UNIT 2 Simple Networking Monitoring 简单网络监控

UNIT 2 Simple Networking Monitoring   简单网络监控

Objectives：

Upon completion of this unit ，you should be able to

         .understandard  the role of SNMP for monitoring

         .install ,configure,and use SNMP client tools

         .install and configure the SNMP daemon

本章目标：

         理解SNMP在监控中的角色

         安装，配置，使用SNMP的客户端

         安装，配置SNMP服务

(1)

SNMP

Application-layer protocol

Low bandwidth

Simple network management protocol 简单网络管理协议

基于应用层的协议，占用很小的带宽

(2)

SNMP was designed as a response/request protocol. The NMS is an SNMP client. A network-management system that wants to inquire about the condition of a managed device issues a Get command to retrieve an object from the agent on the managed device. If the object is one of serveral of objects in a list or table, the network-management system can use GetNext command to retrieve the next object.

The network-management system can also use SNMP to control the managed-device by using Set command to change the value of an object. If the managed-device needs to notify the network-management station of some event, it can issue a Trap command to pass messages to The NMS.

A system can function as either an NMS or a managed-device, or both.

译文：

SNMP有四个命令

Get，GetNext，Set，Trap

SNMP被设计成响应和请求的协议，NMS是SNMP客户端，

网络管理系统：

通过使用GET命令从SNMP agent得到被管理设备信息

使用GETNEXT命令得到SNMP agent得到下一个对象信息

通过使用SET命令控制agent设备

         被管理设备可以通过TRAP命令来修正自己的station

一个系统既可以作为NMS，管理设备，或者两者都可以

(3)

SNMP VERSION

V1 employs a community string for access

         A “shared secret” between client and agent

         Cleartext means there is nothing secret about it！

V2 suffers from inconsistent implementations

V3 employs a user security model (usm) to require:

         Hashed user authentication and/or

         Encrypted data pricacy

我们一般使用的是V1 V3，V1不加密，V3加密

(4)

SNMP V1:

In a default configuration ,the public community is used to provide read access to a managed device while the private community is used to allow read-write access . all information exchanged between managed devices and NMS is sent cleartext.

SNMP V1 使用public 提供read access  使用private 提供rw access.

SNMP V3

SNMP V3 provides three very import security related feature.Username make it possible to audit SNMP connections made to managed devices.Passwords allow authenticated access to managed devices. This is especially important for controlling access to objects that can be used to control the state of managed device. Encryption allows data being exchanged between managed devices and the NMS to be sent securely. Both authentication information and the data being exchanged via SNMP can be encrypted with SNMP V3.

SNMP V3 是加密的，使用username，password，encryption三个重要的信息

(5)

Management  Information Base 管理信息库

         .hierarchical database of information about devices

Data encapsulated as objects

         Identified by an object identifier(OID)

         Tabular objects represent multiple values

         Scalar objects represent a single value

Two integer data types,commonly confused

         Counter:non-negative integer,increases to max value then resets to zero

         Gauge:negative or non-negative integer,remains at max value

(6)

MIB hierarchy

Rferring to MIB objects

Defined in a MBI file

         Shorthand with prefix:IP-MIB::ipForwarding.0

         Numerical ID : .1.3.6.1.2.1.4.1.0

         Name: .iso.org.dod.internet.mgmt.mib-2.system.0

Last number is an index to the OID value

在MIB tree的object可以有以下几种表示方法：

         .simply specifying the name

Example:         ipForwarding.0

         .full path name

Example:           .iso.org.dod.internet.mgmt.mib-2.ip.ipForwarding.0

         .numerical identifier

Example:           .1.3.6.1.2.1.4.1.0

         .snmp prefix

Example:           IP-MIB::ipForwarding.0

Note that in all of the examples used above(which all point to the same object),the last value in the OID string isn’t actually a part of the object ID but serves as an index number.some objects may actually contain multiple values;the index number is used to indicate which specific value we wish to view.

