1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
|
.\" $OpenBSD: snmpd.conf.5,v 1.19 2012/09/17 16:43:59 reyk Exp $
.\"
.\" Copyright (c) 2007, 2008, 2012 Reyk Floeter <reyk@openbsd.org>
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.Dd $Mdocdate: September 17 2012 $
.Dt SNMPD.CONF 5
.Os
.Sh NAME
.Nm snmpd.conf
.Nd Simple Network Management Protocol daemon configuration file
.Sh DESCRIPTION
.Nm
is the configuration file for the
.Xr snmpd 8
daemon.
.Sh SECTIONS
The
.Nm
file is divided into three main sections:
.Bl -tag -width xxxx
.It Sy Macros
User-defined variables may be defined and used later, simplifying the
configuration file.
.It Sy Global Configuration
Global runtime settings for
.Xr snmpd 8 .
.It Sy User Configuration
USM user definitions.
.It Sy OID Configuration
Custom configuration of SNMP object identifiers and values.
.El
.Pp
The current line can be extended over multiple lines using a backslash
.Pq Sq \e .
Comments can be put anywhere in the file using a hash mark
.Pq Sq # ,
and extend to the end of the current line.
Care should be taken when commenting out multi-line text:
the comment is effective until the end of the entire block.
.Pp
Argument names not beginning with a letter, digit, or underscore
must be quoted.
.Pp
Additional configuration files can be included with the
.Ic include
keyword, for example:
.Bd -literal -offset indent
include "/etc/snmpd.conf.local"
.Ed
.Sh MACROS
Macros can be defined that will later be expanded in context.
Macro names must start with a letter, digit, or underscore,
and may contain any of those characters.
Macro names may not be reserved words (for example,
.Ic community ,
.Ic system ,
or
.Ic oid ) .
Macros are not expanded inside quotes.
.Pp
For example:
.Bd -literal -offset indent
ext_addr="192.168.0.1"
listen on $ext_addr
.Ed
.Sh GLOBAL CONFIGURATION
The following options can be set globally:
.Pp
.Bl -tag -width Ds -compact
.It Ic listen on Ar address
Specify the local address
.Xr snmpd 8
should listen on for incoming SNMP messages.
.Pp
.It Ic read-only community Ar string
Specify the name of the read-only community.
The default value is
.Ar public .
.Pp
.It Ic read-write community Ar string
Specify the name of the read-write community.
The default value is
.Ar private .
.Pp
.It Xo
.Ic filter-routes
.Pq Ic yes \*(Ba\ no
.Xc
If set to
.Ic yes ,
ask the kernel to filter route update messages on the routing socket.
Routing table information will not be available, but CPU use will be
reduced during bulk updates.
The default is
.Ic no .
.Pp
.It Xo
.Ic seclevel
.Pq Ic none \*(Ba\ auth \*(Ba\ enc
.Xc
Specify the lowest security level that
.Xr snmpd 8
accepts:
.Bl -tag -width "auth" -offset ident
.It Ic none
Both authentication and encryption of messages is optional.
This is the default value.
.It Ic auth
Authentication of messages is mandatory.
.Xr snmpd 8
will discard any messages that don't have a valid digest.
Encryption of messages is optional.
.It Ic enc
Messages must be encrypted and must have a valid digest for authentication.
Otherwise they will be discarded.
.El
.Pp
If the chosen value is different from
.Ic none
.Xr snmpd 8
will accept only SNMPv3 requests since older versions neither support
authentication nor encryption.
.Pp
.It Ic system contact Ar string
Specify the name or description of the system contact, typically a
name or an e-mail address.
The default value is
.Ar root@hostname
using the hostname of the local machine.
.Pp
.It Ic system description Ar string
Specify a description of the local system.
The default value is the operating system identification as printed by the
.Xr uname 1
command using the
.Fl a
flag:
.Bd -literal -offset indent
OpenBSD myhost.example.com 4.2 GENERIC#595 i386
.Ed
.Pp
.It Ic system location Ar string
Specify the string describing the location of the local system,
typically a physical location.
