HPN-ICF-SSH-MIB

All MIBs › HPN-ICF-SSH-MIB

Last Updated: 2014-02-20

Category: Domain: Security, Protocol: SSH, Vendor: H3C/HH3C, Vendor: HP/HPE

Description: Manages SSH server configuration, session monitoring, and public key management on HP/Comware devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HPN-ICF-SSH-MIB?

HPN-ICF-SSH-MIB is an HPE/H3C Comware ICF private MIB for configuring and monitoring the device's SSH server, along with related secure-access services SFTP, SCP, and Stelnet. It exposes server-wide scalars including hpnicfSSHServerVersion, CompatibleSSH1x, RekeyInterval, AuthRetries, AuthTimeout, individual enable flags for hpnicfSSHServerEnable, SFTPServerEnable, STelnetServerEnable, SCPServerEnable, an idle-timeout scalar for SFTP sessions, and a per-user configuration table (hpnicfSSHUserConfigTable/Entry) for public-key/user management. Its monitoring focus is management-plane software status: confirming SSH/SFTP/SCP/Stelnet services are enabled as intended, whether legacy SSHv1 compatibility is (undesirably) still on, and reviewing per-user key configuration for unauthorized access. Authentication-retry and timeout settings also matter for security posture, since overly permissive values can weaken brute-force resistance. It complements the standard SSH protocol (RFC 4251 et seq.) with vendor-specific management objects and is deployed on HPE/H3C Comware switches and routers administered via secure remote access. Engineers can download the HPN-ICF-SSH-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HPN-ICF-SSH-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HPE/H3C Comware switches
HPE/H3C Comware routers

Monitoring Examples

A security-conscious admin polls hpnicfSSHServerEnable, hpnicfSFTPServerEnable, and hpnicfSTelnetServerEnable to confirm only the intended secure-access services are running, and checks hpnicfSSHServerCompatibleSSH1x to ensure legacy insecure SSHv1 compatibility has not been left enabled. Reviewing hpnicfSSHUserConfigTable confirms which user accounts have configured public keys for SSH login, and unusually low hpnicfSSHServerAuthRetries/AuthTimeout values would be flagged as weakening resistance to brute-force login attempts.

What Can Be Monitored

SSH/SFTP/SCP/Stelnet server enable status
SSH protocol version/compatibility mode
authentication retry count and timeout
per-user SSH key configuration
SSH rekey interval

