SNMP_USM(3)

💅 SNMP_USM(3) — the user-based security module for bsnmpd(1), bestie

okay so this is a library functions manual page, and it's all about snmp_usm — the vibe is security module, the energy is immaculate, the library is literally (begemotSnmpdModulePath."usm" = /usr/lib/snmp_usm.so). 🎀

---

✨ NAME ✨

snmp_usm — the user-based security module for bsnmpd(1). that's it, that's the name, no cap.

---

🌸 LIBRARY 🌸

(begemotSnmpdModulePath."usm" = /usr/lib/snmp_usm.so)

like, that's where it lives. she has an address, she's that girl. 💖

---

🦋 DESCRIPTION 🦋

so the snmp_usm module implements the SNMPv3 User-Based Security Model MIB exactly as defined in RFC 3414. periodt.

the module is the one that manages the internal list of SNMPv3 USM active users inside bsnmpd. and here's the thing, bestie — this module must be loaded for bsnmpd to receive and process SNMPv3 USM PDUs correctly. no module, no PDUs. it's giving essential. 🔥

---

👑 IMPLEMENTATION NOTES 👑

a short little description of the objects in the MIB follows — buckle up, we're going through them one by one. 🫶

• usmStats — this subtree contains the statistics for the User-based Security Model PDU processing. and heads up: the statistics are reset each time the module is loaded. so yeah, reload = clean slate, no notes. 💀
• usmUserSpinLock — an advisory lock used to coordinate several Command Generator Applications when they're altering the SNMP USM users. it's the group-chat moderator of locks, honestly.
• usmUserTable — the table that contains all the SNMP USM users configured in bsnmpd. and she contains the following objects:
  • usmUserEngineID — an SNMP engine's administratively-unique identifier. it must be set to the same Engine ID as bsnmpd so that the user will actually be allowed to communicate with the daemon. this column is used as the entry key and is not accessible for GET or SET operations. look but don't touch? no babe, you can't even look. 🙈
  • usmUserName — the USM user name. it's the second entry key, and again, not accessible for GET or SET operations.
  • usmUserSecurityName — this column has the exact same value as the usmUserName column, however it is accessible for GET operations. iconic of her honestly.
  • usmUserCloneFrom — a GET on this column will return an empty OID. SET operations are currently not supported. it's giving read-only energy. 💅
  • usmUserAuthProtocol — the value of this column contains the OID corresponding to the authentication protocol used by the USM user. the following protocols and their OIDs are known to the snmp_usm module:
    • NoAuthProtocol — 1.3.6.1.6.3.10.1.1.1
    • HMACMD5AuthProtocol — 1.3.6.1.6.3.10.1.1.2
    • HMACSHAAuthProtocol — 1.3.6.1.6.3.10.1.1.3
  • usmUserAuthKeyChange, usmUserOwnAuthKeyChange — these columns may be used to change the user's authentication key. key glow-up, basically. 🔑
  • usmUserPrivProtocol — the value of this column contains the OID corresponding to the privacy protocol used by the USM user. the following protocols and their OIDs are known to the snmp_usm module:
    • NoPrivProtocol — 1.3.6.1.6.3.10.1.2.1
    • DESPrivProtoco — 1.3.6.1.6.3.10.1.2.2
    • AesCfb128Protocol — 1.3.6.1.6.3.10.1.2.4

yep, it really is spelled DESPrivProtoco in here. not me fixing it — that's literally the name. copy it exactly, bestie. 🙈

• usmUserPrivKeyChange, usmUserOwnPrivKeyChange — these columns may be used to change the user's privacy key. privacy is self-care. 🌸
• usmUserPublic — an arbitrary octet string that may be modified to confirm a SET operation on any of the columns was successful. she's the little "ok it worked ✅" receipt.
• usmUserStorageType — this column always has either of two values:
  • entries created via bsnmpd's configuration file always have this column set to readOnly (5), and it is not possible to modify those entries.
  • entries created by Command Generator Applications always have this column set to volatile(2), and such entries are lost when the module is restarted.
  • a SET operation on this column is not allowed. periodt.
• usmUserStatus — this column is used to create new USM user entries or delete existing ones from the table. creation and destruction, the full circle of life. 🦋

---

🎀 FILES 🎀

• /usr/share/snmp/defs/usm_tree.def — the description of the MIB tree implemented by snmp_usm. like a little map of everything above. 🗺️

---

⭐ SEE ALSO ⭐

bsnmpd(1), gensnmptree(1), snmpmod(3)

go read those too, they're the supporting cast and they ate. 👑

---

🌈 STANDARDS 🌈

IETF RFC 3414

---

💜 AUTHORS 💜

Shteryana Shopova <syrinx@FreeBSD.org>

---

okay that's the whole page, bestie — go forth and secure those users 💅✨

Debian · September 9, 2010 · that's the source/version and date, mwah, love u, bye 🫶🎀