The default value is an empty string.
.Pp
.It Ic system name Ar string
Specify the name of the local system, typically a fully-qualified
domain name.
The default value is the hostname of the local system.
.Pp
.It Ic system oid Ar oid-string
Specify the authoritative identification of the local system.
The default value is
.Ar 1.3.6.1.4.1.30155.23.1
.Pq iso.org.dod.internet.private.enterprises.openbsd.23.1
identifying a common
.Ox
system.
.Pp
.It Ic system services Ar number
Specify a magic value which indicates the set of services that the local
system may provide.
Refer to the
.Ar sysServices
description in the SNMP MIB for details.
.\"XXX describe the complicated services alg here
.Pp
.It Ic trap community Ar string
Specify the name of the trap community.
The default value is
.Ar public .
.Pp
.It Xo
.Ic trap receiver Ar string
.Op Ic oid Ar oid-string
.Op Ic community Ar string
.Xc
Specify the address or FQDN of a remote trap receiver for outgoing traps
sent by
.Xr snmpd 8 .
This option may be specified multiple times.
The daemon will send outgoing traps using the revised SNMPv2 format and the
configured trap community.
The default community is specified by the global
.Ic trap community
option.
.Pp
.El
.Sh User Configuration
Users for the SNMP User-based Security Model (USM, RFC3414) must be
defined in the configuration file:
.Pp
.Bl -tag -width xxxx
.It Xo
.Ic user Ar name
.Op Ic authkey Ar key Ic auth Ar hmac
.Op Ic enckey Ar key Ic enc Ar cipher
.Xc
Defines a known user. The
.Ic authkey
keyword is required to specifiy the digest key used to authenticate
messages. If this keyword is omitted then authentication is disabled
for this user account. Optionally the HMAC algorithm used for authentication
can be specified.
.Ar hmac
must be either
.Ic hmac-md5
or
.Ic hmac-sha1 .
If omitted the default is
.Ic hmac-sha1 .
With
.Ic enckey
the encryption key used to encrypt and decrypt messages for privacy is defined.
Without an
.Ic enckey
specification the user account will neither accept encrypted incoming
messages nor will it encrypt outgoing messsages. The
.Ar enc
algorithm can be either
.Ic des
or
.Ic aes
and defaults to
.Ic des .
Any user account that has encryption enabled requires authentication to
be enabled, too.
.El
.Sh OID CONFIGURATION
It is possible to specify user-defined OIDs in the configuration file:
.Pp
.Bl -tag -width Ds -compact
.It Xo
.Ic oid Ar oid-string
.Ic name Ar name
.Op Ic read-only \*(Ba\ read-write
.Op Ar type
.Ar value
.Xc
Return the specified value to the client for this OID.
The
.Ic read-write
option may allow the client to override it,
and the type is either
.Ic string
or
.Ic integer .
.El
.Sh FILES
.Bl -tag -width "/etc/snmpd.conf" -compact
.It Pa /etc/snmpd.conf
Default location of the configuration file.
.El
.Sh EXAMPLES
The following example will tell
.Xr snmpd 8
to listen on localhost, override the default system OID, set the
magic services value and provides some custom OID values:
.Bd -literal -offset indent
listen on 127.0.0.1
system oid 1.3.6.1.4.1.30155.23.2
system services 74
oid 1.3.6.1.4.1.30155.42.1 name myName read-only string "humppa"
oid 1.3.6.1.4.1.30155.42.2 name myStatus read-only integer 1
.Ed
.Sh SEE ALSO
.Xr snmpctl 8 ,
.Xr snmpd 8
.Sh HISTORY
The
.Nm
file format first appeared in
.Ox 4.3 .
.Sh AUTHORS
The
.Xr snmpd 8
program was written by
.An Reyk Floeter Aq reyk@openbsd.org .
|