HM2-USERMGMT-MIB

All MIBs › HM2-USERMGMT-MIB

Organization: Hirschmann Automation and Control GmbH

Last Updated: 2011-03-16

Category: Device Management, Vendor: Belden

Description: Hirschmann HiOS (HM2) user management MIB for local user account and privilege configuration.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HM2-USERMGMT-MIB?

HM2-USERMGMT-MIB is a Hirschmann Automation and Control enterprise MIB (under the HM2-TC-MIB hm2ConfigurationMibs arc used across Hirschmann's HiOS-based switch line) that manages local user accounts and access-control configuration. Its central hm2UserConfigTable (indexed by hm2UserName) exposes hm2UserPassword (write-only, always reads back as masked), hm2UserAccessRole (an Hm2UserAccessRoles enumeration: guest, auditor, operator, administrator, and custom1-3 roles), hm2UserLockoutStatus, hm2UserPwdChangePerm, hm2UserPwdPolicyChk, and SNMPv3 auth/privacy type fields, with hm2UserStatus (RowStatus) controlling account lifecycle — creating a user here also provisions matching SNMPv3 USM entries. Companion groups (hm2PwdMgmtGroup, hm2UserApplicationListGroup, hm2UserAuthListGroup referencing an Hm2UserAuthList enumeration of local/radius/ias/cam/ldap/reject/none, and hm2UserIasGroup) round out password policy and authentication-method configuration across Web/CLI/SSH/SNMPv3 access. Because this is primarily an account/authorization MIB, monitoring it is most useful for auditing who has access at what privilege level and whether accounts are locked out, rather than performance counters. It depends on HM2-TC-MIB for shared Hirschmann textual conventions (including HmEnabledStatus) and SNMP-FRAMEWORK-MIB for SnmpAdminString, and it is deployed on Hirschmann HiOS-based industrial Ethernet switches; administrators can pull the HM2-USERMGMT-MIB MIB Browser output to confirm exact object names before scripting account audits.

IPNetwork Monitor allows you to monitor SNMP objects defined in HM2-USERMGMT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Hirschmann HiOS-based industrial Ethernet switches

Monitoring Examples

An operator polls hm2UserConfigTable to enumerate hm2UserName/hm2UserAccessRole pairs and checks hm2UserLockoutStatus for each account; an administrator-role account showing an unexpected locked-out status would indicate repeated failed login attempts that need investigating rather than an intentional access change.

What Can Be Monitored

local user account table entries
per-user access role/privilege level
account lockout status
password change permission and policy-check flags
SNMPv3 auth/privacy type per user
authentication method list (local/RADIUS/IAS/CAM/LDAP)

