SNMP Accounts and SNMPTrap Queries

AMI_shirleyh
Guppy

Posts: 54

SNMP Accounts and SNMPTrap Queries Dec 14, 2020 12:17:46 GMT

Quote

Post by AMI_shirleyh on Dec 14, 2020 12:17:46 GMT

SNMP Account

Q1 . In AccountService, AccountTypes Property is patchable. Does that mean User can change SNMP to Redfish or OEM after it has been created ?

I think it doesn't make sense to patch it after we create an account once as a Redfish or SNMP Account.

Q2. If we add only SNMP in the AccountTypes array property, does that mean it is Redfish & SNMP Account or only SNMP Account ?

Q3. "SNMPAuthenticationProtocols": { "enum": [ "None","HMAC_MD5","HMAC_SHA96" ] }

We have different AuthenticationProtocols in our BMC. So is there any reason for including only the above Enum's?

This is similar for "SNMPEncryptionProtocols": { "enum": ["None","CBC_DES","CFB128_AES128"] }

Can we have SNMPEncryptionProtocols property as a String Type alone and no Enum's?

It would be easier for us to map to our BMC. Otherwise let us know if any specific reasons for enforcing these Enums?

SNMPTrap

Q1. Already we have SNMP Credentials in ManagerAccount under SNMP property. So why do we need SNMP Property in EventDestination Schema for sending SNMP Trap?

Is SNMP Property in EventDestination independent of SNMP Property in ManagerAccounts ?

The following is a snippet from DMTF Mockup:

EventDestinationRequest

      {
            "Name": "SNMPv3 EventSubscription",
             "Destination": "snmp://contorso_employee457@snmp_server.controso.com:162",
             "ResourceTypes": [
                 "Certificate", "Volume"],
             "Context": "My_SNMPv3_Events",
             "Protocol": "SNMPv3",
        "SubscriptionType": "SNMP",
       }

ManagerAccount Response

   {
        "@odata.type": "#ManagerAccount.v1_4_0.ManagerAccount",
        "Id": "2",
         "Name": "Another User Account",
        "Description": "This user is both a Redfish administrator and a SNMPv3 user.",
        "Enabled": true,
        "Password": null,
         "UserName": "controso_employee457",
        "RoleId": "Administrator",
         "Locked": false,
         "AccountTypes": [
             "Redfish",
             "SNMP"
         ],

         "SNMP": {
             "AuthenticationKeySet": false,
            "AuthenticationProtocol": "None"/"HMAC_MD5"/"HMAC_SHA96",
        "EncryptionKeySet": false,
           "EncryptionProtocol": "None"/"CBC_DES"/"CFB128_AES128",
       },
    "@odata.id": "/redfish/v1/AccountService/Accounts/2",
     "@redfish.Copyright": "Copyright 2014-2019 DMTF. For the full DMTF copyright policy, see www.dmtf.org/about/policies/copyright."
}

jautor
Administrator

Posts: 519

SNMP Accounts and SNMPTrap Queries Jan 14, 2021 21:20:26 GMT

Quote

Post by jautor on Jan 14, 2021 21:20:26 GMT

Dec 14, 2020 12:17:46 GMT AMI_shirleyh said:

SNMP Account

Q1 . In AccountService, AccountTypes Property is patchable. Does that mean User can change SNMP to Redfish or OEM after it has been created ?

I think it doesn't make sense to patch it after we create an account once as a Redfish or SNMP Account.

Q2. If we add only SNMP in the AccountTypes array property, does that mean it is Redfish & SNMP Account or only SNMP Account ?

First, my apologies for not getting a response posted sooner - we had shut down for the end-of-year holiday season and I forgot to reply...

So yes, the user can change an account to add/remove additional access to services by PATCH operations on the AccountTypes array. But the service does NOT have to support that (it can treat the read-write property as read-only, this is always allowed by the specification). So if that is beyond the capabilities of the service, you can still show what is allowed, and perhaps require the user to delete/create accounts if they wish to made those modifications.

Q3. "SNMPAuthenticationProtocols": { "enum": [ "None","HMAC_MD5","HMAC_SHA96" ] }

We have different AuthenticationProtocols in our BMC. So is there any reason for including only the above Enum's?

