HH3C-SSH-MIB

All MIBs › HH3C-SSH-MIB

Organization: Hangzhou H3C Tech. Co., Ltd.

Last Updated: 2014-02-20

Category: Domain: Security, Protocol: SSH, Vendor: H3C/HH3C

Description: HH3C MIB for Secure Shell (SSH) server and client configuration on H3C devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-SSH-MIB?

HH3C-SSH-MIB is a private H3C enterprise MIB for configuring and monitoring the SSH, SFTP, SCP, and secure Telnet server subsystems on H3C network devices. It exposes configuration data such as protocol version compatibility, key rekey intervals, and authentication retry/timeout settings, as well as service-enablement flags and per-user SSH account configuration. Its monitoring value lies in confirming the software state of secure management services — whether the SSH/SFTP/SCP/secure-Telnet daemons are enabled and which authentication parameters are in effect — which is important for both operational access and security posture assurance rather than physical hardware status. It commonly complements H3C's user and AAA MIBs since SSH login ultimately maps to configured user accounts and access levels. This MIB is deployed on H3C routers and switches that support SSH-based secure remote management. Engineers can download the HH3C-SSH-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-SSH-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C routers
H3C switches

Monitoring Examples

An administrator can check hh3cSSHServerEnable, hh3cSFTPServerEnable, hh3cSCPServerEnable, and hh3cSTelnetServerEnable to confirm which secure management services are currently active on the device. hh3cSSHUserConfigTable (via hh3cSSHUserConfigEntry) lets them audit per-user SSH configuration, while hh3cSSHServerAuthRetries and hh3cSSHServerAuthTimeout reveal whether brute-force protection settings are tightened appropriately. A change in hh3cSSHServerRekeyInterval outside policy would flag a configuration drift worth investigating.

What Can Be Monitored

SSH server enabled status
SFTP/SCP/secure-Telnet service status
SSH protocol version compatibility
authentication retry count and timeout
per-user SSH configuration
key rekey interval

