Draft SNMPv2 Party MIB Dec 1992 Party MIB for version 2 of the Simple Network Management Protocol (SNMPv2) Sun Dec 6 16:26:43 1992 | Keith McCloghrie Hughes LAN Systems, Inc. kzm@hls.com James R. Davin Bellcore jrd@thumper.bellcore.com and James M. Galvin Trusted Information Systems, Inc. galvin@tis.com Status of this Memo | This document is an Internet Draft. Internet Drafts are | working documents of the Internet Engineering Task Force | (IETF), its Areas, and its Working Groups. Note that other | groups may also distribute working documents as Internet | Drafts. | Internet Drafts are valid for a maximum of six months and may | be updated, replaced, or obsoleted by other documents at any | time. It is inappropriate to use Internet Drafts as reference | material or to cite them other than as a "work in progress". | Expires June 6, 1993 [Page 1] Draft SNMPv2 Party MIB Dec 1992 1. Introduction A network management system contains: several (potentially many) nodes, each with a processing entity, termed an agent, which has access to management instrumentation; at least one management station; and, a management protocol, used to convey management information between the agents and management stations. Operations of the protocol are carried out under an administrative framework which defines both authentication and authorization policies. Network management stations execute management applications which monitor and control network elements. Network elements are devices such as hosts, routers, terminal servers, etc., which are monitored and controlled through access to their management information. Management information is viewed as a collection of managed objects, residing in a virtual information store, termed the Management Information Base (MIB). Collections of related objects are defined in MIB modules. These modules are written using a subset of OSI's Abstract Syntax Notation One (ASN.1) [1], termed the Structure of Management Information (SMI) [2]. The Administrative Model for SNMPv2 document [3] defines the | properties associated with a Party. It is the purpose of this | document, the Party MIB for SNMPv2, to define managed objects | which correspond to these properties. | 1.1. A Note on Terminology For the purpose of exposition, the original Internet-standard | Network Management Framework, as described in RFCs 1155, 1157, | and 1212, is termed the SNMP version 1 framework (SNMPv1). | The current framework is termed the SNMP version 2 framework | (SNMPv2). | Expires June 6, 1993 [Page 2] Draft SNMPv2 Party MIB Dec 1992 2. Overview | 2.1. Structure This MIB contains the definitions for four tables, a number of OBJECT IDENTIFIER assignments, and some conventions for initial use with some of the assignments. The four tables are | the SNMPv2 Party Public database, the SNMPv2 Party Secrets | database, the SNMPv2 Access Control database, and the SNMPv2 | Views database. | The SNMPv2 Party Public database and the SNMPv2 Party Secrets | database | are defined as separate tables specifically for the purpose of positioning them in different parts of the MIB tree namespace. | In particular, the SNMPv2 Party Secrets database contains | secret | information, for which security demands that access to it be | limited to parties which use authentication. | It is therefore positioned in a separate branch of the MIB tree, at the highest level possible, so as to provide for the easiest means of accommodating the required limitation. In contrast, the SNMPv2 Party Public database contains public | information about SNMPv2 parties. | In particular, it contains the parties' clocks which need to be read-able (but not write-able) by unauthenticated queries, since an unauthenticated query of a party's clock is the first step of the procedure to re-establish clock synchronization | (see [4]). | The objects in this MIB are organized into four groups. All four of the groups are