Freeradius and SNMP
Hi, I have problems starting the SNMP part of FreeRADIUS. Setup: FR 1.0.4, SuSE 10.0 radiusd.conf: snmp = yes $INCLUDE ${confdir}/snmp.conf snmp.conf: smux_password = verysecret Also my net-snmp is configured according to the docs. When I start both demons snmpwalk does not give any answer in 1.3.6.1.4.1.3317. When I do a tcpdump on interface lo (or eth0) port 199 I see no packets beeing exchanged. It seems that FR does not even try to register the subagent. Any hints? Should there be packets on the interface at all? What am I doing wrong? Thanks for any help. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42
Michael Schwartzkopff <misch@multinet.de> wrote:
Any hints? Should there be packets on the interface at all? What am I doing wrong?
Run the server in debugging mode. It will tell you if it's doing SNMP. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Am Dienstag, 29. August 2006 11:18 schrieb Alan DeKok:
Michael Schwartzkopff <misch@multinet.de> wrote:
Any hints? Should there be packets on the interface at all? What am I doing wrong?
Run the server in debugging mode. It will tell you if it's doing SNMP.
Alan DeKok.
hi, the only reference to SNMP in the debug mode is the following line: Config: including file: /usr/local/etc/raddb/snmp.conf What should radiusd say, if snmp does work? -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42
Michael Schwartzkopff <misch@multinet.de> wrote:
What should radiusd say, if snmp does work?
It *should* print out that it's doing SNMP. If it doesn't, it's a bug. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Am Dienstag, 29. August 2006 12:35 schrieb Alan DeKok:
Michael Schwartzkopff <misch@multinet.de> wrote:
What should radiusd say, if snmp does work?
It *should* print out that it's doing SNMP. If it doesn't, it's a bug.
Alan DeKok.
Hi, I recompiled the latest version (1.1.3) explicitly telling configure --with-snmp and everything seems to be ok. Debug output from radius: main: smux_password = "verysecret" main: snmp_write_access = yes SMUX connect try 1 SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: verysecret SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 2 SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 2 Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. SMUX read start SMUX read len: 12 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- and logfile from net-snmp tell something meaningful: [smux_accept] accepted fd 11 from 127.0.0.1:47423 accepted smux peer: oid SNMPv2-SMI::enterprises.3317.1.3.1, descr radiusd Now: snmpwalk (...) mib-2.67 gives good results, but snmpwalk (...) enterprises.3317 gives nothing. Reading the MIBs in mibs/ there are only the descriptions of mib-2.67, nothing about 3317. Is this OK or am I missing something? Michael. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42
On Tuesday 29 August 2006 07:25, Michael Schwartzkopff wrote:
I recompiled the latest version (1.1.3) explicitly telling configure --with-snmp and everything seems to be ok. Debug output from radius:
Looks like everything should work fine based on the output.
Now:
snmpwalk (...) mib-2.67 gives good results, but snmpwalk (...) enterprises.3317 gives nothing.
Reading the MIBs in mibs/ there are only the descriptions of mib-2.67, nothing about 3317. Is this OK or am I missing something?
mib-2.67 is what you care about. You can load the mib files from the mibs/ directory to see useful names, or read the chart files to see what each OID value represents. The private enterprise number 3317 is assigned by IANA [1] to "Port Community Rotterdam", which released the GNOME-SMI MIB module. The GNOME-SMI MIB is used in mibs/GNOME-PRODUCT-RADIUSD-MIB, and using that file you can obtain a full object name for the enterprises.3317.1.3.1 OID. It's only use right now is for the SMUX connection, but may also be needed if/when AgentX support is added. Kevin Bonner [1] http://www.iana.org/assignments/enterprise-numbers
Am Dienstag, 29. August 2006 22:35 schrieb Kevin Bonner: (...)
The private enterprise number 3317 is assigned by IANA [1] to "Port Community Rotterdam", which released the GNOME-SMI MIB module. The GNOME-SMI MIB is used in mibs/GNOME-PRODUCT-RADIUSD-MIB, and using that file you can obtain a full object name for the enterprises.3317.1.3.1 OID. It's only use right now is for the SMUX connection, but may also be needed if/when AgentX support is added.
Kevin Bonner
Hi, thanks to that explanation. But my question was: Why I do get no answer if I do snmpwalk (...) localhost enterprises.3317 while walking mib-2.67 gives results? Michael. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42
On Wednesday 30 August 2006 11:09, Michael Schwartzkopff wrote:
Hi,
thanks to that explanation. But my question was: Why I do get no answer if I do snmpwalk (...) localhost enterprises.3317
while walking mib-2.67 gives results?
Michael.
The ent.3317 OID is only used to establish the SMUX session with the SNMP daemon. It is never registered with snmpd, which is why you receive no results. -Kevin
Am Freitag, 1. September 2006 00:16 schrieb Kevin Bonner:
On Wednesday 30 August 2006 11:09, Michael Schwartzkopff wrote:
Hi,
thanks to that explanation. But my question was: Why I do get no answer if I do snmpwalk (...) localhost enterprises.3317
while walking mib-2.67 gives results?
Michael.
The ent.3317 OID is only used to establish the SMUX session with the SNMP daemon. It is never registered with snmpd, which is why you receive no results.
-Kevin
Thanks. That explains a lot. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42
participants (3)
-
Alan DeKok -
Kevin Bonner -
Michael Schwartzkopff