🚀 go-pugleaf

hi Gary,
Last time i checked it did SNMP in the clear which is real uncool
and this was about 6 months ago according to my best knowledge of 
this week;') it has not changed this way. The concept is sound and 
is quite a time saver and such but the security of the protocol sucks:'<
Enough said.

						Regards,
							dreamwvr@dreamwvr.com

At 03:12 PM 4/13/98 -0700, Gary Mills wrote:
>
>I was asked to look into security issues with HPopenview SNMP Agent.
>Does any one have any experience or advice on any known problems with 
>installing this agent on DMZ systems such as
>mail, web, ftp, firewall, etc... The idea is to monitor activity on these 
>external system and send traps to the internal Hpopenview system. Iam not 
>sure of the security of the agent or the daemons it may start.
>
>Gary Mills
>gary.mills@experian.com
>
>
>
>
>===========================================================================
=====
>     To unsubscribe from this mailing list, please see the instructions at
>               http://www.checkpoint.com/services/mailing.html
>===========================================================================
=====
>
>
_______________________________________________________________________

DREAMWVR.COM - TOTAL WEB INTEGRATION, DEVELOPMENT, DESIGN SERVICES. 
Featuring Website Development and Web Strategies of a TOP Developer 
<http://www.dreamwvr.com/dreambiz.htm> <mailto:dreamwvr@dreamwvr.com>
"As Unique as the Company You Keep."        "===0 PGP Key Available 
________________________________________________________________________
                                                                   

Yeah, SNMP v2* is pretty icky because of the plaintext passwords ("community
strings").  The SNMP v2c spec was supposed to address that little snarl, but
everyone seems to be working on SNMP v3, which  is supposedly "nearly out".

For SNMP v3 info, check out RFCs:
2271, 2272, 2273, 2274, and 2275

The site "http://www.snmp.com" isn't updated very much so there must be a better
source for that info.

bill


Gary Mills wrote:

> I was asked to look into security issues with HPopenview SNMP Agent.
> Does any one have any experience or advice on any known problems with
> installing this agent on DMZ systems such as
> mail, web, ftp, firewall, etc... The idea is to monitor activity on these
> external system and send traps to the internal Hpopenview system. Iam not
> sure of the security of the agent or the daemons it may start.
>
> Gary Mills
> gary.mills@experian.com
>
> ================================================================================
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
> ================================================================================



--
Bill Burns
Senior Security Engineer
Netscape Communications Corp.

--MoZhcV1D07fIPgaa
Content-Type: text/plain; charset=us-ascii

Gary,

SNMP is a dangerous protocol to have accessible on the public network
unless you have some assurance that the traffic can't be sniffed.  Your
probably aware of its many vulnerabilities (cleartext community strings,
many people never change their default community strings, UDP-based...)  

We offer a "secure SNMP" offering based on a firewallized 
(modified) version of SNMP Research's extensible agent architecture for 
our InterLock firewall.  This agent supports SNMPv2* which is encrypted/
authenticated SNMP.  The next problem is getting the management station
to speak SNMPv2*.  SNMP Research has an add-on module for OpenView to 
convert SNMPv1 and v2 to v2*.

The SNMPv2* protocol was one of the secure SNMP proposals for SNMPv2
(so its not just some proprietary protocol).  Unfortunately the battles
over how to secure SNMP were too great for the IETF process, so SNMPv2
was left with no additional security.  SNMPv3 looks more promising to
have some security, but in the meantime this is something you can do to
address your question until v3 stabilizes and products ship.

SNMP is really a handy protocol particularly if it can be done securely.
The InterLock has support for several MIBs including HR-MIB (processes,
disk, filesystems...), MIB-II (tcp/ip, interface stats) and a WWW MIB
which includes lots of neat WWW performance information as well as load.

You probably also want to lock down where traps can originate, as 
OpenView could be DOSed by trap storms if your not careful.  This could
probably be limited if your servers are on a 3rd leg of your firewall
and tight security policies are applied controlling the trap UDP packets.

Paul

On Mon, Apr 13, 1998 at 03:12:54PM -0700, Gary Mills wrote:
> I was asked to look into security issues with HPopenview SNMP Agent.
> Does any one have any experience or advice on any known problems with 
> installing this agent on DMZ systems such as
> mail, web, ftp, firewall, etc... The idea is to monitor activity on these 
> external system and send traps to the internal Hpopenview system. Iam not 
> sure of the security of the agent or the daemons it may start.
> 
> Gary Mills
> gary.mills@experian.com
> 
> 

-- 
_______________________________________________________________________
                            Paul Sangster 
 ANS Communications                       Senior Software Engineer
 1875 Campus Commons Dr.                  sangster@reston.ans.net
 Suite 220,  Reston VA 22091              http://www.ans.net/InterLock
_______________________________________________________________________

--MoZhcV1D07fIPgaa
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQB1AwUBNTNgnQrwW0NaS5JJAQHHfgMAxoUkVPeE3Tc1YZkOLYvatDctd/PvlMg0
jfCfDCv43IunWG2FpwsvnSQd01cZ1EQhnGfUKn+PtnkeOMYQiCVmXOjd3ZNuSuGG
he7u8zwXvboTccj7ASETNf7a9hMYowoG
=PDBC
-----END PGP SIGNATURE-----

--MoZhcV1D07fIPgaa--