Imported Objects

From HPN-ICF-OID-MIB

hpnicfCommon

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpnicfSSH	1.3.6.1.4.1.11.2.14.11.15.2.22			This MIB is used to configure SSH server.
hpnicfSSHServerMIB	1.3.6.1.4.1.11.2.14.11.15.2.22.1
hpnicfSSHServerMIBObjects	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1
hpnicfSSHServerGlobalConfig	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1
STR hpnicfSSHServerVersion	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.1	DisplayString	read-only	The protocol version of the SSH server.
INT hpnicfSSHServerCompatibleSSH1x	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.2	INTEGER	read-write	Supporting compatibility with SSH versions 1.x. It is known that there are still devices using the previous versions. During the transition period, it is important to be able to work in a way that is compatible with the installed SSH clients and servers that use the older version of the protocol.
I32 hpnicfSSHServerRekeyInterval	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.3	Integer32	read-write	The time interval of regenerating SSH server key. The unit is hour.
I32 hpnicfSSHServerAuthRetries	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.4	Integer32	read-write	The limit times of a specified user can retry.
I32 hpnicfSSHServerAuthTimeout	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.5	Integer32	read-write	The SSH server has a timeout for authentication and disconnect if the authentication has not been accepted within the timeout period. The unit is second.
I32 hpnicfSFTPServerIdleTimeout	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.6	Integer32	read-write	The SFTP server has a timeout for idle connection if a user has no activities within the timeout period. The unit is minute.
INT hpnicfSSHServerEnable	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.7	INTEGER	read-write	Enable SSH server function.
INT hpnicfSFTPServerEnable	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.8	INTEGER	read-write	Enable SFTP server function.
INT hpnicfSTelnetServerEnable	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.9	INTEGER	read-write	Enable STelnet server function.
INT hpnicfSCPServerEnable	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.1.10	INTEGER	read-write	Enable SCP server function.
hpnicfSSHUserConfig	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.2
hpnicfSSHUserConfigTable	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.2.1		not-accessible	A table for managing SSH users.
hpnicfSSHUserConfigEntry	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.2.1.1		not-accessible	SSH users configuration entry.
STR hpnicfSSHUserName	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.2.1.1.1	DisplayString	not-accessible	The name of SSH user.
INT hpnicfSSHUserServiceType	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.2.1.1.2	INTEGER	read-create	The service type of SSH user uses.
INT hpnicfSSHUserAuthType	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.2.1.1.3	INTEGER	read-create	The authentication type of SSH user chooses.
STR hpnicfSSHUserPublicKeyName	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.2.1.1.4	DisplayString	read-create	The public key which is used for authentication.
STR hpnicfSSHUserWorkDirectory	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.2.1.1.5	DisplayString	read-create	The SFTP user's work directory associates with an existing user.
ROW hpnicfSSHUserRowStatus	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.2.1.1.6	RowStatus	read-create	The row status variable, used in accordance to installation and removal conventions for conceptual rows. When the `hpnicfSSHUserRowStatus' is set to active(1), no objects in this table can be modified. When 'hpnicfSSHUserRowStatus' is set to notInService(2), every object except the 'hpnicfSSHUserName' object in this table can be modified. To create a row in this table, a manager must set this object to createAndGo(4). Until instances of all corresponding columns are appropriately configured, the value of the corresponding instance of the hpnicfSSHUserRowStatus column is 'notReady'.
hpnicfSSHSessionInfoTable	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3		not-accessible	A table for SSH sessions.
hpnicfSSHSessionInfoEntry	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3.1		not-accessible	The SSH session information entry.
I32 hpnicfSSHSessionID	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3.1.1	Integer32	not-accessible	The identifier of SSH session.
STR hpnicfSSHSessionUserName	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3.1.2	DisplayString	read-only	The user name of SSH session.
IPt hpnicfSSHSessionUserIpAddrType	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3.1.3	InetAddressType	read-only	The user IP address type of SSH session.
IP hpnicfSSHSessionUserIpAddr	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3.1.4	InetAddress	read-only	The user IP address of SSH session.
STR hpnicfSSHSessionClientVersion	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3.1.5	DisplayString	read-only	The client version of SSH session. It is known that there are still devices using the previous versions.
INT hpnicfSSHSessionServiceType	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3.1.6	INTEGER	read-only	The service type of SSH session.
INT hpnicfSSHSessionEncry	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3.1.7	INTEGER	read-only	The encryption algorithm of SSH session. There are several encryption algorithms used in SSH protocol, please refer to RFC4253 Section 6.3.
INT hpnicfSSHSessionState	1.3.6.1.4.1.11.2.14.11.15.2.22.1.1.3.1.8	INTEGER	read-only	The status of SSH session. init : This session is in initial status. verExchange : This session is in version exchanging. keysExchange : This session is in keys exchanging. authRequest : This session is in authentication requesting. serviceRequest : This session is in service requesting. established : This session has been established. disconnected : This session has been disconnected.
hpnicfSSHServerObjForTrap	1.3.6.1.4.1.11.2.14.11.15.2.22.1.2
STR hpnicfSSHAttemptUserName	1.3.6.1.4.1.11.2.14.11.15.2.22.1.2.1	DisplayString	accessible-for-notify	The user name of the attacker who attempted to log in.
IPt hpnicfSSHAttemptIpAddrType	1.3.6.1.4.1.11.2.14.11.15.2.22.1.2.2	InetAddressType	accessible-for-notify	The IP address type of the attacker who attempted to log in.
IP hpnicfSSHAttemptIpAddr	1.3.6.1.4.1.11.2.14.11.15.2.22.1.2.3	InetAddress	accessible-for-notify	The IP address of the attacker who attempted to log in.
INT hpnicfSSHUserAuthFailureReason	1.3.6.1.4.1.11.2.14.11.15.2.22.1.2.4	INTEGER	accessible-for-notify	The reason for that a user failed to log in.
hpnicfSSHServerNotifications	1.3.6.1.4.1.11.2.14.11.15.2.22.1.3
hpnicfSSHServerNotificationsPrefix	1.3.6.1.4.1.11.2.14.11.15.2.22.1.3.0
NTF hpnicfSSHUserAuthFailure	1.3.6.1.4.1.11.2.14.11.15.2.22.1.3.0.1			The trap is generated when a user fails to authentication.
NTF hpnicfSSHVersionNegotiationFailure	1.3.6.1.4.1.11.2.14.11.15.2.22.1.3.0.2			The trap is generated when a user fails to negotiate SSH protocol version.
NTF hpnicfSSHUserLogin	1.3.6.1.4.1.11.2.14.11.15.2.22.1.3.0.3			The trap is generated when a user logs in successfully.
NTF hpnicfSSHUserLogoff	1.3.6.1.4.1.11.2.14.11.15.2.22.1.3.0.4			The trap is generated when a user logs off.

RFC description

Manages SSH server configuration on HP/Hewlett-Packard devices including version compatibility, user authentication, and session parameters.

Start monitoring HPE/H3C Comware switch or router (SSH/SFTP/SCP/Stelnet server) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HPN-ICF-SSH-MIB

What Is HPN-ICF-SSH-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description