NET-SNMP-VACM-MIB

All MIBs › NET-SNMP-VACM-MIB

Organization: www.net-snmp.org

Last Updated: 2006-08-27

Category: Net-SNMP and Linux

Description: Defines Net-SNMP extensions to the standard View-based Access Control Model (VACM) view table for fine-grained SNMP access control.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring NET-SNMP-VACM-MIB with a free 30-day trial of IPNetwork Monitor.

What Is NET-SNMP-VACM-MIB?

NET-SNMP-VACM-MIB is a Net-SNMP implementation-specific extension to the standard SNMPv3 View-based Access Control Model (VACM), adding a finer-grained access table beyond what RFC 3415's VACM-MIB provides. It exposes SNMP security/access-control configuration data: an access table mapping groups and contexts to authentication type, view name, storage type, and row status. Rather than hardware, this is a software/configuration-status MIB - it lets an administrator audit which access views and authentication types are currently active (via nsVacmStatus and nsVacmAuthType) to confirm the agent's security configuration matches intent. It explicitly extends and depends on the standard VACM-MIB (RFC 3415) and SNMP-FRAMEWORK-MIB definitions for its base access-control model. The NET-SNMP-VACM-MIB MIB is deployed on any Linux/Unix host running the Net-SNMP agent where administrators need more granular, context-aware access control than the standard VACM table alone offers.

IPNetwork Monitor allows you to monitor SNMP objects defined in NET-SNMP-VACM-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Linux/Unix host running the Net-SNMP agent
vendor-neutral SNMP access-control extension, not tied to specific hardware

Monitoring Examples

An administrator inspects nsVacmAccessTable/nsVacmAccessEntry rows, checking nsVacmStatus for active(1) entries and nsVacmViewName to confirm each group is bound to the intended read/write view. Discovering an nsVacmAccessEntry with an unexpectedly permissive nsVacmViewName or an nsVacmAuthType weaker than expected would reveal a security misconfiguration granting broader access than intended. nsVacmContextMatch and nsVacmStorageType round out the picture of how persistently and precisely each access rule is scoped.

What Can Be Monitored

access table row status (active/notReady)
authentication type per group
view name granted per context
storage type of access entries

Imported Objects

From NET-SNMP-MIB

netSnmpGroups	OBJECT-IDENTITY
netSnmpObjects	OBJECT-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMP-VIEW-BASED-ACM-MIB

vacmAccessContextPrefix	OBJECT-TYPE
vacmAccessSecurityLevel	OBJECT-TYPE
vacmAccessSecurityModel	OBJECT-TYPE
vacmGroupName	OBJECT-TYPE

From SNMPv2-CONF

NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
RowStatus
StorageType
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
netSnmpVacmMIB	1.3.6.1.4.1.8072.1.9			Defines Net-SNMP extensions to the standard VACM view table.
nsVacmAccessTable	1.3.6.1.4.1.8072.1.9.1		not-accessible	Net-SNMP extensions to vacmAccessTable.
nsVacmAccessEntry	1.3.6.1.4.1.8072.1.9.1.1		not-accessible	Net-SNMP extensions to vacmAccessTable.
STR nsVacmAuthType	1.3.6.1.4.1.8072.1.9.1.1.1	SnmpAdminString	not-accessible	The type of processing that the specified view should be applied to. See 'snmpd.conf(5)' and 'snmptrapd.conf(5)' for details.
INT nsVacmContextMatch	1.3.6.1.4.1.8072.1.9.1.1.2	INTEGER	read-create	If the value of this object is exact(1), then all rows where the contextName exactly matches vacmAccessContextPrefix are selected. If the value of this object is prefix(2), then all rows where the contextName whose starting octets exactly match vacmAccessContextPrefix are selected. This allows for a simple form of wildcarding. The value of this object should be consistent across all nsVacmAccessEntries corresponding to a single row of the vacmAccessTable.
STR nsVacmViewName	1.3.6.1.4.1.8072.1.9.1.1.3	SnmpAdminString	read-create	The MIB view authorised for the appropriate style of processing (as indicated by nsVacmToken). The interpretation of this value is the same as for the standard VACM ViewName objects.
STO nsVacmStorageType	1.3.6.1.4.1.8072.1.9.1.1.4	StorageType	read-create	The storage type for this (group of) conceptual rows. Conceptual rows having the value 'permanent' need not allow write-access to any columnar objects in the row. The value of this object should be consistent across all nsVacmAccessEntries corresponding to a single row of the vacmAccessTable.
ROW nsVacmStatus	1.3.6.1.4.1.8072.1.9.1.1.5	RowStatus	read-create	The status of this (group of) conceptual rows. The RowStatus TC [RFC2579] requires that this DESCRIPTION clause states under which circumstances other objects in this row can be modified: The value of this object has no effect on whether other objects in this conceptual row can be modified. The value of this object should be consistent across all nsVacmAccessEntries corresponding to a single row of the vacmAccessTable.

RFC description

Net-SNMP View Access Control Model extension MIB providing Net-SNMP-specific extensions to SNMP access control, allowing fine-grained SNMP security and view management.

Start monitoring Linux/Unix host running Net-SNMP agent (VACM access-control extension) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NET-SNMP-VACM-MIB

What Is NET-SNMP-VACM-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description