HPN-ICF-USER-MIB

All MIBs › HPN-ICF-USER-MIB

Last Updated: 2012-10-11

Category: RADIUS and AAA, Vendor: H3C/HH3C, Vendor: HP/HPE

Description: Manages local user accounts, privilege levels, and password policies for device access on HP/Comware devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HPN-ICF-USER-MIB?

HPN-ICF-USER-MIB is an HP/Comware ICF MIB for managing local user accounts used to authenticate administrative access to the device, covering usernames, passwords, authentication mode, privilege level, and account state. It exposes a user information table plus a related user-attribute table with access-limit settings, giving a full picture of who can log into the device and with what privileges. Its monitoring role is security/configuration auditing rather than hardware health: administrators verify which local accounts exist, their privilege level and enabled/disabled state, catching unauthorized or overprivileged accounts and confirming access-limit policies are enforced. It is a vendor-specific access-control MIB with no strong dependency on external standard MIBs, though it parallels concepts in the IETF SNMPv3 USM/VACM security model. It is deployed on HP/H3C Comware routers and switches wherever local (non-RADIUS/TACACS+) user accounts are used for device management, and administrators can download the HPN-ICF-USER-MIB file to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HPN-ICF-USER-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP/H3C Comware router or switch

Monitoring Examples

An administrator polls hpnicfUserInfoTable/hpnicfUserInfoEntry to list every hpnicfUserName along with its hpnicfUserLevel and hpnicfUserState, checking for unexpected accounts with an administrative privilege level. hpnicfAuthMode reveals whether an account authenticates locally or defers to an external mechanism, and hpnicfUserInfoRowStatus shows whether an entry is fully active. The hpnicfUserAttributeTable's hpnicfAccessLimit can be checked to confirm concurrent-login limits are enforced for a given account, flagging accounts that could allow unrestricted simultaneous sessions.

What Can Be Monitored

local user account list
user privilege level
account enabled/disabled state
authentication mode per user
concurrent access/login limit

