All MIBs › RFC1353-MIB
Category: IETF Standards
Description: Defines SNMP security protocol management objects for authentication and privacy per RFC 1353.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is RFC1353-MIB?
RFC1353-MIB is the IETF standards-track MIB defining the SNMP Administrative Model's party-based security objects, part of the short-lived SNMPv2p (party-based) security framework that predated community-string and later USM/SNMPv3 security models. It defines objects describing SNMP 'parties' (security principals), their authentication and privacy protocol configuration, and access-control context information used to secure SNMP exchanges. It is a pure protocol/security-configuration MIB rather than a hardware or performance monitoring one: it would be used to verify which authentication/privacy algorithms and party identities are configured on an agent, not to track uptime, CPU, or environmental conditions. It is tightly coupled to the now-obsolete SNMPv2 party-based administrative and security framework defined in companion RFCs of that era, and has no relevance to the community-based or SNMPv3 USM security models used in virtually all modern deployments. It would only be found on legacy SNMPv2p-capable agents from the mid-1990s and has essentially no presence in modern production networks, making this RFC1353-MIB reference primarily of historical interest today.
IPNetwork Monitor allows you to monitor SNMP objects defined in RFC1353-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- vendor-neutral, standards-based MIB, not tied to a specific manufacturer
- legacy SNMPv2p-capable network devices (obsolete security model)
Monitoring Examples
No sample_objects were provided for this module, and as a security/administrative-model MIB rather than a device-status MIB it does not lend itself to a hardware or performance monitoring scenario; at most an operator would inspect party authentication/privacy protocol configuration objects to audit which security parameters an SNMPv2p agent had configured, but no concrete object names can be cited from the available source.
What Can Be Monitored
- configured party authentication protocol
- configured party privacy protocol
- party/security context configuration
This MIB depends on
Related MIBs
Imported Objects
From RFC-1212
| OBJECT-TYPE |
From RFC1213-MIB
| mib-2 | |
| system |
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| aclEntry | 1.3.6.1.2.1.21.2.1.1 | not-accessible | The access privileges for a particular requesting SNMP party in accessing a particular target SNMP party. | |
| INT aclPrivileges | 1.3.6.1.2.1.21.2.1.1.3 | INTEGER | read-write | The access privileges which govern what management operations a particular target party may perform when requested by a particular subject party. These privileges are specified as a sum of values, where each value specifies a SNMP PDU type by which the subject party may request a permitted operation. The value for a particular PDU type is computed as 2 raised to the value of the ASN.1 context-specific tag for the appropriate SNMP PDU type. The values (for the tags defined in RFC 1157) are defined in RFC 1351 as: Get : 1 GetNext : 2 GetResponse : 4 Set : 8 Trap : 16 The null set is represented by the value zero. |
| INT aclStatus | 1.3.6.1.2.1.21.2.1.1.4 | INTEGER | read-write | The status of the access privileges for a particular requesting SNMP party in accessing a particular target SNMP party. Setting an instance of this object to the value 'invalid(2)' has the effect of invalidating the corresponding access privileges. It is an implementation-specific matter as to whether the agent removes an invalidated entry from the table. Accordingly, management stations must be prepared to receive from agents tabular information corresponding to entries not currently in use. Proper interpretation of such entries requires examination of the relevant aclStatus object. |
| PAR aclSubject | 1.3.6.1.2.1.21.2.1.1.2 | Party | read-write | The subject SNMP party whose requests for management operations to be performed is constrained by this set of access privileges. |
| aclTable | 1.3.6.1.2.1.21.2.1 | not-accessible | The access privileges database. | |
| PAR aclTarget | 1.3.6.1.2.1.21.2.1.1.1 | Party | read-write | The target SNMP party whose performance of management operations is constrained by this set of access privileges. |
| desPrivProtocol | 1.3.6.1.2.1.20.1.1.4 | |||
| initialPartyId | 1.3.6.1.2.1.20.1.4 | |||
| md5AuthProtocol | 1.3.6.1.2.1.20.1.1.5 | |||
| noAuth | 1.3.6.1.2.1.20.1.1.1 | |||
| noPriv | 1.3.6.1.2.1.20.1.1.3 | |||
| noProxy | 1.3.6.1.2.1.20.1.3.1 | |||
| partyAccess | 1.3.6.1.2.1.21.2 | |||
| partyAdmin | 1.3.6.1.2.1.20.1 | |||
| CLO partyAuthClock | 1.3.6.1.2.1.20.2.1.1.6 | Clock | read-write | The authentication clock which represents the local notion of the current time specific to the party. This value must not be decremented unless the party's secret information is changed simultaneously, at which time the party's nonce and last-timestamp values must also be reset to zero, and the new value of the clock, respectively. |
| INT partyAuthLifetime | 1.3.6.1.2.1.20.2.1.1.8 | INTEGER | read-write | The lifetime (in units of seconds) which represents an administrative upper bound on acceptable delivery delay for protocol messages generated by the party. |