mandatory for all SNMPv2 | implementations. | 2.2. Instance Identifiers In all four of the tables in this MIB, the object instances are identified by values which have an underlying syntax of OBJECT IDENTIFIER. For the Party Public database and the Party Secrets database, the index variable is the party identifier. For the Access Control database and the Views database, two index variables are defined, both of which have Expires June 6, 1993 [Page 3] Draft SNMPv2 Party MIB Dec 1992 a syntax of OBJECT IDENTIFIER. (See the INDEX clauses in the MIB definitions below for the specific variables.) According to the Section 7.7 of [2], the syntax of the | object(s) | specified in an INDEX clause indicates how to form the instance-identifier. In particular, for each index object which is object identifier-valued, its contribution to the instance identifier is: `n+1' sub-identifiers, where `n' is the number of sub- identifiers in the value (the first sub-identifier is `n' itself, following this, each sub-identifier in the value is copied). Expires June 6, 1993 [Page 4] Draft SNMPv2 Party MIB Dec 1992 3. Definitions | SNMPv2-PARTY-MIB DEFINITIONS ::= BEGIN | IMPORTS MODULE-IDENTITY, OBJECT-TYPE, snmpModules | FROM SNMPv2-SMI | TEXTUAL-CONVENTION, RowStatus, TruthValue | FROM SNMPv2-TC | MODULE-COMPLIANCE, OBJECT-GROUP | FROM SNMPv2-CONF; | partyMIB MODULE-IDENTITY | LAST-UPDATED "9212070426Z" | ORGANIZATION "IETF SNMP Security Working Group" | CONTACT-INFO | " Keith McCloghrie | Postal: Hughes LAN Systems + Mountain View, CA 94043 + US + Tel: +1 415 966 7934 | Fax: +1 415 960 3738 | E-mail: kzm@hls.com" | DESCRIPTION | "The MIB module describing SNMPv2 parties." | ::= { snmpModules 3 } | Expires June 6, 1993 [Page 5] Draft SNMPv2 Party MIB Dec 1992 -- textual conventions | Party ::= TEXTUAL-CONVENTION + STATUS current + DESCRIPTION + "Denotes a SNMPv2 party identifier." + SYNTAX OBJECT IDENTIFIER + Clock ::= TEXTUAL-CONVENTION | STATUS current | DESCRIPTION | "A party's authentication clock - a non-negative | integer which is incremented as specified/allowed | by the party's Authentication Protocol. | For noAuth, a party's authentication clock is + unused and its value is undefined. + For v2md5AuthProtocol, a party's authentication | clock is a relative clock with 1-second | granularity." | SYNTAX INTEGER (0..2147483647) | TAddress ::= TEXTUAL-CONVENTION + STATUS current + DESCRIPTION + "Denotes a transport service address. + For snmpUDPDomain, a TAddress is 6 octets long, + the initial 4 octets containing the IP-address in + network-byte order and the last 2 containing the + UDP port in network-byte order. Consult [5] for + the further information on snmpUDPDomain." + SYNTAX OCTET STRING + Expires June 6, 1993 [Page 6] Draft SNMPv2 Party MIB Dec 1992 -- administrative assignments + partyAdmin OBJECT IDENTIFIER ::= { partyMIB 1 } + -- definitions of security protocols | partyProtocols OBJECT IDENTIFIER ::= { partyAdmin 1 } -- the protocol without authentication | noAuth | OBJECT IDENTIFIER ::= { partyProtocols 1 } -- the protocol without privacy | noPriv | OBJECT IDENTIFIER ::= { partyProtocols 3 } -- the DES Privacy Protocol [4] | desPrivProtocol | OBJECT IDENTIFIER ::= { partyProtocols 4 } -- the MD5 Authentication Protocol [4] | v2md5AuthProtocol | OBJECT IDENTIFIER ::= { partyProtocols 5 } -- definitions of proxy domains | proxyDomains | OBJECT IDENTIFIER ::= { partyAdmin 2 } -- local operation | noProxy | OBJECT IDENTIFIER ::= { proxyDomains 1 } | Expires June 6, 1993 [Page 7] Draft SNMPv2 Party MIB Dec 1992 -- Definition of Initial Party Identifiers + -- When devices are installed, they need to be configured | -- with an initial set of SNMPv2 parties. The configuration | -- of SNMPv2 parties requires (among other things) the | -- assignment of several OBJECT IDENTIFIERs. Any local network | -- network administration can obtain the delegated authority | -- necessary to