Imported Objects

From HPN-ICF-OID-MIB

hpnicfCommon

OBJECT-IDENTITY

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DateAndTime
DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpnicfUser	1.3.6.1.4.1.11.2.14.11.15.2.12			This MIB contains objects to Manage configuration and Monitor running state for userlog feature.
hpnicfUserObjects	1.3.6.1.4.1.11.2.14.11.15.2.12.1
hpnicfUserInfoTable	1.3.6.1.4.1.11.2.14.11.15.2.12.1.1		not-accessible	Local User Info Table
hpnicfUserInfoEntry	1.3.6.1.4.1.11.2.14.11.15.2.12.1.1.1		not-accessible	The entry of hpnicfUserInfoTable
STR hpnicfUserName	1.3.6.1.4.1.11.2.14.11.15.2.12.1.1.1.1	DisplayString	read-create	The name of local user, it must be unique.
STR hpnicfUserPassword	1.3.6.1.4.1.11.2.14.11.15.2.12.1.1.1.2	DisplayString	read-create	The password of local user, default is null. When read, hpnicfUserPassword always returns an Octet String of length zero.
I32 hpnicfAuthMode	1.3.6.1.4.1.11.2.14.11.15.2.12.1.1.1.3	Integer32	read-create	The encrypting type of password: 0 : password simple, means password is entered in clean text and saved in cipher text. 1 : password hash simple, means password is entered in clean text and saved in hash value. 7 : password cipher, means password is entered and saved in cipher text. 8 : password hash cipher, means password is entered and saved in hash value. default is 0.
I32 hpnicfUserLevel	1.3.6.1.4.1.11.2.14.11.15.2.12.1.1.1.4	Integer32	read-create	The privilege of local user the value range is from 0 to 3, and 0 is minimum, 3 is maximum. default is 0.
INT hpnicfUserState	1.3.6.1.4.1.11.2.14.11.15.2.12.1.1.1.5	INTEGER	read-create	The state of local user 0: active, means local user can execute any operations that he has privilege to do. 1: block, means local user can not execute any operations. default is active.
ROW hpnicfUserInfoRowStatus	1.3.6.1.4.1.11.2.14.11.15.2.12.1.1.1.6	RowStatus	read-create	The status of this conceptual row. Now only support CreateAndGo and Destroy and Active.
I32 hpnicfUserIndex	1.3.6.1.4.1.11.2.14.11.15.2.12.1.1.1.7	Integer32	not-accessible	The index of local user
hpnicfUserAttributeTable	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2		not-accessible	Local User Attribute Table. if there are data in hpnicfUserInfoTable, this table should have the relevant data. this table only support query and modify, but not support create and delete operations.
hpnicfUserAttributeEntry	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1		not-accessible	The entry of hpnicfUserAttributeTable
I32 hpnicfAccessLimit	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.1	Integer32	read-write	The maximum user number of current user who can access devices. default is 0, means no limit.
I32 hpnicfIdleCut	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.2	Integer32	read-write	Valid idle time out(second), default is 0, means disable idle time out.
IP hpnicfIPAddress	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.3	IpAddress	read-write	Set local user's ip address. default is 0.0.0.0
IP hpnicfNasIPAddress	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.4	IpAddress	read-write	Set local user's ip address of network access server. default is 127.0.0.1, means local machine.
I32 hpnicfSlotNum	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.5	Integer32	read-write	Set local user's slot. default is 0.
I32 hpnicfSubSlotNum	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.6	Integer32	read-write	Set local user's sub-slot. default is 0.
I32 hpnicfPortNum	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.7	Integer32	read-write	Set local user's port number. 0 is an insignificant value for initial status.
MAC hpnicfMacAddress	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.8	MacAddress	read-write	Set local user's mac address. default is 0-0-0, means the local user do not bind any mac address.
I32 hpnicfVlan	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.9	Integer32	read-write	Set local user's vlan id. the value range is from 0 to 4094. default is 0, means the local user is not in any vlan.
SER hpnicfFtpService	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.10	ServiceType	read-write	FTP service: enable Setting this object to the value enable has the effect of enabling the FTP service for the corresponding entry in the hpnicfUserAttributeTable. disable Setting this object to the value disable has the effect of disabling the FTP service for the corresponding entry in the hpnicfUserAttributeTable. The default value is disable.
OCT hpnicfFtpDirectory	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.11	OCTET STRING	read-write	Directory of FTP user. default is null, means if local user has the privilege of ftp service.
SER hpnicfLanAccessService	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.12	ServiceType	read-write	Lan Access service: enable Setting this object to the value enable has the effect of enabling the lan access service for the corresponding entry in the hpnicfUserAttributeTable. disable Setting this object to the value disable has the effect of disabling the lan access service for the corresponding entry in the hpnicfUserAttributeTable. The default value is disable.
SER hpnicfSshService	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.13	ServiceType	read-write	SSH service: enable Setting this object to the value enable has the effect of enabling the SSH service for the corresponding entry in the hpnicfUserAttributeTable. disable Setting this object to the value disable has the effect of disabling the SSH service for the corresponding entry in the hpnicfUserAttributeTable. The default value is disable.
SER hpnicfTelnetService	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.14	ServiceType	read-write	Telnet service: enable Setting this object to the value enable has the effect of enabling the TELNET service for the corresponding entry in the hpnicfUserAttributeTable. disable Setting this object to the value disable has the effect of disabling the TELNET service for the corresponding entry in the hpnicfUserAttributeTable. The default value is disable.