Imported Objects

From HM2-TC-MIB

HmEnabledStatus
hm2ConfigurationMibs	OBJECT-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
hm2UserMgmtMib	1.3.6.1.4.1.248.11.24			Hirschmann User and Password Management MIB. Copyright (C) 2011. All Rights Reserved.
hm2UserMgmtMibNotifications	1.3.6.1.4.1.248.11.24.0
NTF hm2UserCreatedTrap	1.3.6.1.4.1.248.11.24.0.1			This notification is send when a new user is added to the hm2UserConfigTable.
NTF hm2UserDeletedTrap	1.3.6.1.4.1.248.11.24.0.2			This notification is send when a user is deleted from the hm2UserConfigTable.
NTF hm2UserLockedTrap	1.3.6.1.4.1.248.11.24.0.3			This notification is send when a user is locked due to excessive failed login attempts.
NTF hm2UserPwdChangedTrap	1.3.6.1.4.1.248.11.24.0.4			This notification is send when a password for a user is changed.
NTF hm2UserPwdPolicyChkChangedTrap	1.3.6.1.4.1.248.11.24.0.5			This notification is send when the password policy for a user is changed.
hm2UserMgmtMibObjects	1.3.6.1.4.1.248.11.24.1
hm2UserConfigGroup	1.3.6.1.4.1.248.11.24.1.1
hm2UserConfigTable	1.3.6.1.4.1.248.11.24.1.1.1		not-accessible	User configuration table. This table provides the functionality the system uses for any interaction started by the user - authentication, encryption - changing authentication, password and access role for login purposes through Web, CLI, SSH, SNMPv3. For SNMPv3 the standard SNMPv3 authentication/encryption methods are used. To create a new user set hm2UserStatus to 'createAndWait, and set the corresponding objects to their values. Setting hm2UserStatus to 'active' activates the user. To delete a user, set hm2UserStatus to 'destroy'. Creating a new user in the hm2UserConfigTable always creates a new user in the SNMPv3 tables. The newly created SNMPv3 user will get the corresponding view in the SNMPv3 tables which matches to one of the given roles the user can have. All objects in this table can be set while a row is 'active'.
hm2UserConfigEntry	1.3.6.1.4.1.248.11.24.1.1.1.1		not-accessible	User configuration entry.
STR hm2UserName	1.3.6.1.4.1.248.11.24.1.1.1.1.1	SnmpAdminString	accessible-for-notify	Agent user name.
STR hm2UserPassword	1.3.6.1.4.1.248.11.24.1.1.1.1.2	DisplayString	read-create	Agent user password This object will always return '********' when read. The minimum size of the password is defined with the hm2PwdMgmtMinLength object. The user password can be set while the row is active.
HM2 hm2UserAccessRole	1.3.6.1.4.1.248.11.24.1.1.1.1.3	Hm2UserAccessRoles	read-create	Agent user's role. The user's role can be set while the row is active.
T/F hm2UserLockoutStatus	1.3.6.1.4.1.248.11.24.1.1.1.1.4	TruthValue	read-create	Displays whether the user account is locked due to excessive failed login attempts. If the user is locked out, the hm2UserLockoutStatus status is 'true'. Only a user with the administrator role can set this status back to 'false'.
T/F hm2UserPwdChangePerm	1.3.6.1.4.1.248.11.24.1.1.1.1.5	TruthValue	read-create	Displays whether the user is allowed to change his own password. Only a user with the administrator role can set this value.
HME hm2UserPwdPolicyChk	1.3.6.1.4.1.248.11.24.1.1.1.1.6	HmEnabledStatus	read-create	Displays whether the password policy check is enabled or not. The password policy check objects are defined in the hm2PwdMgmtGroup. Even if this object if set to 'disable' the size of a new password has to be at least the size of the hm2PwdMgmtMinLength object set. Only a user with the administrator role can set this value.
INT hm2UserSnmpAuthType	1.3.6.1.4.1.248.11.24.1.1.1.1.7	INTEGER	read-create	SNMPv3 user authentication. The user password must be set to a string greater than or equal to 8 characters for this to be set to anything but none(0). - hmacmd5(1) -> Use HMAC-MD5 authentication - hmacsha(2) -> Use HMAC-SHA authentication The user authentication type can be set while the row is active .