This is similar for "SNMPEncryptionProtocols": { "enum": ["None","CBC_DES","CFB128_AES128"] }

Can we have SNMPEncryptionProtocols property as a String Type alone and no Enum's?

It would be easier for us to map to our BMC. Otherwise let us know if any specific reasons for enforcing these Enums?

This was an oversight in the schema, and the next version (EDIT: 2020.4 which is now available) adds all of the available authentication protocols for SNMPv3. We want enumerations for these types of properties whenever possible to increase interoperability. String values mean that implementations will vary in their handling of the same values. Since these values are backed by the SNMP specification, hopefully we can define enumerations for all possible types and be 100% covered. If we're missing something after the next release, please let us know.

SNMPTrap

Q1. Already we have SNMP Credentials in ManagerAccount under SNMP property. So why do we need SNMP Property in EventDestination Schema for sending SNMP Trap?

Is SNMP Property in EventDestination independent of SNMP Property in ManagerAccounts ?

The credential properties in EventDestination are for support of SNMPv3 which can require user credentials to be presented to the trap receiver (otherwise the trap is rejected). This is different than credentials used to access SNMP services (for GET / GET_NEXT / etc.).

Jeff

Last Edit: Feb 21, 2021 22:10:10 GMT by jautor: Added 2020.4 release note

AMI_shirleyh
Guppy

Posts: 54

SNMP Accounts and SNMPTrap Queries Feb 17, 2021 10:32:17 GMT

Quote

Post by AMI_shirleyh on Feb 17, 2021 10:32:17 GMT

Thanks Jeff for the reply.

I was checking for a few days and then left to followup. Saw it today only.

We continued with OEM Attributes as of now to matc our BMC implementation. Saw that in new Schema 2020.4, it is updated.

We will move to standard attributes in our next release.

Also 1 quick query:
We can allow only some enum's right according to our choice by providing Allowables values for Patch properties in the GET response?

mraineri Administrator Posts: 1,132	SNMP Accounts and SNMPTrap Queries Feb 17, 2021 13:41:15 GMT Quote Select Post Deselect Post Link to Post Back to Top Post by mraineri on Feb 17, 2021 13:41:15 GMT That's correct; you do not need to support all possible enumeration values, and you can use the @redfish.AllowableValues term to inform clients which values you do support.

AMI_shirleyh
Guppy

Posts: 54

SNMP Accounts and SNMPTrap Queries Apr 7, 2021 10:54:11 GMT

Quote

Post by AMI_shirleyh on Apr 7, 2021 10:54:11 GMT

SNMP Access Privilege

Till now we do not have any property for SNMP User Access in "SNMPUserInfo" object in ManagerAccount Schema.

Is it possible to add this in the upcoming Schemas ?

For eg: [ Please check the "Access" property in the below mentioned example ]
"SNMP": {
"AuthenticationProtocol" : "HMAC192_SHA256",
"EncryptionProtocol" : "CBC_DES",
"Access" : "ReadWrite"
}

mraineri
Administrator

Posts: 1,132

SNMP Accounts and SNMPTrap Queries Apr 8, 2021 15:00:11 GMT

Quote

Post by mraineri on Apr 8, 2021 15:00:11 GMT

The expectation is the "RoleId" property would be used to perform that mapping. We have this statement in the "Roles" clause of the specification:

Non-Redfish services, such as those enabled by the AccountTypes property within the ManagerAccount resource, should map the Redfish RoleId to their permission system. For example, an SSH user with Administrator as the value of the RoleId property could map to "root" for the SSH service. However, the privileges specified by the AssignedPrivileges and OemPrivileges do not necessarily map to non-Redfish services.

So, for SNMP, something like the "Operator" or "Administrator" role could map to the "ReadWrite" access for SNMP.

Post by AMI_shirleyh on Dec 14, 2020 12:17:46 GMT

Post by jautor on Jan 14, 2021 21:20:26 GMT

Post by AMI_shirleyh on Feb 17, 2021 10:32:17 GMT

Post by mraineri on Feb 17, 2021 13:41:15 GMT

Post by AMI_shirleyh on Apr 7, 2021 10:54:11 GMT

Post by mraineri on Apr 8, 2021 15:00:11 GMT