| OID partyAuthProtocol | 1.3.6.1.2.1.20.2.1.1.5 | OBJECT IDENTIFIER | read-write | The authentication protocol by which all messages generated by the party are authenticated as to origin and integrity. In this context, the value { noAuth } signifies that messages generated by the party are not authenticated. |
| OCT partyAuthPublic | 1.3.6.1.2.1.20.2.1.1.7 | OCTET STRING | read-write | A publically-readable value for the party. Depending on the party's authentication protocol, this value may be needed to support the party's authentication protocol. Alternatively, it may be used by a manager during the procedure for altering secret information about a party. (For example, by altering the value of an instance of this object in the same SNMP Set-Request used to update an instance of partyAuthPrivate, a subsequent Get-Request can determine if the Set- Request was successful in the event that no response to the Set-Request is received, see RFC 1352.) The length of the value is dependent on the party's authentication protocol. If not used by the authentication protocol, it is recommended that agents support values of any length up to and including the length of the corresponding partyAuthPrivate object. |
| partyEntry | 1.3.6.1.2.1.20.2.1.1 | not-accessible | Locally held non-secret information about a particular SNMP party, which is available for access by network management. Note that this does not include all locally held information about a party. In particular, it does not include the 'last-timestamp' (i.e., the timestamp of the last authentic message received) or the 'nonce' values. | |
| PAR partyIdentity | 1.3.6.1.2.1.20.2.1.1.1 | Party | read-write | A party identifier uniquely identifying a particular SNMP party. |
| INT partyMaxMessageSize | 1.3.6.1.2.1.20.2.1.1.11 | INTEGER | read-write | The maximum length in octets of a SNMP message which this party will accept. For parties which execute at an agent, the agent initializes this object to the maximum length supported by the agent, and does not let the object be set to any larger value. For parties which do not execute at the agent, the agent must allow the manager to set this object to any legal value, even if it is larger than the agent can generate. |
| partyPrivate | 1.3.6.1.2.1.21.1 | |||
| OID partyPrivProtocol | 1.3.6.1.2.1.20.2.1.1.9 | OBJECT IDENTIFIER | read-write | The privacy protocol by which all protocol messages received by the party are protected from disclosure. In this context, the value { noPriv } signifies that messages received by the party are not protected. |
| OCT partyPrivPublic | 1.3.6.1.2.1.20.2.1.1.10 | OCTET STRING | read-write | A publically-readable value for the party. Depending on the party's privacy protocol, this value may be needed to support the party's privacy protocol. Alternatively, it may be used by a manager as a part of its procedure for altering secret information about a party. (For example, by altering the value of an instance of this object in the same SNMP Set-Request used to update an instance of partyPrivPrivate, a subsequent Get-Request can determine if the Set-Request was successful in the event that no response to the Set-Request is received, see RFC 1352.) The length of the value is dependent on the party's privacy protocol. If not used by the privacy protocol, it is recommended that agents support values of any length up to and including the length of the corresponding partyPrivPrivate object. |
| partyProtocols | 1.3.6.1.2.1.20.1.1 | |||
| PAR partyProxyFor | 1.3.6.1.2.1.20.2.1.1.4 | Party | read-write | The identity of a second SNMP party or other management entity with which interaction may be necessary to satisfy received management requests. In this context, the distinguished value { noProxy } signifies that the party responds to received management requests by entirely local mechanisms. |
| partyPublic | 1.3.6.1.2.1.20.2 | |||
| OCT partySecretsAuthPrivate | 1.3.6.1.2.1.21.1.1.1.2 | OCTET STRING | read-write | An encoding of the party's private authentication key which may be needed to support the authentication protocol. Although the value of this variable may be altered by a management operation (e.g., a SNMP Set-Request), its value can never be retrieved by a management operation: when read, the value of this variable is the zero length OCTET STRING. The private authentication key is NOT directly represented by the value of this variable, but rather it is represented according to an encoding. This encoding is the bitwise exclusive-OR of the old key with the new key, i.e., of the old private authentication key (prior to the alteration) with the new private authentication key (after the alteration). Thus, when processing a received protocol Set operation, the new private authentication key is obtained from the value of this variable as the result of a bitwise exclusive-OR of the variable's value and the old private authentication key. In calculating the exclusive-OR, if the old key is shorter than the new key, zero-valued padding is appended to the old key. If no value for the old key exists, a zero-length OCTET STRING is used in the calculation. |
