Managing Security

This section describes how to create new Simple Network Management Protocol (SNMP) version 3 (v3) users to provide secure access to the Oracle Solaris SNMP agent. For SNMP version 1 (v1) and version 2 (v2c), the access control mechanism is the community string, which defines the relationship between an SNMP server and its clients. This string controls the client access to the server similar to a password controlling a user's access to a system. See Solaris System Management Agent Administration Guide.

How to Create the Initial snmpv3 User

This procedure describes how to create the initial snmpv3 user on an Oracle Solaris 10 or Oracle Solaris 11 system.

You can create additional users by cloning this initial user. Cloning enables subsequent users to inherit the initial user's authentication and security types. You can change these types later.

When you clone the initial user, you set secret key data for the new user. You must know the passwords for the initial user and for the subsequent users that you configure. You can only clone one user at a time from the initial user. See “To Create Additional SNMPv3 Users with Security” in Solaris System Management Agent Administration Guide for your version of the Oracle Solaris OS.

1. Stop the Oracle Solaris SNMP agent.
   • Stop the Oracle Solaris 10 SNMP agent.

     # svcadm disable -t svc:/application/management/sma:default

   • Stop the Oracle Solaris 11 SNMP agent.

     # svcadm disable svc:/application/management/net-snmp:default

2. Create the initial user.

   This step creates user initial-user with a password that you choose, my-password, and adds an entry to the /etc/sma/snmp/snmpd.conf file. This entry gives the initial user read and write access to the agent.

   ---

   Note - Passwords must contain at least eight characters.

   ---

   • Create the initial user on an Oracle Solaris 10 system.

     # /usr/sfw/bin/net-snmp-config --create-snmpv3-user -a my-password initial-user

   • Create the initial user on an Oracle Solaris 11 system.

     # /usr/bin/net-snmp-config --create-snmpv3-user -a my-password initial-user

3. Start the Oracle Solaris SNMP agent.
   • Start the Oracle Solaris 10 SNMP agent.

     # svcadm enable svc:/application/management/sma:default

   • Start the Oracle Solaris 11 SNMP agent.

     # svcadm enable svc:/application/management/net-snmp:default

4. Verify that the initial user has been created.

   # snmpget -v 3 -u initial-user -l authNoPriv -a MD5 -A my-password localhost sysUpTime.0