Chapter 5
Security is a major concern in SNMP. Not only can SNMP be used to change device
configurations--an obvious security red flag--but it can also be used to query information from
devices, which can lead to security compromises. For example, an improperly secured router
could be queried, via SNMP, and made to reveal information about how your network is put
together. That information, which would include IP addresses and routes, could be used to
architect an effective attack on your network.
I'll discuss security and SNMP in more detail in a moment.
SNMP Use in Network Configuration Management
SNMP has obvious value in a network configuration management solution. In earlier chapters, I
described how many devices--such as routers and switches--allow the use of TFTP to dump
their configuration information to a file. Other devices, however, might not; SNMP represents a
universal constant for most manageable network devices, providing a common way for a
network configuration management solution to retrieve configuration settings (which can be
saved to a database) and to reconfigure a device, if necessary.
Another aspect of SNMP is traps. Traps are essentially event notifications sent from an SNMP
agent to an SNMP management station whenever specific events occur. Such events might
include an administrator logging off of the device or placing the device into configuration mode.
These traps, if passed to a network configuration management solution, can serve as a trigger,
notifying the solution that the device's configuration might have changed. The solution can then
access the device's configuration, compare it with a previously-saved version, and take the
appropriate action as defined by an administrator.
SNMP Considerations
SNMP is a fairly old protocol and recent revisions to it have shown the growing concern about
network security. Originally, SNMP's basic security element was the community string. This
string is a simple text name that defines a group to which SNMP devices could belong. In theory,
devices would only respond to management stations possessing the same community string.
However, the default community string, "public," is left unchanged on many devices, making it
easy for attackers to guess the string and begin attacking SNMP-managed devices. Even
changing the community string isn't a completely effective solution because it is fairly easy for
an attacker to monitor network traffic for SNMP packets and analyze them to discover the
community strings in use on the network.
SNMPv3--the current version of the protocol--includes enhancements that provide for data
encryption of SNMP packets. That encryption originally used the Data Encryption Standard
(DES) and was later upgraded to the more secure Triple-DES; it can optionally use the newer
Advanced Encryption Standard (AES). SNMPv3 also includes authentication mechanisms to
ensure that only authorized management stations can query and modify the configurations of
managed devices. This authentication mechanism is based on MD5 and SHA hashes, which help
protect device passwords from being discovered by an electronic eavesdropper on your network.
Why bother encrypting traffic on your firewalled internal network? See the sidebar "It's Your Internal
Network--Why Encrypt?" later in this chapter.
88
Summary :
Not only can SNMP be used to change device configurations--an obvious security red flag--but it can also be used to query information from devices, which can lead to security compromises. SNMP Use in Network Configuration Management SNMP has obvious value in a network configuration management solution. SNMP represents a universal constant for most manageable network devices, providing a common way for a network configuration management solution to retrieve configuration settings (which can be saved to a database) and to reconfigure a device, if necessary.
Tags :
configuration,management,solution,string,security,which,deice,community,used,use,encryption,information,only