SER hpnicfTerminalService	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.15	ServiceType	read-write	Terminal service: enable Setting this object to the value enable has the effect of enabling the terminal service for the corresponding entry in the hpnicfUserAttributeTable. disable Setting this object to the value disable has the effect of disabling the terminal service for the corresponding entry in the hpnicfUserAttributeTable. The default value is disable.
DAT hpnicfExpirationDate	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.16	DateAndTime	read-write	Expired date of user. The default value is 0-0-0,0:0:0.0, and means it doesn't expire for ever.
STR hpnicfUserGroup	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.17	DisplayString	read-write	The user group that user belongs to. Any user must belong to a user group. The default group is the 'system' group. The maximum length of the group name is 80.
SER hpnicfPortalService	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.18	ServiceType	read-write	Portal service: enable Setting this object to the value enable has the effect of enabling the portal service for the corresponding entry in the hpnicfUserAttributeTable. disable Setting this object to the value disable has the effect of disabling the portal service for the corresponding entry in the hpnicfUserAttributeTable. The default value is disable.
SER hpnicfPPPService	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.19	ServiceType	read-write	PPP service: enable Setting this object to the value enable has the effect of enabling the PPP service for the corresponding entry in the hpnicfUserAttributeTable. disable Setting this object to the value disable has the effect of disabling the PPP service for the corresponding entry in the hpnicfUserAttributeTable. The default value is disable.
SER hpnicfHttpService	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.20	ServiceType	read-write	Http service: enable Setting this object to the value enable has the effect of enabling the Web service for the corresponding entry in the hpnicfUserAttributeTable. disable Setting this object to the value disable has the effect of disabling the Web service for the corresponding entry in the hpnicfUserAttributeTable. The default value is disable.
SER hpnicfHttpsService	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.21	ServiceType	read-write	Https service: enable Setting this object to the value enable has the effect of enabling the Web service for the corresponding entry in the hpnicfUserAttributeTable. disable Setting this object to the value disable has the effect of disabling the Web service for the corresponding entry in the hpnicfUserAttributeTable. The default value is disable.
I32 hpnicfUserIfIndex	1.3.6.1.4.1.11.2.14.11.15.2.12.1.2.1.22	Integer32	read-write	Set local user's interface index. A value of 0 means that the interface index has not been assigned or the interface assigned not exist. The default value is 0.
I32 hpnicfUserMaxNum	1.3.6.1.4.1.11.2.14.11.15.2.12.1.3	Integer32	read-only	This object contains the maximum number of local users.
I32 hpnicfUserCurrNum	1.3.6.1.4.1.11.2.14.11.15.2.12.1.4	Integer32	read-only	This object contains the current number of local users.
I32 hpnicfUserIndexIndicator	1.3.6.1.4.1.11.2.14.11.15.2.12.1.5	Integer32	read-only	This object contains an appropriate value to be used for hpnicfUserIndex when creating entries in the hpnicfUserInfoTable. The value 0 indicates that no unassigned entries are available. To obtain the hpnicfUserIndex value for a new entry, the manager issues a management protocol retrieval operation to obtain the current value of this object. After each retrieval, the agent should modify the value to the next unassigned index. After a manager retrieves a value the agent will determine through its local policy when this index value will be made available for reuse.
hpnicfUserRoleTable	1.3.6.1.4.1.11.2.14.11.15.2.12.1.6		not-accessible	Local User Role Table. If there is data in hpnicfUserInfoTable, this table should has the relevant data.
hpnicfUserRoleEntry	1.3.6.1.4.1.11.2.14.11.15.2.12.1.6.1		not-accessible	The entry of hpnicfUserRoleTable.
STR hpnicfUserRole	1.3.6.1.4.1.11.2.14.11.15.2.12.1.6.1.1	DisplayString	not-accessible	The user's role determines the user's privilege. The user must be authorized one role at least. The default user role for a local user created by a network-admin user is network-operator, and the default user role for a local user created by an mdc-admin or level-15 user is mdc-operator.
ROW hpnicfUserRoleStatus	1.3.6.1.4.1.11.2.14.11.15.2.12.1.6.1.2	RowStatus	read-create	This object is responsible for managing the creation, deletion and modification of rows, which support active status and CreateAndGo, Destroy operation. To create a new row, hpnicfUserIndex must be specified. The number of rows with same hpnicfUserIndex cann't be more than 64. If the the number of rows with a hpnicfUserIndex is 1, this row cann't be destroyed.
hpnicfUserGroupObjects	1.3.6.1.4.1.11.2.14.11.15.2.12.2
hpnicfUserGroupInfoTable	1.3.6.1.4.1.11.2.14.11.15.2.12.2.1		not-accessible	User group information table.
hpnicfUserGroupInfoEntry	1.3.6.1.4.1.11.2.14.11.15.2.12.2.1.1		not-accessible	The entry of hpnicfUserGroupInfoTable.
STR hpnicfUserGroupName	1.3.6.1.4.1.11.2.14.11.15.2.12.2.1.1.1	DisplayString	not-accessible	The index of user group.
ROW hpnicfUserGroupInfoRowStatus	1.3.6.1.4.1.11.2.14.11.15.2.12.2.1.1.2	RowStatus	read-create	The status of this conceptual row. Only support createAndGo, destroy and active.

RFC description

Manages user configuration and monitoring for network devices, including user authentication and role-based access control.

Start monitoring HP/H3C Comware router or switch (local user account management) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HPN-ICF-USER-MIB

What Is HPN-ICF-USER-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description