(7)

Reading a MIB file

Format

         First line defines the SNMP prefix  

         /usr/share/snmp/mibs/HOST-RESOURCES-MIB.txt

第一行定义snmp的前缀

(8)

Using SNMP v1 for queries

Uniform syntax per snmpcmd(1)

Snmpwalk –v1 –c rh442 localhost

Snmpget  -v1 –c rh442 localhost IP-MIB::ipForwarding.0

Using SNMP v3 for queries

Query must include

         .Security level(auth,priv,authPriv,authNoPriv)

         .if auth is used:username,password,and type of hash

         .if priv is used:shared secret and type of encryption

Snmpget –v3 localhost IP-MIB::ipForwarding.0 \

 -l authPriv –u demouser –A redhatrocks –a sha –X redhatrocks –X AES

译文：

使用SNMP V1查询：

         Snmpwalk –v1 –c rh442 localhost

使用SNMP V3查询：

         安全级别：auth，priv，authPriv，authNoPriv

         如果使用auth：username，password，哈希类型

         如果使用priv：shared secret，加密的类型

注意：我们使用服务器端进行查询时，需要使用上面的语法，但是可以通过修改客户端的配置文件来进行修正语法，是语法比较简洁

客户端的配置如下：

/etc/snmp/snmp.conf

defversion        3

defsecurityname      demouser

defsecuritylevel        authPriv

defauthtype              SHA

defauthpassphrase redhatrocks

defprivtype                AES

defprivpassphrase   redhatrocks

查询时使用下面的语法：

Snmpget localhost IP-MIB::ipForwarding.0

(9)

SNMP支持TCP wrapper

可以实现访问控制

(10)

Configuring SNMP v1 access

         .edit /etc/snmp/snmpd.conf

#ro_versus_rw         shared_secret          [source_spec            [oid_spec]]

rocommunity            rh442                          192.168.0.0/4           .1

rocommunity            not_secret                 192.168.0.0/255. 255. 255.0  .1

rwcommunity           dangerous

         .Or use an interactive tool

Snmpconf

配置SNMP v1的访问

两种方式：直接编辑配置文件或者使用交互式的工具snmpconf

(11)

Configuring SNMP v3 access

1.       stop snmpd

2.       create a user with password >=8 characters

net-snmp-config –create-snmpv3-user –ro \

-A redhatrocks –a sha –X redhatrocks –x AES demouser

3.       establish access controls in /etc/snmp/snmpd.conf

#define group and view

group  demogroup usm demouser

view   demoview included .1

#map group to view using snmpd.conf as a guide

Access demogroup any auth exact demoview none none

4.       start snmpd

配置SNMPV3的访问

停止snmpd的服务

等等步骤！

 

Objectives：

Upon completion of this unit ，you should be able to

         .understandard the role of SNMP for monitoring

         .install ,configure,and use SNMP client tools

         .install and configure the SNMP daemon

本章目标：

         理解SNMP在监控中的角色

         安装，配置，使用SNMP的客户端

         安装，配置SNMP服务

(1)

SNMP

Application-layer protocol

Low bandwidth

Simple network management protocol 简单网络管理协议

基于应用层的协议，占用很小的带宽

(2)

SNMP was designed as a response/request protocol. The NMS is an SNMP client. A network-management system that wants to inquire about the condition of a managed device issues a Get command to retrieve an object from the agent on the managed device. If the object is one of serveral of objects in a list or table, the network-management system can use GetNext command to retrieve the next object.

The network-management system can also use SNMP to control the managed-device by using Set command to change the value of an object. If the managed-device needs to notify the network-management station of some event, it can issue a Trap command to pass messages to The NMS.

A system can function as either an NMS or a managed-device, or both.

译文：

SNMP有四个命令

Get，GetNext，Set，Trap

SNMP被设计成响应和请求的协议，NMS是SNMP客户端，

网络管理系统：

通过使用GET命令从SNMP agent得到被管理设备信息

使用GETNEXT命令得到SNMP agent得到下一个对象信息

通过使用SET命令控制agent设备

         被管理设备可以通过TRAP命令来修正自己的station

一个系统既可以作为NMS，管理设备，或者两者都可以

(3)

SNMP VERSION

V1 employs a community string for access

         A “shared secret” between client and agent

         Cleartext means there is nothing secret about it！

V2 suffers from inconsistent implementations

V3 employs a user security model (usm) to require:

         Hashed user authentication and/or

         Encrypted data pricacy

我们一般使用的是V1 V3，V1不加密，V3加密

(4)

SNMP V1:

In a default configuration ,the public community is used to provide read access to a managed device while the private community is used to allow read-write access . all information exchanged between managed devices and NMS is sent cleartext.

SNMP V1 使用public 提供read access 使用private 提供rw access.

