H3C-SSH-MIB

All MIBs › H3C-SSH-MIB

Organization: Hangzhou H3C Tech. Co., Ltd.

Last Updated: 2007-11-19

Category: Protocol: SSH, Vendor: H3C/HH3C

Description: H3C MIB for SSH server and client management configuring authentication methods, keys, and session monitoring.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is H3C-SSH-MIB?

H3C-SSH-MIB is an H3C proprietary MIB for managing and monitoring the device's SSH and SFTP server/client subsystem, covering protocol version compatibility, rekey and authentication timing parameters, and per-user SSH configuration. It exposes scalars such as server version and SSH1.x compatibility mode, rekey interval, authentication retry count and timeout, SFTP idle timeout, and enable flags for the SSH and SFTP services, alongside a per-user configuration table. From a monitoring/security standpoint this MIB is valuable for confirming the remote-access service is enabled and correctly hardened (e.g. SSH1.x compatibility disabled, reasonable auth retry/timeout values) and for auditing which users are configured with SSH access and what service type they're granted. It is a self-contained vendor MIB with no strong external MIB dependency, operating alongside but independent of standard network-management MIBs. It is deployed across the H3C switch and router product line wherever SSH/SFTP remote management access is enabled. Engineers can download the H3C-SSH-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in H3C-SSH-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C switches and routers with SSH/SFTP management access

Monitoring Examples

An administrator would check h3cSSHServerEnable and h3cSFTPServerEnable to confirm which remote-access services are running, and inspect h3cSSHServerCompatibleSSH1x to verify the legacy, less-secure SSH1 protocol is disabled. Polling h3cSSHServerAuthRetries and h3cSSHServerAuthTimeout confirms brute-force protection settings, while h3cSSHUserConfigTable (h3cSSHUserConfigEntry), keyed by h3cSSHUserName, lets an operator audit each configured user's h3cSSHUserServiceType (e.g. SSH vs. SFTP access). h3cSSHServerRekeyInterval would be checked to ensure session keys are rotated within the organization's security policy window.

What Can Be Monitored

SSH/SFTP service enable state
SSH protocol compatibility mode
authentication retry/timeout settings
per-user SSH configuration
session rekey interval