| partySecretsEntry | 1.3.6.1.2.1.21.1.1.1 | not-accessible | Locally held secret information about a particular SNMP party, which is available for access by network management. When a SNMP Set-Request is used to update the values of instances of objects in this table, it is recommended that the same SNMP Set-Request also alter the value of a non-secret object instance (e.g., an instance of partyAuthPublic or partyPrivPublic). This allows a Get-Request of that non-secret object instance to determine if the Set-Request was successful in the event that no response which matches the Set-Request is received, see RFC 1352. | |
| PAR partySecretsIdentity | 1.3.6.1.2.1.21.1.1.1.1 | Party | read-write | A party identifier uniquely identifying a particular SNMP party. |
| OCT partySecretsPrivPrivate | 1.3.6.1.2.1.21.1.1.1.3 | OCTET STRING | read-write | An encoding of the party's private encryption key which may be needed to support the privacy protocol. Although the value of this variable may be altered by a management operation (e.g., a SNMP Set-Request), its value can never be retrieved by a management operation: when read, the value of this variable is the zero length OCTET STRING. The private encryption key is NOT directly represented by the value of this variable, but rather it is represented according to an encoding. This encoding is the bitwise exclusive-OR of the old key with the new key, i.e., of the old private encryption key (prior to the alteration) with the new private encryption key (after the alteration). Thus, when processing a received protocol Set operation, the new private encryption key is obtained from the value of this variable as the result of a bitwise exclusive-OR of the variable's value and the old private encryption key. In calculating the exclusive-OR, if the old key is shorter than the new key, zero-valued padding is appended to the old key. If no value for the old key exists, a zero-length OCTET STRING is used in the calculation. |
| INT partySecretsStatus | 1.3.6.1.2.1.21.1.1.1.4 | INTEGER | read-write | The status of the locally-held information on a particular SNMP party. Setting an instance of this object to the value 'valid(1)' has the effect of ensuring that valid local knowledge exists for the corresponding party. For valid local knowledge to exist, there must be corresponding instances of each object in this table and in the partyTable. Thus, the creation of instances in the partyTable (but not in the aclTable or viewTable) occurs as a direct result of the creation of instances in this table. Setting an instance of this object to the value 'invalid(2)' has the effect of invalidating all local knowledge of the corresponding party, including the invalidating of any/all entries in the partyTable, the partySecretsTable, the aclTable, and the viewTable which reference said party. It is an implementation-specific matter as to whether the agent removes an invalidated entry from the table. Accordingly, management stations must be prepared to receive from agents tabular information corresponding to entries not currently in use. Proper interpretation of such entries requires examination of the relevant partySecretsStatus object. |
| partySecretsTable | 1.3.6.1.2.1.21.1.1 | not-accessible | The SNMP Party Secrets database. | |
| INT partyStatus | 1.3.6.1.2.1.20.2.1.1.12 | INTEGER | read-only | The status of the locally-held information on a particular SNMP party. The instance of this object for a particular party and the instance of partySecretsStatus for the same party always have the same value. This object will typically provide unrestricted read-only access to the status of parties. In contrast, partySecretsStatus will typically provide restricted read-write access to the status of parties. |
| partyTable | 1.3.6.1.2.1.20.2.1 | not-accessible | The SNMP Party Public database. An agent must ensure that there is, at all times, a one-to-one correspondence between entries in this table and entries in the partySecretsTable. The creation/deletion of instances in this table via SNMP Set-Requests is not allowed. Instead, entries in this table are created/deleted as a side-effect of the creation/deletion of corresponding entries in the partySecretsTable. Thus, a SNMP Set-Request whose varbinds contain a reference to a non-existent instance of a partyTable object, but no reference to the corresponding instance of a partySecretsTable object, will be rejected. | |
| ADR partyTAddress | 1.3.6.1.2.1.20.2.1.1.3 | TAddress | read-write | The transport service address by which the party receives network management traffic, formatted according to the corresponding value of partyTDomain. For rfc1351Domain, partyTAddress is formatted as a 4-octet IP Address concatenated with a 2-octet UDP port number. |
| OID partyTDomain | 1.3.6.1.2.1.20.2.1.1.2 | OBJECT IDENTIFIER | read-write | Indicates the kind of transport service by which the party receives network management traffic. An example of a transport domain is 'rfc1351Domain' (SNMP over UDP). |
| partyViews | 1.3.6.1.2.1.21.3 | |||
| proxyDomains | 1.3.6.1.2.1.20.1.3 | |||
| rfc1351Domain | 1.3.6.1.2.1.20.1.2.1 | |||
| snmpParties | 1.3.6.1.2.1.20 | |||
| snmpSecrets | 1.3.6.1.2.1.21 | |||
| transportDomains | 1.3.6.1.2.1.20.1.2 | |||
| viewEntry | 1.3.6.1.2.1.21.3.1.1 | not-accessible | Information on a particular family of view subtrees included in or excluded from a particular SNMP party's MIB view. | |