assign its own OBJECT IDENTIFIERs. However, | -- to provide for those administrations who have not obtained | -- the necessary authority, this document allocates a branch | -- of the naming tree for use with the following conventions. | initialPartyId | OBJECT IDENTIFIER ::= { partyAdmin 3 } -- Note these are identified as "initial" party identifiers | -- since these allow secure SNMPv2 communication to proceed, | -- thereby allowing further SNMPv2 parties to be configured | -- through use of the SNMPv2 itself. | -- The following definitions identify a party identifier, + -- and specify the initial values of various object + -- instances indexed by that identifier. In addition, + -- the initial MIB view and access control parameters + -- assigned, by convention, to these parties are identified. + -- Party Identifiers for use as initial SNMPv2 parties | -- at IP address a.b.c.d | -- Note that for all OBJECT IDENTIFIERs assigned under | -- initialPartyId, the four subidentifiers immediately | -- following initialPartyId represent the four octets of | -- an IP address. Initial party identifiers for other address | -- families are assigned under a different OBJECT IDENTIFIER, | -- as defined elsewhere. | -- Devices which support SNMPv2 as entities acting in an | -- agent role, and accessed via the snmpUDPDomain transport | -- domain, are required to be configured with the appropriate | -- set of the following as implicit assignments as and when | -- they are configured with an IP address. The appropriate | -- set is all those applicable to the authentication and | -- privacy protocols supported by the device. | Expires June 6, 1993 [Page 8] Draft SNMPv2 Party MIB Dec 1992 -- a noAuth/noPriv party which executes at the agent | -- partyIdentity = { initialPartyId a b c d 1 } -- partyTDomain = { snmpUDPDomain } | -- partyTAddress = a.b.c.d, 161 | -- partyProxyFor = { noProxy } -- partyAuthProtocol = { noAuth } -- partyAuthClock = 0 -- partySecretsAuthPrivate = ''H (the empty string) | -- partyAuthPublic = ''H (the empty string) | -- partyAuthLifetime = 0 -- partyPrivProtocol = { noPriv } -- partySecretsPrivPrivate = ''H (the empty string) | -- partyPrivPublic = ''H (the empty string) | -- a noAuth/noPriv party which executes at a manager | -- partyIdentity = { initialPartyId a b c d 2 } -- partyTDomain = { snmpUDPDomain } | -- partyTAddress = assigned by local administration -- partyProxyFor = { noProxy } -- partyAuthProtocol = { noAuth } -- partyAuthClock = 0 -- partySecretsAuthPrivate = ''H (the empty string) | -- partyAuthPublic = ''H (the empty string) | -- partyAuthLifetime = 0 -- partyPrivProtocol = { noPriv } -- partySecretsPrivPrivate = ''H (the empty string) | -- partyPrivPublic = ''H (the empty string) | -- a md5Auth/noPriv party which executes at the agent | -- partyIdentity = { initialPartyId a b c d 3 } -- partyTDomain = { snmpUDPDomain } | -- partyTAddress = a.b.c.d, 161 -- partyProxyFor = { noProxy } -- partyAuthProtocol = { v2md5AuthProtocol } | -- partyAuthClock = 0 -- partySecretsAuthPrivate = assigned by local administration -- partyAuthPublic = ''H (the empty string) | -- partyAuthLifetime = 300 -- partyPrivProtocol = { noPriv } -- partySecretsPrivPrivate = ''H (the empty string) | -- partyPrivPublic = ''H (the empty string) | Expires June 6, 1993 [Page 9] Draft SNMPv2 Party MIB Dec 1992 -- a md5Auth/noPriv party which executes at a manager | -- partyIdentity = { initialPartyId a b c d 4 } -- partyTDomain = { snmpUDPDomain } | -- partyTAddress = assigned by local administration -- partyProxyFor = { noProxy } -- partyAuthProtocol = { v2md5AuthProtocol } | -- partyAuthClock = 0 -- partySecretsAuthPrivate = assigned by local administration -- partyAuthPublic = ''H (the empty string) | -- partyAuthLifetime = 300 -- partyPrivProtocol = { noPriv } -- partySecretsPrivPrivate = ''H (the empty string) | -- partyPrivPublic = ''H (the empty string) | -- a