INT hm2UserSnmpEncType	1.3.6.1.4.1.248.11.24.1.1.1.1.8	INTEGER	read-create	SNMPv3 user encryption Can not be set to des(2) or aesCfb128(3) if hm2UserSnmpAuthenticationType is set to none(0). - none(0) -> no encryption used - des(1) -> DES encryption used - aesCfb128(2) -> AES-128 encryption used The user encryption type can be set while the row is active.
ROW hm2UserStatus	1.3.6.1.4.1.248.11.24.1.1.1.1.9	RowStatus	read-create	Agent user status. active(1) - This user account is active. notInService(2) - Row has been suspended. notReady(3) - Row has incomplete values. createAndGo(4) - Accept row values and activate. createAndWait(5) - Accept row values and wait. destroy(6) - Set to this value to remove this user account.
hm2UserStatusGroup	1.3.6.1.4.1.248.11.24.1.1.10
STR hm2UserLastUserCreated	1.3.6.1.4.1.248.11.24.1.1.10.1	SnmpAdminString	read-only	Name of the last user created in hm2UserConfigTable.
STR hm2UserLastUserDeleted	1.3.6.1.4.1.248.11.24.1.1.10.2	SnmpAdminString	read-only	Name of the last user deleted in hm2UserConfigTable.
hm2UserCustomGroup	1.3.6.1.4.1.248.11.24.1.1.20
hm2UserCustomAccessRole2NameTable	1.3.6.1.4.1.248.11.24.1.1.20.1		not-accessible	Custom based role to name mapping.
hm2UserCustomAccessRole2NameEntry	1.3.6.1.4.1.248.11.24.1.1.20.1.1		not-accessible	The hm2UserCustomAccessRole2NameEntry.
HM2 hm2UserCustomAccessRole	1.3.6.1.4.1.248.11.24.1.1.20.1.1.1	Hm2UserCustomAccessRoles	not-accessible	Custom based roles.
STR hm2UserCustomAccessRoleName	1.3.6.1.4.1.248.11.24.1.1.20.1.1.2	SnmpAdminString	read-write	Custom based role name.
ROW hm2UserCustomAccessRoleStatus	1.3.6.1.4.1.248.11.24.1.1.20.1.1.3	RowStatus	read-create	Custom-based role to name command row status. active(1) - This user account is active. notInService(2) - Row has been suspended. notReady(3) - Row has incomplete values. createAndGo(4) - Accept row values and activate. createAndWait(5) - Accept row values and wait. destroy(6) - Set to this value to remove this role to name entry.
hm2UserCustomCliCmdInheritTable	1.3.6.1.4.1.248.11.24.1.1.20.2		not-accessible	Base access role from which the custom-based CLI commands are inherited from.
hm2UserCustomCliCmdInheritEntry	1.3.6.1.4.1.248.11.24.1.1.20.2.1		not-accessible	The hm2UserCustomCliCmdInheritEntry.
HM2 hm2UserCustomCliBaseAccessRole	1.3.6.1.4.1.248.11.24.1.1.20.2.1.1	Hm2UserAccessRoles	read-create	The base access role the new CLI command is inherited from.
ROW hm2UserCustomCliBaseAccessRoleStatus	1.3.6.1.4.1.248.11.24.1.1.20.2.1.2	RowStatus	read-create	Custom-based CLI base access role command row status. active(1) - This user account is active. notInService(2) - Row has been suspended. notReady(3) - Row has incomplete values. createAndGo(4) - Accept row values and activate. createAndWait(5) - Accept row values and wait. destroy(6) - Set to this value to remove this role to name entry.
hm2UserCustomCliCmdTable	1.3.6.1.4.1.248.11.24.1.1.20.3		not-accessible	Table containing the custom-based CLI commands.
hm2UserCustomCliCmdEntry	1.3.6.1.4.1.248.11.24.1.1.20.3.1		not-accessible	The entries of the table.
HM2 hm2UserCustomCliExecMode	1.3.6.1.4.1.248.11.24.1.1.20.3.1.1	Hm2UserCliExecModes	not-accessible	CLI exec mode.
I32 hm2UserCustomCliIndex	1.3.6.1.4.1.248.11.24.1.1.20.3.1.2	Integer32	not-accessible	Index of the custom based CLI commands.
STR hm2UserCustomCliCommand	1.3.6.1.4.1.248.11.24.1.1.20.3.1.3	SnmpAdminString	read-create	The custom based CLI command to be assigned.
INT hm2UserCustomCliType	1.3.6.1.4.1.248.11.24.1.1.20.3.1.4	INTEGER	read-create	The custom based CLI command to be included or excluded in respect to the base role.
