECmcc 
BMS V1.0 SNMP AM?  One source indicates that only the ifAdminStatus
parameter can be changed.  If so, this fact will impede our efforts to 
leverage future PCSA ULTRIX sales by promoting the concept of SNMP 
management from the DECmcc BMS/SNMP NETstation!

	Yes, I believe that's the only one allowed by the Ultrix V4 SNMP agent.
	The issue with SNMP in general is that there isn't much in the way
	of security, so most network administrators don't allow SET via SNMP.
	This will probably change in the next year, as the authentication
	and privacy MIBs and rules become standardized.

	You might want to post this in MKNME::SNMP.


2) So far, I am experiencing time-outs from issuing the following 
command from DECmcc:

	SET SNMP DS3100 INTERFACE 1 ifAdminStatus = TESTING

	
	I believe the community name is case sensitive on Ultrix.
	The default community used by the AM is "public".
	
	Try 
	SET SNMP DS3100 INTERFACE 1 ifAdminStatus = TESTING, 
						  by password "public"

	If that works, you might want to alter the Ultrix file accordingly.
	Finally, please note that by doing so you will have configured your
	agent to accept SET requests from ANY IP address, AND using the
	default community name.

	Regards,
	Mike

	I forgot to mention, as stated in the Use book section on
	access control, an SNMP agent is required to discard unauthorized
	packets.  So the timeout is the expected behavior if the community name
	doesn't match.

	And of course, what I really meant in .1 was ,by password "PUBLIC"
	not "public".

>1) What SNMP parameters does ULTRIX allow one to change from the DECmcc 
>BMS V1.0 SNMP AM?  One source indicates that only the ifAdminStatus
>parameter can be changed.  If so, this fact will impede our efforts
>parameter can be changed.  If so, this fact will impede our efforts to 
>leverage future PCSA ULTRIX sales by promoting the concept of SNMP 
>management from the DECmcc BMS/SNMP NETstation!

>>	Yes, I believe that's the only one allowed by the Ultrix V4 SNMP agent.

And I believe that ifAdminStatus is the only parameter that is settable in most
SNMP agent implementations.  Also note that the restriction on what
is settable is a characteristic of the SNMP agent, independent of
which manager is being used.

Even allowing ifAdminStatus to be set with SNMP is pretty dumb. 
You can easily turn off a Router that way and bring down a whole network.
How long will it be before some enterpising hacker crashes the Internet
this way?

				Mark

>Even allowing ifAdminStatus to be set with SNMP is pretty dumb. 

Yup.  While the ULTRIX snmp agent SUPPORTS set for ifAdminStatus,
the default config file has "community       public  0.0.0.0 read-only".
Changing the access to allow sets is not a real great idea.

>Even allowing ifAdminStatus to be set with SNMP is pretty dumb. 

	I don't think it's really a problem.  This refers to the latest
	adminstrative request to set the interface.  It's usually not tied
	to anything real.  That is, even setting this to off won't cause the
	agent to REALLY shut down the interface, it will merely change the value
	of ifAdminstatus.  The ACTUAL status of the interface is returned
	by ifOperstatus, which is NOT settable by Ultrix SNMP agnts.  ( I don't
	think MIB I even defines it as writeable. )

	Most agents don't let you set anything.  Period.  When a standard
	for security is adopted, I believe SNMP will start being use to
	actually manage.  This should happen in 91.

	We're not the first to think about SNMP, SET, and security.