19-07-2012, 05:07 PM
Simple Network Management Protocol (SNMP)
Simple Network Management Protocol (SNMP).pdf (Size: 149.74 KB / Downloads: 80)
Introduction
Simple Network Management Protocol (SNMP) is an interoperable standards-based
protocol that allows for external monitoring of the Content Engine through an SNMP agent.
An SNMP-managed network consists of three primary components: managed devices,
agents, and management systems. A managed device is a network node that contains an
SNMP agent and resides on a managed network. Managed devices collect and store
management information and use SNMP to make this information available to
management systems that use SNMP. Managed devices include routers, access servers,
switches, bridges, hubs, computer hosts, and printers.
An agent is a software module that has local knowledge of management information and
translates that information into a form compatible with SNMP: the Management
Information Base (MIB). The agent can send traps, or notification of certain events, to the
manager.
A manager is a software module that listens to the SNMP notifications sent by SNMP
agents. The manager can also send requests to an agent to collect remote information
from the Management Information Base (MIB).
Threats of Network Security and their Relation to Network Management
SNMP version 1, or SNMPv1, has enjoyed unparalleled success as an interoperable
management solution. However, it had multiple shortcomings, the most notable of which
was its lack of strong security
This section describes the different kind of threats. Within the explanation of each threat
it's also explained what kind of effects the threats have on the network management in
general. That is, how the threats show up in the security of the network management.
Modification of Information.
The threat of the modification of information means
that some third party can intercept the transmission of the message and maliciously
modify the in-transit message. Then the modified message is passed to the original
receiver. Now the receiver of the message thinks that the message was sent by the
trusted source while the contents of the message are changed. In network
management, an authorized network manager can generate a valid management
PDU. If an attacker succeeds to intercept the transmission, the whole PDU can be
changed while keeping the authentication information unchanged. Of course, this is
possible only if the PDU is not signed, nor encrypted.
Message Stream Modification means that the stream of messages is modified
somehow. This means that the messages could be reordered, or the messages
could be recorded and replayed. The network management design originally aimed
to connectionless management protocols. And since the most of the management
protocols were designed to operate on connectionless transport services the
message stream modification is a severe threat in network management. An
attacker could for example record the valid management message that orders the
router to shut down. Then, in the future, the attacker could use the captured
message to perform the router shutdown whenever he wanted to do so.
Disclosure.
The threat of disclosure means that confidential information is leaked
to the people who shouldn't see it. In network security in general, sniffing the traffic
that is not encrypted is one way to do it. Also, in network management, some
managment PDUs can carry some crucial information about the network and
managed nodes itself. So, if an attacker spies the management traffic in a network
segment, he could get some important information. That information could be used
as the basis for other attacks, such as masquerading. A way to fight the threat of
disclosure is to encrypt the messages.
security of SNMPv1
The basic SNMP has very primitive security functions. The only mechanism to
authenticate a manager is by so called community name. The community name is used in
defining management groups with differing access rights. That is, the community name is
used to define which managers are allowed to submit get or set requests. The same
community name mapping is used to define access policies for different managers. That
is, some names may be restricted to operate only on some the areas of MIB while the
others may have greater rights.
Privacy Through Encryption
For privacy, the USM uses Data Encryption Standard for ciphering messages. More
precisely the CBC-mode of DES is used. The secret key needed for encryption is gained
by taking the first eigth octets of the privacy key (privKey) assosiated with the user. The
initial vector (IV) needed for the DES encryption algorithm is same as the last eight octets
of privacy key. The encryption of the messages is optional. Like authentication key, the
encryption key has to be set locally at the managed node.