ROW hm2UserCustomCliStatus	1.3.6.1.4.1.248.11.24.1.1.20.3.1.5	RowStatus	read-create	Custom-based CLI command row status. active(1) - This user account is active. notInService(2) - Row has been suspended. notReady(3) - Row has incomplete values. createAndGo(4) - Accept row values and activate. createAndWait(5) - Accept row values and wait. destroy(6) - Set to this value to remove this CLI command entry.
hm2PwdMgmtGroup	1.3.6.1.4.1.248.11.24.1.2
I32 hm2PwdMgmtMinLength	1.3.6.1.4.1.248.11.24.1.2.1	Integer32	read-write	Minimum length for user passwords All new local user passwords must be at least this many characters in length.
I32 hm2PwdMgmtLoginAttempts	1.3.6.1.4.1.248.11.24.1.2.2	Integer32	read-write	The number of allowable failed local authentication attempts before the user's account is locked. A value of '0' indicates that user accounts will never be locked.
I32 hm2PwdMgmtMinUpperCase	1.3.6.1.4.1.248.11.24.1.2.3	Integer32	read-write	The number of minimum allowable uppercase letters in a password. Minimum of '0' means no restriction on that set of characters.
I32 hm2PwdMgmtMinLowerCase	1.3.6.1.4.1.248.11.24.1.2.4	Integer32	read-write	The number of minimum allowable lowercase letters in a password. Minimum of '0' means no restriction on that set of characters.
I32 hm2PwdMgmtMinNumericNumbers	1.3.6.1.4.1.248.11.24.1.2.5	Integer32	read-write	The number of minimum allowable numeric numbers in a password. Minimum of '0' means no restriction on that set of characters.
I32 hm2PwdMgmtMinSpecialCharacters	1.3.6.1.4.1.248.11.24.1.2.6	Integer32	read-write	The number of minimum allowable special characters in a password. Minimum of '0' means no restriction on that set of characters. The following special characters are allowed: !#$%&'()*+,-./:;?@[\\]^_`{}~
hm2PwdMgmtDefaultPwdStatusGroup	1.3.6.1.4.1.248.11.24.1.2.100
T/F hm2PwdMgmtDefaultPwdActive	1.3.6.1.4.1.248.11.24.1.2.100.1	TruthValue	read-only	Shows if one or more default passwords are active for users configured in the hm2UserConfigTable. The hm2PwdMgmtDefaultPwdStatusTable shows for which users the default password is currently actice.
hm2PwdMgmtDefaultPwdStatusTable	1.3.6.1.4.1.248.11.24.1.2.100.100		not-accessible	Table showing for which users defined in hm2UserConfigTable the default password has not been changed.
hm2PwdMgmtDefaultPwdStatusEntry	1.3.6.1.4.1.248.11.24.1.2.100.100.1		not-accessible	Entry.
I32 hm2PwdMgmtDefaultPwdStatusIndex	1.3.6.1.4.1.248.11.24.1.2.100.100.1.1	Integer32	not-accessible	Index for the table.
STR hm2PwdMgmtDefaultPwdStatusUserName	1.3.6.1.4.1.248.11.24.1.2.100.100.1.2	SnmpAdminString	read-only	The name of the default user for which the default password has not been changed.
hm2UserApplicationListGroup	1.3.6.1.4.1.248.11.24.1.3
hm2UserApplicationListTable	1.3.6.1.4.1.248.11.24.1.3.1		not-accessible	This table provides the functionality the system uses to assign an authentication list to an application. All objects in this table can be set while a row is 'active'.
hm2UserApplicationListEntry	1.3.6.1.4.1.248.11.24.1.3.1.1		not-accessible	Application list entry.
STR hm2UserApplicationListName	1.3.6.1.4.1.248.11.24.1.3.1.1.1	SnmpAdminString	not-accessible	Application list name.
STR hm2UserApplicationListAuthListName	1.3.6.1.4.1.248.11.24.1.3.1.1.6	SnmpAdminString	read-create	The authentication list used for this application to authenticate to the system. The application authentication list can be set while the row is active.
ROW hm2UserApplicationListStatus	1.3.6.1.4.1.248.11.24.1.3.1.1.7	RowStatus	read-create	Application row status. active(1) - This user account is active. notInService(2) - Row has been suspended. notReady(3) - Row has incomplete values. createAndGo(4) - Accept row values and activate. createAndWait(5) - Accept row values and wait. destroy(6) - Set to this value to remove this application list entry.
