BRCM-SSH-MGMT-MIB

All MIBs › BRCM-SSH-MGMT-MIB

Organization: Broadcom Corporation

Last Updated: 2006-09-29

Category: Broadcom DOCSIS / Cable Modem, Security & Authentication

Description: Manages SSH server configuration including keys, sessions, and access control on Broadcom gateways.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is BRCM-SSH-MGMT-MIB?

BRCM-SSH-MGMT-MIB is a Broadcom enterprise MIB for managing the SSH server running on Broadcom-chipset residential/access gateways. It exposes SSH server control (enable/disable), configured usernames/passwords, active session details, a table of detected "hacker" (failed-login/intrusion) attempts, and the ability to force a user logout, alongside SSH-related trap notifications. Monitoring focus is security/software status of the management access path: administrators track active sessions and the hacker/failed-login table to detect brute-force or unauthorized access attempts, and confirm the SSH server control state is as expected. No dependency on other standard MIBs is evident; it is a self-contained Broadcom management extension. Deployment context is Broadcom-based broadband gateways/CPE devices where SSH is used for remote management and needs to be secured and monitored, which is exactly what BRCM-SSH-MGMT-MIB SNMP monitoring is designed to provide.

IPNetwork Monitor allows you to monitor SNMP objects defined in BRCM-SSH-MGMT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Broadcom-based broadband gateway/CPE

Monitoring Examples

An admin polls sshSessionIp and sshSessionInProgress to see who currently holds an active SSH session on the gateway. A growing sshHackerTable populated with unfamiliar sshHackerAddressType/sshSessionAddress entries indicates repeated failed login attempts, sshTraps would fire a notification for such events, and the admin can invoke sshForceUserLogout to terminate a suspicious session.

What Can Be Monitored

SSH server enable/control state
active SSH session IP/status
failed-login ("hacker") attempt records
configured SSH users

Imported Objects

From BRCM-CABLEDATA-MGMT-MIB

cableDataMgmtBase

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DisplayString
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
sshMgmt	1.3.6.1.4.1.4413.50.1.1.2.1.1.4			Broadcom SSH (Secure Shell) management MIB
BIT sshIpStackInterfaces	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.1	Bits	read-write	Controls and reflects the IP stack interfaces on which a ssh server is active.
STR sshUserName	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.2	DisplayString	read-write	Controls and reflects the user name which will be allowed ssh access.
STR sshPassword	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.3	DisplayString	read-write	Controls and reflects the password which will be allowed ssh access.
INT sshServerControl	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.4	INTEGER	read-write	Used to start or stop the ssh server. When read, indicates the current state of the server.
IP sshSessionIp	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.5	IpAddress	read-only	This object gives the IP address of the most recently connected device. If no session has taken place since the last reboot, this object will read 0.0.0.0.
T/F sshSessionInProgress	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.6	TruthValue	read-only	Indicates whether or not a ssh session is currently in progress.
T/F sshForceUserLogout	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.7	TruthValue	read-write	If a ssh session is currently in progress, setting this object to true(1) will terminate the session. Setting to false(2) has no effect. Always returns false(2) when read.
IPt sshSessionAddressType	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.8	InetAddressType	read-only	The type of internet address used for sshSessionAddress.
IP sshSessionAddress	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.9	InetAddress	read-only	This object gives the address of the most recently connected device. If no session has taken place since the last reboot, this object will report an empty string.
sshHackerTable	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.10		not-accessible	A table of internet addresses which have been blacklisted from ssh access on this station. Blacklisting occurs when a login attempt fails a number of times from the given address.
sshHackerEntry	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.10.1		not-accessible	An entry representing a single blacklisted address.
IPt sshHackerAddressType	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.10.1.1	InetAddressType	not-accessible	The type of internet address used for sshHackerAddress.
IP sshHackerAddress	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.10.1.2	InetAddress	not-accessible	The address of an device which has unsuccessfully attempted to log in to this station enough times to be blacklisted as a hacker.
U32 sshHackerNumAttempts	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.10.1.3	Unsigned32	read-only	The number of times that the device represented by this entry has attempted to log in to this station.
TIK sshHackerLastTime	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.10.1.4	TimeTicks	read-only	The value of sysUpTime when this row was created, or when the value of sshHackerNumAttempts was last incremented.
INT sshSessionInactivityTimeout	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.11	INTEGER	read-write	This object controls the length of time after which an ssh session will be terminated if there is no activity. Note that if this object is set to zero, the session will never be terminated due to inactivity.
INT sshHackerInactivityTimeout	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.12	INTEGER	read-write	This object controls the length of time after which an entry in the sshHackerTable will be removed if there are no further attempts to access the system from the corresponding sshHackerAddress. Note that if this object is set to zero, the sshHackerTable will be effectively disabled and no IP addresses will be blacklisted for unauthorized access. If set to -1, entries in the sshHackerTable will never be aged out and once blacklisted, only a system reboot will allow another attempted login from the blacklisted address.
sshTraps	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.99
NTF sshHackerTrap	1.3.6.1.4.1.4413.50.1.1.2.1.1.4.99.1			An entry has been added to the sshHackerTable, indicating repeated unauthorized login attempts by the device indicated.

RFC description

Broadcom Secure Shell (SSH) runtime management MIB for cable data devices.

Start monitoring Broadcom-chipset DOCSIS cable modems/gateways with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download BRCM-SSH-MGMT-MIB

What Is BRCM-SSH-MGMT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description