md5Auth/desPriv party which executes at the agent | -- partyIdentity = { initialPartyId a b c d 5 } -- partyTDomain = { snmpUDPDomain } | -- partyTAddress = a.b.c.d, 161 -- partyProxyFor = { noProxy } -- partyAuthProtocol = { v2md5AuthProtocol } | -- partyAuthClock = 0 -- partySecretsAuthPrivate = assigned by local administration -- partyAuthPublic = ''H (the empty string) | -- partyAuthLifetime = 300 -- partyPrivProtocol = { desPrivProtocol } -- partySecretsPrivPrivate = assigned by local administration -- partyPrivPublic = ''H (the empty string) | -- a md5Auth/desPriv party which executes at a manager | -- partyIdentity = { initialPartyId a b c d 6 } -- partyTDomain = { snmpUDPDomain } | -- partyTAddress = assigned by local administration -- partyProxyFor = { noProxy } -- partyAuthProtocol = { v2md5AuthProtocol } | -- partyAuthClock = 0 -- partySecretsAuthPrivate = assigned by local administration -- partyAuthPublic = ''H (the empty string) | -- partyAuthLifetime = 300 -- partyPrivProtocol = { desPrivProtocol } -- partySecretsPrivPrivate = assigned by local administration -- partyPrivPublic = ''H (the empty string) | Expires June 6, 1993 [Page 10] Draft SNMPv2 Party MIB Dec 1992 -- The initial access control parameters assigned, by + -- convention, to these parties are: + -- aclTarget = { initialPartyId a b c d 1 } - -- aclSubject = { initialPartyId a b c d 2 } -- aclPrivileges = 35 (Get, Get-Next & Get-Bulk) | -- aclTarget = { initialPartyId a b c d 2 } -- aclSubject = { initialPartyId a b c d 1 } -- aclPrivileges = 132 (Response & SNMPv2-Trap) | -- aclTarget = { initialPartyId a b c d 3 } -- aclSubject = { initialPartyId a b c d 4 } -- aclPrivileges = 43 (Get, Get-Next, Set & Get-Bulk) | -- aclTarget = { initialPartyId a b c d 4 } -- aclSubject = { initialPartyId a b c d 3 } -- aclPrivileges = 4 (Response) | -- aclTarget = { initialPartyId a b c d 5 } -- aclSubject = { initialPartyId a b c d 6 } -- aclPrivileges = 43 (Get, Get-Next, Set & Get-Bulk) | -- aclTarget = { initialPartyId a b c d 6 } -- aclSubject = { initialPartyId a b c d 5 } -- aclPrivileges = 4 (Response) | Expires June 6, 1993 [Page 11] Draft SNMPv2 Party MIB Dec 1992 -- The initial MIB views assigned, by convention, to + -- these parties are: + -- viewParty = { initialPartyId a b c d 1 } -- viewSubtree = { system } - system FROM RFC1213-MIB -- viewType = { included } | -- viewMask = { ''H } | -- viewParty = { initialPartyId a b c d 1 } -- viewSubtree = { snmpStats } - snmpStats FROM SNMPv2-MIB + -- viewType = { included } + -- viewMask = { ''H } + -- viewParty = { initialPartyId a b c d 1 } + -- viewSubtree = { snmpParties } -- viewType = { included } | -- viewMask = { ''H } | -- viewParty = { initialPartyId a b c d 1 } + -- viewSubtree = { snmpStats } - snmpStats FROM SNMPv2-MIB + -- viewType = { included } + -- viewMask = { ''H } + -- viewParty = { initialPartyId a b c d 3 } -- viewSubtree = { internet } - internet FROM SNMPv2-SMI | -- viewType = { included } | -- viewMask = { ''H } | -- viewParty = { initialPartyId a b c d 3 } -- viewSubtree = { snmpV2 } - snmpV2 FROM SNMPv2-SMI | -- viewType = { included } | -- viewMask = { ''H } | -- viewParty = { initialPartyId a b c d 5 } -- viewSubtree = { internet } - internet FROM SNMPv2-SMI | -- viewType = { included } | -- viewMask = { ''H } | -- viewParty = { initialPartyId a b c d 5 } | -- viewSubtree = { snmpV2 } - snmpV2 FROM SNMPv2-SMI | -- viewType = { included } | -- viewMask = { ''H } | Expires June 6, 1993 [Page 12] Draft SNMPv2 Party MIB Dec 1992 -- Note that the only required use of privacy in SNMPv2 | -- is for the creation of parties, not for the maintenance | -- of existing parties. Thus, the initial access control | -- parameters and initial MIB views assigned, by default, | -- above to the md5Auth/desPriv parties are identical to | -- those assigned to the md5Auth/noPriv parties. | Expires June 6, 1993 [Page 13] Draft SNMPv2 Party