hm2UserAuthListGroup	1.3.6.1.4.1.248.11.24.1.4
hm2UserAuthListTable	1.3.6.1.4.1.248.11.24.1.4.1		not-accessible	The hm2UserAuthListTable holds up to 5 policies a user authenticates to the system.
hm2UserAuthListEntry	1.3.6.1.4.1.248.11.24.1.4.1.1		not-accessible	The hm2UserAuthListEntry.
STR hm2UserAuthListName	1.3.6.1.4.1.248.11.24.1.4.1.1.1	SnmpAdminString	not-accessible	Authentication list index. Unique name used for indexing into this table.
HM2 hm2UserAuthListPolicy1	1.3.6.1.4.1.248.11.24.1.4.1.1.2	Hm2UserAuthList	read-create	Authentication list policy 1. Configures the first authentication policy to use when this list is specified. - local -> authentication is done through local user database - radius -> authentication is done through a RADIUS server - ias -> authentication is done through a (i)ntegrated (a)uthentication (s)erver - cam -> authentication is done through a CAM server (via LDAP) - ldap -> authentication is done through a AD server (via LDAP) - reject -> authentication is rejected/not allowed. Note: If a policy is set to 'reject' further policies are ignored.
HM2 hm2UserAuthListPolicy2	1.3.6.1.4.1.248.11.24.1.4.1.1.3	Hm2UserAuthList	read-create	Authentication list policy 2. Configures the first authentication policy to use when this list is specified. - local -> authentication is done through local user database - radius -> authentication is done through a RADIUS server - ias -> authentication is done through a (i)ntegrated (a)uthentication (s)erver - cam -> authentication is done through a CAM server (via LDAP) - ldap -> authentication is done through a AD server (via LDAP) - reject -> authentication is rejected/not allowed Note: If a policy is set to 'reject' further policies are ignored.
HM2 hm2UserAuthListPolicy3	1.3.6.1.4.1.248.11.24.1.4.1.1.4	Hm2UserAuthList	read-create	Authentication list policy 3. Configures the first authentication policy to use when this list is specified. - local -> authentication is done through local user database - radius -> authentication is done through a RADIUS server - ias -> authentication is done through a (i)ntegrated (a)uthentication (s)erver - cam -> authentication is done through a CAM server (via LDAP) - ldap -> authentication is done through a AD server (via LDAP) - reject -> authentication is rejected/not allowed Note: If a policy is set to 'reject' further policies are ignored.
HM2 hm2UserAuthListPolicy4	1.3.6.1.4.1.248.11.24.1.4.1.1.5	Hm2UserAuthList	read-create	Authentication list policy 4. Configures the first authentication policy to use when this list is specified. - local -> authentication is done through local user database - radius -> authentication is done through a RADIUS server - ias -> authentication is done through a (i)ntegrated (a)uthentication (s)erver - cam -> authentication is done through a CAM server (via LDAP) - ldap -> authentication is done through a AD server (via LDAP) - reject -> authentication is rejected/not allowed Note: If a policy is set to 'reject' further policies are ignored.
HM2 hm2UserAuthListPolicy5	1.3.6.1.4.1.248.11.24.1.4.1.1.6	Hm2UserAuthList	read-create	Authentication list policy 5. Configures the first authentication policy to use when this list is specified. - local -> authentication is done through local user database - radius -> authentication is done through a RADIUS server - ias -> authentication is done through a (i)ntegrated (a)uthentication (s)erver - cam -> authentication is done through a CAM server (via LDAP) - ldap -> authentication is done through a AD server (via LDAP) - reject -> authentication is rejected/not allowed Note: If a policy is set to 'reject' further policies are ignored.
