Previous Table of Contents Next


5.9 SNMPv2 Security

When SNMPv1 was first published (circa 1988), the community name and the version number in the SNMP header provided the only message security capabilities. This provision, known as the trivial protocol, assured that both agent and manager recognized the same community name before proceeding with network management operations.

Additional research into security issues yielded three documents on the subject, all released in July 1992:

RFC Title

1351 SNMP Administrative Model
1352 SNMP Security Protocols
1353 Definitions for Managed Objects for Administration of SNMP Parties

Further refinements of the above yielded three additional documents, all released in April 1993:

RFC Title

1445 Administrative Model for SNMPv2
1446 Security Protocols for SNMPv2
1447 Party MIB for SNMPv2

These RFCs were designed to address the authentication and privacy of network management communication. Authentication assures the appropriate origin of the message, while privacy protects the messages from disclosure. Unfortunately, implementing these enhancements proved to be more complex than either vendors or network managers anticipated; consequently, few products containing these improvements were developed. The result, SNMPv2C, with community-based security, has been the subject of this chapter.

Nevertheless, requirements for enhanced SNMP security exist. An administrative framework for SNMPv2, defined in the experimental RFC 1909 [5-10], describes how network management can be effective in a variety of configurations and environments, using various techniques such as authorization, authentication and privacy. In addition, two alternatives have been proposed to address the security aspects in particular. The first is called SNMPv2U, which stands for a User-based security model; it is described in the experimental RFC 1910 [5-11] and references [5-12] and [5-13]. The second is called SNMPv2* (pronounced SNMP vee-two-star), and is described in references [5-14] and [5-15]. As might be expected, both proposals have very vocal proponents. An IETF working group, called the SNMPv3 (formally called the SNMPng for next generation) working group is chartered with proposing a resolution; readers interested in following the discussion may wish to investigate Reference [5-16].

This chapter concludes our discussion of the three aspects of the Internet Network Management Framework. In Chapter 6, we will discuss the underlying transport protocols that are used in conjunction with SNMP for network management communication.

5.10 References

[5-1] Case, J.D., K. McCloghrie, M.T. Rose, and S.L. Waldbusser, “Introduction to version 2 of the Network Management Framework.” RFC 1441, April 1993.
[5-2] Case, J., K. McCloghrie, M. Rose,and S. Waldbusser, “Introduction to Community-based SNMPv2.” RFC 1901, January 1996.
[5-3] Case, J., K. McCloghrie, M. Rose, and S. Waldbusser, “Structure of Management Information for version 2 of the Simple Network Management Protocol (SNMPv2).” RFC 1902, January 1996.
[5-4] Case, J., K. McCloghrie, M. Rose, and S. Waldbusser, ‘Textual Conventions for version 2 of the Simple Network Management Protocol (SNMPv2).” RFC 1903, January 1996.
[5-5] Case, J., K. McCloghrie, M. Rose, and S. Waldbusser, “Conformance Statements for version 2 of the Simple Network Management Protocol (SNMPv2).” RFC 1904, January 1996.
[5-6]Case, J., K. McCloghrie, M. Rose, and S. Waldbusser, “Protocol Operations for version 2 of the Simple Network Management Protocol (SNMPv2).” RFC 1905, January 1996.
[5-7] Case, J., K. McCloghrie, M. Rose, and S. Waldbusser, “Transport Mappings for version 2 of the Simple Network Management Protocol (SNMPv2).” RFC 1906, January 1996.
[5-8] Case, J., K. McCloghrie, M. Rose, and S. Waldbusser, “Management Information Base for version 2 of the Simple Network Management Protocol (SNMPv2).” RFC 1907, January 1996.
[5-9] Case, J.D., K. McCloghrie, M.T. Rose, and S.L. Waldbusser. “Coexistence between version 1 and version 2 of the Internet-standard Network Management Framework.” RFC 1908, January 1996.
[5-10] McCloghrie, K., editor. “An Administrated Infrastructure for SNMPv2.” RFC 1909, February 1996.
[5-11] Waters, G., editor. “User-based Security Model for SNMPv2.” RFC 1910, February 1996.
[5-12] Waters, Glenn. “The User-based Security Model for SNMPv2.” ConneXions, the Interoperability Report (May 1996): 12–21.
[5-13] For further information on SNMPv2U, consult http://www.simple-times.orb/pub/simple-times/usec/, or subscribe to the SNMPv2U mailing list by sending an email to: usec-mib-request@fv.com.
[5-14] Partain, David. “An Introduction to SNMPv2*.” ConneXions, the Interoperability Report (May 1996): 22–33.
[5-15] For further information on SNMPv2*, consult http://www.snmp.com/v2star.html, or subscribe to the SNMPv2* mailing list by sending an email to: snmpv2star-request@snmp.com.
[5-16] For further information on SNMPv3, consult http://www.tis.com/docs/research/network/snmp-ng.html, or subscribe to the SNMPv3 mailing list by sending an email to: snmpv3-request@tis.com.


Previous Table of Contents Next