MIB Dec 1992 -- object assignments | partyMIBObjects OBJECT IDENTIFIER ::= { partyMIB 2 } | snmpParties OBJECT IDENTIFIER ::= { partyMIBObjects 1 } | partyPublic OBJECT IDENTIFIER ::= { snmpParties 1 } | snmpSecrets OBJECT IDENTIFIER ::= { partyMIBObjects 2 } | partyPrivate OBJECT IDENTIFIER ::= { snmpSecrets 1 } | partyAccess OBJECT IDENTIFIER ::= { snmpSecrets 2 } | partyViews OBJECT IDENTIFIER ::= { snmpSecrets 3 } | Expires June 6, 1993 [Page 14] Draft SNMPv2 Party MIB Dec 1992 -- the SNMPv2 party public database group | -- -- The non-secret party information. -- -- Implementation of the objects in this group is mandatory. partyTable OBJECT-TYPE + SYNTAX SEQUENCE OF PartyEntry | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "The SNMPv2 Party Public database. | An agent must ensure that there is, at all times, a one-to-one correspondence between entries in this table and entries in the partySecretsTable. The creation/deletion of instances in this table | via SNMPv2 | Set-Requests is not allowed. Instead, entries in this table are created/deleted as a side-effect of the creation/deletion of corresponding entries in the partySecretsTable. Thus, a SNMPv2 Set-Request whose varbinds contain | a reference to a | non-existent instance of a partyTable object, but no reference to the corresponding instance of a partySecretsTable object, will be rejected." ::= { partyPublic 1 } | Expires June 6, 1993 [Page 15] Draft SNMPv2 Party MIB Dec 1992 partyEntry OBJECT-TYPE SYNTAX PartyEntry | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "Locally held non-secret information about a | particular SNMPv2 party, which is available for | access by network management." | INDEX { partyIdentity } ::= { partyTable 1 } PartyEntry ::= SEQUENCE { partyIdentity Party, | partyTDomain OBJECT IDENTIFIER, | partyTAddress TAddress, | partyProxyFor Party, | partyAuthProtocol OBJECT IDENTIFIER, | partyAuthClock Clock, | partyAuthPublic OCTET STRING, | partyAuthLifetime INTEGER, | partyPrivProtocol OBJECT IDENTIFIER, | partyPrivPublic OCTET STRING, | partyMaxMessageSize INTEGER, | partyStatus RowStatus, | partyLocal TruthValue | } partyIdentity OBJECT-TYPE SYNTAX Party | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "A party identifier uniquely identifying a | particular SNMPv2 party." | ::= { partyEntry 1 } Expires June 6, 1993 [Page 16] Draft SNMPv2 Party MIB Dec 1992 partyTDomain OBJECT-TYPE SYNTAX OBJECT IDENTIFIER | MAX-ACCESS read-write | STATUS current | DESCRIPTION "Indicates the kind of transport service by which the party receives network management traffic. An example of a transport domain is 'snmpUDPDomain' | (SNMPv2 over UDP)." | DEFVAL { snmpUDPDomain } | ::= { partyEntry 2 } partyTAddress OBJECT-TYPE SYNTAX TAddress | MAX-ACCESS read-write | STATUS current | DESCRIPTION "The transport service address by which the party receives network management traffic, formatted according to the corresponding value of partyTDomain. For snmpUDPDomain, partyTAddress is | formatted as | a 4-octet IP Address concatenated with a 2-octet UDP port number." DEFVAL { '000000000000'h } ::= { partyEntry 3 } partyProxyFor OBJECT-TYPE SYNTAX Party | MAX-ACCESS read-write | STATUS current | DESCRIPTION "The identity of a second SNMPv2 party or other | management entity | with which interaction may be necessary to satisfy received management requests. In this context, the distinguished value { noProxy } signifies that the party responds to received management requests by entirely local mechanisms." DEFVAL { noProxy } ::= { partyEntry 4 } Expires June 6, 1993 [Page 17] Draft SNMPv2 Party MIB Dec 1992 partyAuthProtocol OBJECT-TYPE SYNTAX OBJECT IDENTIFIER | MAX-ACCESS read-write | STATUS current | DESCRIPTION "The authentication protocol by which all messages generated by the party are authenticated as to origin and integrity. In this context, the value { noAuth } signifies that messages