ROW hm2UserAuthListStatus	1.3.6.1.4.1.248.11.24.1.4.1.1.7	RowStatus	read-create	The status of the authentication list. active(1) - This entry is active. notInService(2) - Row has been suspended. notReady(3) - Row has incomplete values. createAndGo(4) - Accept row values and activate. createAndWait(5) - Accept row values and wait. destroy(6) - Set to this value to remove this authentication list.
hm2UserIasGroup	1.3.6.1.4.1.248.11.24.1.5
hm2UserIasTable	1.3.6.1.4.1.248.11.24.1.5.1		not-accessible	(I)ntegrated (A)uthentication (S)erver.
hm2UserIasEntry	1.3.6.1.4.1.248.11.24.1.5.1.1		not-accessible	The hm2UserIasEntry.
STR hm2UserIasUserName	1.3.6.1.4.1.248.11.24.1.5.1.1.1	SnmpAdminString	not-accessible	The (I)ntegrated (A)uthentication (S)erver user name.
STR hm2UserIasUserPassword	1.3.6.1.4.1.248.11.24.1.5.1.1.2	DisplayString	read-create	The (I)ntegrated (A)uthentication (S)erver user password. This object will always return '********' when read. The user password can be set while the row is active.
ROW hm2UserIasUserStatus	1.3.6.1.4.1.248.11.24.1.5.1.1.3	RowStatus	read-create	The status of the IAS users. active(1) - This entry is active. notInService(2) - Row has been suspended. notReady(3) - Row has incomplete values. createAndGo(4) - Accept row values and activate. createAndWait(5) - Accept row values and wait. destroy(6) - Set to this value to remove this IAS entry.
hm2UserMgmtMibSNMPExtensionGroup	1.3.6.1.4.1.248.11.24.3
hm2UserMgmtGlobalSESGroup	1.3.6.1.4.1.248.11.24.3.1
hm2UserMgmtGlobalSESLenCharset	1.3.6.1.4.1.248.11.24.3.1.1			Indicates that the chosen entry name uses not allowed character(s). Allowed are alphanumerical characters and name size from 1 to 32.
hm2UserMgmtGlobalSESPwdLenCharset	1.3.6.1.4.1.248.11.24.3.1.2			Indicates that the chosen password is incorrect. Check character set, length, policy matching (if password policy checker is enabled).
hm2UserMgmtUserSESGroup	1.3.6.1.4.1.248.11.24.3.2
hm2UserMgmtUserSESActivate	1.3.6.1.4.1.248.11.24.3.2.1			Indicates that the chosen user entry can not be activated. Be sure that a user password has been successfully set before.
hm2UserMgmtUserSESDeactivate	1.3.6.1.4.1.248.11.24.3.2.2			Indicates that the chosen user entry can not be deactivated. Be sure that this user is not the last active admin on the device.
hm2UserMgmtApplSESGroup	1.3.6.1.4.1.248.11.24.3.3
hm2UserMgmtApplSESAddDel	1.3.6.1.4.1.248.11.24.3.3.1			Indicates that the chosen entry can not be added or deleted. Notice that application lists can neither be added nor deleted.
hm2UserMgmtApplSESDeactivate	1.3.6.1.4.1.248.11.24.3.3.2			Indicates that the chosen entry can not be deactivated. Be sure that this list is not referenced to an authentication list (hm2UserApplicationListAuthListName has to be set to a zero length string).
hm2UserMgmtAuthSESGroup	1.3.6.1.4.1.248.11.24.3.4
hm2UserMgmtAuthSESDuplPolicy	1.3.6.1.4.1.248.11.24.3.4.1			Indicates that the chosen policy of this entry can not be set twice. Be sure that a policy is set only once per authentication list (exception: the policy 'reject' can be set several times).
hm2UserMgmtAuthSESDeactivate	1.3.6.1.4.1.248.11.24.3.4.2			Indicates that the chosen entry can not be deactivated. Be sure that this list is not referenced by an apllication list (hm2UserApplicationListAuthListName is not set to this authentication list name).

RFC description

Vendor-specific MIB for user management on Hirschmann (HM2) network devices; manages user accounts, authentication, access control, and permission settings.

Start monitoring Hirschmann HiOS industrial switch (local user account management) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HM2-USERMGMT-MIB

What Is HM2-USERMGMT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description