SNMP V3

SNMP V3 provides three very import security related feature. Username make it possible to audit SNMP connections made to managed devices.Passwords allow authenticated access to managed devices. This is especially important for controlling access to objects that can be used to control the state of managed device. Encryption allows data being exchanged between managed devices and the NMS to be sent securely. Both authentication information and the data being exchanged via SNMP can be encrypted with SNMP V3.

SNMP V3 是加密的，使用username，password，encryption三个重要的信息

(5)

Management Information Base 管理信息库

         .hierarchical database of information about devices

Data encapsulated as objects

         Identified by an object identifier(OID)

         Tabular objects represent multiple values

         Scalar objects represent a single value

Two integer data types,commonly confused

         Counter:non-negative integer,increases to max value then resets to zero

         Gauge:negative or non-negative integer,remains at max value

(6)

MIB hierarchy

Rferring to MIB objects

Defined in a MBI file

         Shorthand with prefix:IP-MIB::ipForwarding.0

         Numerical ID : .1.3.6.1.2.1.4.1.0

         Name: .iso.org.dod.internet.mgmt.mib-2.system.0

Last number is an index to the OID value

在MIB tree的object可以有以下几种表示方法：

         .simply specifying the name

Example:         ipForwarding.0

         .full path name

Example:            .iso.org.dod.internet.mgmt.mib-2.ip.ipForwarding.0

         .numerical identifier

Example:            .1.3.6.1.2.1.4.1.0

         .snmp prefix

Example:            IP-MIB::ipForwarding.0

Note that in all of the examples used above(which all point to the same object),the last value in the OID string isn’t actually a part of the object ID but serves as an index number.some objects may actually contain multiple values;the index number is used to indicate which specific value we wish to view.

(7)

Reading a MIB file

Format

         First line defines the SNMP prefix  

         /usr/share/snmp/mibs/HOST-RESOURCES-MIB.txt

第一行定义snmp的前缀

(8)

Using SNMP v1 for queries

Uniform syntax per snmpcmd(1)

Snmpwalk –v1 –c rh442 localhost

Snmpget -v1 –c rh442 localhost IP-MIB::ipForwarding.0

Using SNMP v3 for queries

Query must include

         .Security level(auth,priv,authPriv,authNoPriv)

         .if auth is used:username,password,and type of hash

         .if priv is used:shared secret and type of encryption

Snmpget –v3 localhost IP-MIB::ipForwarding.0 \

 -l authPriv –u demouser –A redhatrocks –a sha –X redhatrocks –X AES

译文：

使用SNMP V1查询：

         Snmpwalk –v1 –c rh442 localhost

使用SNMP V3查询：

         安全级别：auth，priv，authPriv，authNoPriv

         如果使用auth：username，password，哈希类型

         如果使用priv：shared secret，加密的类型

注意：我们使用服务器端进行查询时，需要使用上面的语法，但是可以通过修改客户端的配置文件来进行修正语法，是语法比较简洁

客户端的配置如下：

/etc/snmp/snmp.conf

defversion         3

defsecurityname       demouser

defsecuritylevel         authPriv

defauthtype               SHA

defauthpassphrase redhatrocks

defprivtype                 AES

defprivpassphrase    redhatrocks

查询时使用下面的语法：

Snmpget localhost IP-MIB::ipForwarding.0

(9)

SNMP支持TCP wrapper

可以实现访问控制

(10)

Configuring SNMP v1 access

         .edit /etc/snmp/snmpd.conf

#ro_versus_rw          shared_secret          [source_spec            [oid_spec]]

rocommunity             rh442                          192.168.0.0/4           .1

rocommunity             not_secret                 192.168.0.0/255. 255. 255.0 .1

rwcommunity            dangerous

         .Or use an interactive tool

Snmpconf

配置SNMP v1的访问

两种方式：直接编辑配置文件或者使用交互式的工具snmpconf

(11)

Configuring SNMP v3 access

1.       stop snmpd

2.       create a user with password >=8 characters

net-snmp-config –create-snmpv3-user –ro \

-A redhatrocks –a sha –X redhatrocks –x AES demouser

3.       establish access controls in /etc/snmp/snmpd.conf

#define group and view

group demogroup usm demouser

view    demoview included .1

#map group to view using snmpd.conf as a guide

Access demogroup any auth exact demoview none none

4.       start snmpd

配置SNMPV3的访问

停止snmpd的服务

等等步骤！