Security to Group Table

The vacmsecurityToGroupTable table stores group information. A group name is given to a group of users and is used when managing their access rights. A group contains SecurityModel and a SecurityName value pairs. The resulting pair can only map to at most one group. The vacmSecurityToGroupTable table is indexed by the following:

• securityModel

• securityName

Each of the rows in the vacmSecurityToGroupTable table contains the following:

vacmSecurityModel

An SNMPv3 security model, in this case USM. For further information on USM, see Using USM for Authentication and Message Privacy. By using the com2sec token, SNMPv1 and SNMPv2c security models can be used. For more information about the com2sec token, see the snmpd.conf(4) man page.

vacmSecurityName

With USM, the vacmSecurityName is identical to userName. Represents a user in a format that is independent of the security model. By using the com2sec token, SNMPv1 and SNMPv2c security names can be used. For more information on the com2sec token, see the snmpd.conf(4) man page.

vacmGroupName

A readable string. Indicates the group that is associated with this entry.

The SecurityName is obtained by the msgSecurityModel specifier when a message is successfully authenticated and decrypted. The System Management Agent searches for this msgSecurityModel specifier and associated SecurityName in the vacmSecurityToGroupTable table. If the msgSecurityModel specifier and associated SecurityName are not found in the vacmSecurityToGroupTable, then access is denied. In this case, a return value of noSuchGroupName is returned.

If an entry is found, then the corresponding groupName is returned. Access checking continues, as shown in Figure 4–2.

Typical entries in a vacmsecurityToGroupTable are shown in Example 4–2.

Example 4–2 Creating Typical Security to Group Table Entries

Create a group for two previously created users that are named user2 and user5. In this example, the users are placed in a newly created group that is named grpnam1. Choose from one of two methods:

• Add the following lines to the main /etc/sma/snmp/snmpd.conf configuration file:

  group grpnam1 usm user2 group grpnam1 usm user5

  If the group is created by adding to the main /etc/sma/snmp/snmpd.conf configuration file, then the entries that are created in the vacmsecurityToGroupTable table are as follows:

  SNMP-VIEW-BASED-ACM-MIB::vacmGroupName.3."user2" = STRING: grpnam1 SNMP-VIEW-BASED-ACM-MIB::vacmGroupName.3."user5" = STRING: grpnam1 SNMP-VIEW-BASED-ACM-MIB::vacmSecurityToGroupStorageType.3."user2" = INTEGER: permanent(4) SNMP-VIEW-BASED-ACM-MIB::vacmSecurityToGroupStorageType.3."user5" = INTEGER: permanent(4) SNMP-VIEW-BASED-ACM-MIB::vacmSecurityToGroupStatus.3."user2" = INTEGER: active(1) SNMP-VIEW-BASED-ACM-MIB::vacmSecurityToGroupStatus.3."user5" = INTEGER: active(1)

  Rebooting does not delete entries. To delete entries in this VACM table, use the snmpvacm deleteGroup command. This method works if the storage type is nonVolatile. For VACM table entries with other storage types, you must manually remove from the table entries from the main /etc/sma/snmp/snmpd.conf configuration file. If the group is created by editing the main /etc/sma/snmp/snmpd.conf configuration file, the vacmsecurityToGroupTable table entries can be deleted only by editing the main /etc/sma/snmp/snmpd.conf configuration file.

• Use the snmpvacm command. For user2, a group can be created using the snmpvacm command as follows:

  # snmpvacm -v3 -u myuser -a MD5 -A my_password -l authNoPriv localhost createSec2Group 3 user2 grpnam1

  For user5, a group can be created using the snmpvacm command as follows:

  # snmpvacm -v3 -u myuser -a MD5 -A my_password -l authNoPriv localhost createSec2Group 3 user5 grpnam1

  The user myuser has rwuser level access. Therefore, group entries are created in this example as the myuser user where appropriate for the context. The users user2 and user5 do not have rights to update VACM tables.