Imported Objects

From HUAWEI-3COM-OID-MIB

h3cCommon

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
h3cSSH	1.3.6.1.4.1.2011.10.2.22			The initial version.
h3cSSHServerMIB	1.3.6.1.4.1.2011.10.2.22.1
h3cSSHServerMIBObjects	1.3.6.1.4.1.2011.10.2.22.1.1
h3cSSHServerGlobalConfig	1.3.6.1.4.1.2011.10.2.22.1.1.1
STR h3cSSHServerVersion	1.3.6.1.4.1.2011.10.2.22.1.1.1.1	DisplayString	read-only	The protocol version of the SSH server.
INT h3cSSHServerCompatibleSSH1x	1.3.6.1.4.1.2011.10.2.22.1.1.1.2	INTEGER	read-write	Supporting compatibility with SSH versions 1.x. It is known that there are still devices using the previous versions. During the transition period, it is important to be able to work in a way that is compatible with the installed SSH clients and servers that use the older version of the protocol.
I32 h3cSSHServerRekeyInterval	1.3.6.1.4.1.2011.10.2.22.1.1.1.3	Integer32	read-write	The time interval of regenerating SSH server key. The unit is hour.
I32 h3cSSHServerAuthRetries	1.3.6.1.4.1.2011.10.2.22.1.1.1.4	Integer32	read-write	The limit times of a specified user can retry.
I32 h3cSSHServerAuthTimeout	1.3.6.1.4.1.2011.10.2.22.1.1.1.5	Integer32	read-write	The SSH server has a timeout for authentication and disconnect if the authentication has not been accepted within the timeout period. The unit is second.
I32 h3cSFTPServerIdleTimeout	1.3.6.1.4.1.2011.10.2.22.1.1.1.6	Integer32	read-write	The SFTP server has a timeout for idle connection if a user has no activities within the timeout period. The unit is minute.
INT h3cSSHServerEnable	1.3.6.1.4.1.2011.10.2.22.1.1.1.7	INTEGER	read-write	Enable SSH server function.
INT h3cSFTPServerEnable	1.3.6.1.4.1.2011.10.2.22.1.1.1.8	INTEGER	read-write	Enable SFTP server function.
h3cSSHUserConfig	1.3.6.1.4.1.2011.10.2.22.1.1.2
h3cSSHUserConfigTable	1.3.6.1.4.1.2011.10.2.22.1.1.2.1		not-accessible	A table for managing SSH users.
h3cSSHUserConfigEntry	1.3.6.1.4.1.2011.10.2.22.1.1.2.1.1		not-accessible	SSH users configuration entry.
STR h3cSSHUserName	1.3.6.1.4.1.2011.10.2.22.1.1.2.1.1.1	DisplayString	not-accessible	The name of SSH user.
INT h3cSSHUserServiceType	1.3.6.1.4.1.2011.10.2.22.1.1.2.1.1.2	INTEGER	read-create	The service type of SSH user uses.
INT h3cSSHUserAuthType	1.3.6.1.4.1.2011.10.2.22.1.1.2.1.1.3	INTEGER	read-create	The authentication type of SSH user chooses.
STR h3cSSHUserPublicKeyName	1.3.6.1.4.1.2011.10.2.22.1.1.2.1.1.4	DisplayString	read-create	The public key which is used for authentication.
STR h3cSSHUserWorkDirectory	1.3.6.1.4.1.2011.10.2.22.1.1.2.1.1.5	DisplayString	read-create	The SFTP user's work directory associates with an existing user.
ROW h3cSSHUserRowStatus	1.3.6.1.4.1.2011.10.2.22.1.1.2.1.1.6	RowStatus	read-create	The row status variable, used in accordance to installation and removal conventions for conceptual rows. When the `h3cSSHUserRowStatus' is set to active(1), no objects in this table can be modified. When 'h3cSSHUserRowStatus' is set to notInService(2), every object except the 'h3cSSHUserName' object in this table can be modified. To create a row in this table, a manager must set this object to createAndGo(4). Until instances of all corresponding columns are appropriately configured, the value of the corresponding instance of the h3cSSHUserRowStatus column is 'notReady'.
h3cSSHSessionInfoTable	1.3.6.1.4.1.2011.10.2.22.1.1.3		not-accessible	A table for SSH sessions.
h3cSSHSessionInfoEntry	1.3.6.1.4.1.2011.10.2.22.1.1.3.1		not-accessible	The SSH session information entry.
I32 h3cSSHSessionID	1.3.6.1.4.1.2011.10.2.22.1.1.3.1.1	Integer32	not-accessible	The identifier of SSH session.
STR h3cSSHSessionUserName	1.3.6.1.4.1.2011.10.2.22.1.1.3.1.2	DisplayString	read-only	The user name of SSH session.
IPt h3cSSHSessionUserIpAddrType	1.3.6.1.4.1.2011.10.2.22.1.1.3.1.3	InetAddressType	read-only	The user IP address type of SSH session.
IP h3cSSHSessionUserIpAddr	1.3.6.1.4.1.2011.10.2.22.1.1.3.1.4	InetAddress	read-only	The user IP address of SSH session.
STR h3cSSHSessionClientVersion	1.3.6.1.4.1.2011.10.2.22.1.1.3.1.5	DisplayString	read-only	The client version of SSH session. It is known that there are still devices using the previous versions.
INT h3cSSHSessionServiceType	1.3.6.1.4.1.2011.10.2.22.1.1.3.1.6	INTEGER	read-only	The service type of SSH session.
INT h3cSSHSessionEncry	1.3.6.1.4.1.2011.10.2.22.1.1.3.1.7	INTEGER	read-only	The encryption algorithm of SSH session. There are several encryption algorithms used in SSH protocol, please refer to RFC4253 Section 6.3.
INT h3cSSHSessionState	1.3.6.1.4.1.2011.10.2.22.1.1.3.1.8	INTEGER	read-only	The status of SSH session. init : This session is in initial status. verExchange : This session is in version exchanging. keysExchange : This session is in keys exchanging. authRequest : This session is in authentication requesting. serviceRequest : This session is in service requesting. established : This session has been established. disconnected : This session has been disconnected.
h3cSSHServerObjForTrap	1.3.6.1.4.1.2011.10.2.22.1.2
STR h3cSSHAttemptUserName	1.3.6.1.4.1.2011.10.2.22.1.2.1	DisplayString	accessible-for-notify	The user name of the attacker who attempted to log in.
IPt h3cSSHAttemptIpAddrType	1.3.6.1.4.1.2011.10.2.22.1.2.2	InetAddressType	accessible-for-notify	The IP address type of the attacker who attempted to log in.
IP h3cSSHAttemptIpAddr	1.3.6.1.4.1.2011.10.2.22.1.2.3	InetAddress	accessible-for-notify	The IP address of the attacker who attempted to log in.
INT h3cSSHUserAuthFailureReason	1.3.6.1.4.1.2011.10.2.22.1.2.4	INTEGER	accessible-for-notify	The reason for that a user failed to log in.
h3cSSHServerNotifications	1.3.6.1.4.1.2011.10.2.22.1.3
h3cSSHServerNotificationsPrefix	1.3.6.1.4.1.2011.10.2.22.1.3.0
NTF h3cSSHUserAuthFailure	1.3.6.1.4.1.2011.10.2.22.1.3.0.1			The trap is generated when a user fails to authentication.
NTF h3cSSHVersionNegotiationFailure	1.3.6.1.4.1.2011.10.2.22.1.3.0.2			The trap is generated when a user fails to negotiate SSH protocol version.
NTF h3cSSHUserLogin	1.3.6.1.4.1.2011.10.2.22.1.3.0.3			The trap is generated when a user logs in successfully.
NTF h3cSSHUserLogoff	1.3.6.1.4.1.2011.10.2.22.1.3.0.4			The trap is generated when a user logs off.

RFC description

Configures and monitors SSH server functionality on H3C devices for secure remote management.

Start monitoring H3C switch/router (SSH/SFTP management access) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download H3C-SSH-MIB

What Is H3C-SSH-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description