| OCT viewMask | 1.3.6.1.2.1.21.3.1.1.4 | OCTET STRING | read-write | The bit mask which, in combination with the corresponding instance of viewSubtree, defines a family of view subtrees. Each bit of this bit mask corresponds to a sub- identifier of viewSubtree, with the most significant bit of the i-th octet of this octet string value (extended if necessary, see below) corresponding to the (8*i - 7)-th sub-identifier, and the least significant bit of the i-th octet of this octet string corresponding to the (8*i)-th sub-identifier, where i is in the range 1 through 16. Each bit of this bit mask specifies whether or not the corresponding sub-identifiers must match when determining if an Object Identifier is in this family of view subtrees; a '1' indicates that an exact match must occur; a '0' indicates 'wild card', i.e., any sub-identifier value matches. Thus, the Object Identifier X of an object instance is contained in a family of view subtrees if the following criteria are met: for each sub-identifier of the value of viewSubtree, either: the i-th bit of viewMask is 0, or the i-th sub-identifier of X is equal to the i-th sub-identifier of the value of viewSubtree. If the value of this bit mask is M bits long and there are more than M sub-identifiers in the corresponding instance of viewSubtree, then the bit mask is extended with 1's to be the required length. Note that when the value of this object is the zero-length string, this extension rule results in a mask of all-1's being used (i.e., no 'wild card'), and the family of view subtrees is the one view subtree uniquely identified by the corresponding instance of viewSubtree. |
| PAR viewParty | 1.3.6.1.2.1.21.3.1.1.1 | Party | read-write | The SNMP party whose single MIB view includes or excludes a particular family of view subtrees. |
| INT viewStatus | 1.3.6.1.2.1.21.3.1.1.3 | INTEGER | read-write | The status of a particular family of view subtrees within the particular SNMP party's MIB view. The value 'included(1)' indicates that the corresponding instances of viewSubtree and viewMask define a family of view subtrees included in the MIB view. The value 'excluded(2)' indicates that the corresponding instances of viewSubtree and viewMask define a family of view subtrees excluded from the MIB view. Setting an instance of this object to the value 'invalid(3)' has the effect of invalidating the presence or absence of the corresponding family of view subtrees in the corresponding SNMP party's MIB view. It is an implementation-specific matter as to whether the agent removes an invalidated entry from the table. Accordingly, management stations must be prepared to receive from agents tabular information corresponding to entries not currently in use. Proper interpretation of such entries requires examination of the relevant viewStatus object. |
| OID viewSubtree | 1.3.6.1.2.1.21.3.1.1.2 | OBJECT IDENTIFIER | read-write | The view subtree which, in combination with the corresponding instance of viewMask, defines a family of view subtrees. This family is included in, or excluded from the particular SNMP party's MIB view, according to the value of the corresponding instance of viewStatus. |
| viewTable | 1.3.6.1.2.1.21.3.1 | not-accessible | The table contained in the local database which defines local MIB views. Each SNMP party has a single MIB view which is defined by two collections of view subtrees: the included view subtrees, and the excluded view subtrees. Every such subtree, both included and excluded, is defined in this table. To determine if a particular object instance is in a particular SNMP party's MIB view, compare the object instance's Object Identifier with each entry (for this party) in this table. If none match, then the object instance is not in the MIB view. If one or more match, then the object instance is included in, or excluded from, the MIB view according to the value of viewStatus in the entry whose value of viewSubtree has the most sub-identifiers. If multiple entries match and have the same number of sub-identifiers, then the lexicographically greatest instance of viewStatus determines the inclusion or exclusion. An object instance's Object Identifier X matches an entry in this table when the number of sub- identifiers in X is at least as many as in the value of viewSubtree for the entry, and each sub- identifier in the value of viewSubtree matches its corresponding sub-identifier in X. Two sub- identifiers match either if the corresponding bit of viewMask is zero (the 'wild card' value), or if they are equal. Due to this 'wild card' capability, we introduce the term, a 'family' of view subtrees, to refer to the set of subtrees defined by a particular combination of values of viewSubtree and viewMask. In the case where no 'wild card' is defined in viewMask, the family of view subtrees reduces to a single view subtree. |
RFC description
IETF RFC 1353 defines a Management Information Base for administration of SNMP parties, including object definitions for party management, secrets, access control, and MIB views to support the SNMP security framework (RFC 1351-1353).
Start monitoring vendor-neutral, standards-based MIB, legacy SNMPv2p-capable network devices (obsolete security model) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.