Imported Objects

From HH3C-OID-MIB

hh3cCommon

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
hh3cSSH	1.3.6.1.4.1.25506.2.22			This MIB is used to configure SSH server.
hh3cSSHServerMIB	1.3.6.1.4.1.25506.2.22.1
hh3cSSHServerMIBObjects	1.3.6.1.4.1.25506.2.22.1.1
hh3cSSHServerGlobalConfig	1.3.6.1.4.1.25506.2.22.1.1.1
STR hh3cSSHServerVersion	1.3.6.1.4.1.25506.2.22.1.1.1.1	DisplayString	read-only	The protocol version of the SSH server.
INT hh3cSSHServerCompatibleSSH1x	1.3.6.1.4.1.25506.2.22.1.1.1.2	INTEGER	read-write	Supporting compatibility with SSH versions 1.x. It is known that there are still devices using the previous versions. During the transition period, it is important to be able to work in a way that is compatible with the installed SSH clients and servers that use the older version of the protocol.
I32 hh3cSSHServerRekeyInterval	1.3.6.1.4.1.25506.2.22.1.1.1.3	Integer32	read-write	The time interval of regenerating SSH server key. The unit is hour.
I32 hh3cSSHServerAuthRetries	1.3.6.1.4.1.25506.2.22.1.1.1.4	Integer32	read-write	The limit times of a specified user can retry.
I32 hh3cSSHServerAuthTimeout	1.3.6.1.4.1.25506.2.22.1.1.1.5	Integer32	read-write	The SSH server has a timeout for authentication and disconnect if the authentication has not been accepted within the timeout period. The unit is second.
I32 hh3cSFTPServerIdleTimeout	1.3.6.1.4.1.25506.2.22.1.1.1.6	Integer32	read-write	The SFTP server has a timeout for idle connection if a user has no activities within the timeout period. The unit is minute.
INT hh3cSSHServerEnable	1.3.6.1.4.1.25506.2.22.1.1.1.7	INTEGER	read-write	Enable SSH server function.
INT hh3cSFTPServerEnable	1.3.6.1.4.1.25506.2.22.1.1.1.8	INTEGER	read-write	Enable SFTP server function.
INT hh3cSTelnetServerEnable	1.3.6.1.4.1.25506.2.22.1.1.1.9	INTEGER	read-write	Enable STelnet server function.
INT hh3cSCPServerEnable	1.3.6.1.4.1.25506.2.22.1.1.1.10	INTEGER	read-write	Enable SCP server function.
hh3cSSHUserConfig	1.3.6.1.4.1.25506.2.22.1.1.2
hh3cSSHUserConfigTable	1.3.6.1.4.1.25506.2.22.1.1.2.1		not-accessible	A table for managing SSH users.
hh3cSSHUserConfigEntry	1.3.6.1.4.1.25506.2.22.1.1.2.1.1		not-accessible	SSH users configuration entry.
STR hh3cSSHUserName	1.3.6.1.4.1.25506.2.22.1.1.2.1.1.1	DisplayString	not-accessible	The name of SSH user.
INT hh3cSSHUserServiceType	1.3.6.1.4.1.25506.2.22.1.1.2.1.1.2	INTEGER	read-create	The service type of SSH user uses.
INT hh3cSSHUserAuthType	1.3.6.1.4.1.25506.2.22.1.1.2.1.1.3	INTEGER	read-create	The authentication type of SSH user chooses.
STR hh3cSSHUserPublicKeyName	1.3.6.1.4.1.25506.2.22.1.1.2.1.1.4	DisplayString	read-create	The public key which is used for authentication.
STR hh3cSSHUserWorkDirectory	1.3.6.1.4.1.25506.2.22.1.1.2.1.1.5	DisplayString	read-create	The SFTP user's work directory associates with an existing user.
ROW hh3cSSHUserRowStatus	1.3.6.1.4.1.25506.2.22.1.1.2.1.1.6	RowStatus	read-create	The row status variable, used in accordance to installation and removal conventions for conceptual rows. When the `hh3cSSHUserRowStatus' is set to active(1), no objects in this table can be modified. When 'hh3cSSHUserRowStatus' is set to notInService(2), every object except the 'hh3cSSHUserName' object in this table can be modified. To create a row in this table, a manager must set this object to createAndGo(4). Until instances of all corresponding columns are appropriately configured, the value of the corresponding instance of the hh3cSSHUserRowStatus column is 'notReady'.
hh3cSSHSessionInfoTable	1.3.6.1.4.1.25506.2.22.1.1.3		not-accessible	A table for SSH sessions.
hh3cSSHSessionInfoEntry	1.3.6.1.4.1.25506.2.22.1.1.3.1		not-accessible	The SSH session information entry.
I32 hh3cSSHSessionID	1.3.6.1.4.1.25506.2.22.1.1.3.1.1	Integer32	not-accessible	The identifier of SSH session.
STR hh3cSSHSessionUserName	1.3.6.1.4.1.25506.2.22.1.1.3.1.2	DisplayString	read-only	The user name of SSH session.
IPt hh3cSSHSessionUserIpAddrType	1.3.6.1.4.1.25506.2.22.1.1.3.1.3	InetAddressType	read-only	The user IP address type of SSH session.
IP hh3cSSHSessionUserIpAddr	1.3.6.1.4.1.25506.2.22.1.1.3.1.4	InetAddress	read-only	The user IP address of SSH session.
STR hh3cSSHSessionClientVersion	1.3.6.1.4.1.25506.2.22.1.1.3.1.5	DisplayString	read-only	The client version of SSH session. It is known that there are still devices using the previous versions.
INT hh3cSSHSessionServiceType	1.3.6.1.4.1.25506.2.22.1.1.3.1.6	INTEGER	read-only	The service type of SSH session.
INT hh3cSSHSessionEncry	1.3.6.1.4.1.25506.2.22.1.1.3.1.7	INTEGER	read-only	The encryption algorithm of SSH session. There are several encryption algorithms used in SSH protocol, please refer to RFC4253 Section 6.3.
INT hh3cSSHSessionState	1.3.6.1.4.1.25506.2.22.1.1.3.1.8	INTEGER	read-only	The status of SSH session. init : This session is in initial status. verExchange : This session is in version exchanging. keysExchange : This session is in keys exchanging. authRequest : This session is in authentication requesting. serviceRequest : This session is in service requesting. established : This session has been established. disconnected : This session has been disconnected.
hh3cSSHServerObjForTrap	1.3.6.1.4.1.25506.2.22.1.2
STR hh3cSSHAttemptUserName	1.3.6.1.4.1.25506.2.22.1.2.1	DisplayString	accessible-for-notify	The user name of the attacker who attempted to log in.
IPt hh3cSSHAttemptIpAddrType	1.3.6.1.4.1.25506.2.22.1.2.2	InetAddressType	accessible-for-notify	The IP address type of the attacker who attempted to log in.
IP hh3cSSHAttemptIpAddr	1.3.6.1.4.1.25506.2.22.1.2.3	InetAddress	accessible-for-notify	The IP address of the attacker who attempted to log in.
INT hh3cSSHUserAuthFailureReason	1.3.6.1.4.1.25506.2.22.1.2.4	INTEGER	accessible-for-notify	The reason for that a user failed to log in.
hh3cSSHServerNotifications	1.3.6.1.4.1.25506.2.22.1.3
hh3cSSHServerNotificationsPrefix	1.3.6.1.4.1.25506.2.22.1.3.0
NTF hh3cSSHUserAuthFailure	1.3.6.1.4.1.25506.2.22.1.3.0.1			The trap is generated when a user fails to authentication.
NTF hh3cSSHVersionNegotiationFailure	1.3.6.1.4.1.25506.2.22.1.3.0.2			The trap is generated when a user fails to negotiate SSH protocol version.
NTF hh3cSSHUserLogin	1.3.6.1.4.1.25506.2.22.1.3.0.3			The trap is generated when a user logs in successfully.
NTF hh3cSSHUserLogoff	1.3.6.1.4.1.25506.2.22.1.3.0.4			The trap is generated when a user logs off.

RFC description

Configures and monitors SSH server settings including authentication and session management.

Start monitoring H3C router/switch (SSH/SFTP/SCP secure management server) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-SSH-MIB

What Is HH3C-SSH-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description