generated by the party are not authenticated." DEFVAL { v2md5AuthProtocol } | ::= { partyEntry 5 } partyAuthClock OBJECT-TYPE SYNTAX Clock | MAX-ACCESS read-write | STATUS current | DESCRIPTION "The authentication clock which represents the local notion of the current time specific to the party. This value must not be decremented unless | the party's secret information is changed | simultaneously." | DEFVAL { 0 } ::= { partyEntry 6 } Expires June 6, 1993 [Page 18] Draft SNMPv2 Party MIB Dec 1992 partyAuthPublic OBJECT-TYPE SYNTAX OCTET STRING | -- for v2md5AuthProtocol: (SIZE (0..16)) | MAX-ACCESS read-write | STATUS current | DESCRIPTION "A publically-readable value for the party. Depending on the party's authentication protocol, this value may be needed to support the party's authentication protocol. Alternatively, it may be used by a manager during the procedure for altering secret information about a party. (For example, by altering the value of an instance of | this object in the same SNMPv2 Set-Request used to | update | an instance of partyAuthPrivate, a subsequent Get-Request can determine if the Set-Request was successful in the event that no response to the | Set-Request is received, see [4].) | The length of the value is dependent on the party's authentication protocol. If not used by the authentication protocol, it is recommended that agents support values of any length up to and including the length of the corresponding partyAuthPrivate object." DEFVAL { ''H } -- the empty string | ::= { partyEntry 7 } partyAuthLifetime OBJECT-TYPE SYNTAX INTEGER (0..2147483647) | UNITS "seconds" | MAX-ACCESS read-write | STATUS current | DESCRIPTION "The lifetime (in units of seconds) which represents an administrative upper bound on acceptable delivery delay for protocol messages generated by the party." DEFVAL { 300 } ::= { partyEntry 8 } Expires June 6, 1993 [Page 19] Draft SNMPv2 Party MIB Dec 1992 partyPrivProtocol OBJECT-TYPE SYNTAX OBJECT IDENTIFIER | MAX-ACCESS read-write | STATUS current | DESCRIPTION "The privacy protocol by which all protocol messages received by the party are protected from disclosure. In this context, the value { noPriv } signifies that messages received by the party are not protected." DEFVAL { noPriv } ::= { partyEntry 9 } partyPrivPublic OBJECT-TYPE SYNTAX OCTET STRING | -- for desPrivProtocol: (SIZE (0..16)) | MAX-ACCESS read-write | STATUS current | DESCRIPTION "A publically-readable value for the party. Depending on the party's privacy protocol, this value may be needed to support the party's privacy protocol. Alternatively, it may be used by a manager as a part of its procedure for altering secret information about a party. (For example, by altering the value of an instance of this | object in the same SNMPv2 Set-Request used to | update | an instance of partyPrivPrivate, a subsequent Get-Request can determine if the Set-Request was successful in the event that no response to the | Set-Request is received, see [4].) | The length of the value is dependent on the party's privacy protocol. If not used by the privacy protocol, it is recommended that agents support values of any length up to and including the length of the corresponding partyPrivPrivate object." DEFVAL { ''H } -- the empty string | ::= { partyEntry 10 } Expires June 6, 1993 [Page 20] Draft SNMPv2 Party MIB Dec 1992 partyMaxMessageSize OBJECT-TYPE SYNTAX INTEGER (484..65507) | MAX-ACCESS read-write | STATUS current | DESCRIPTION "The maximum length in octets of a SNMPv2 message | which this | party will accept. For parties which execute at an agent, the agent initializes this object to the maximum length supported by the agent, and does not let the object be set to any larger value. For parties which do not execute at the agent, the agent must allow the manager to set this object to any legal value, even if it is larger than the agent can generate." DEFVAL { 484 } ::= { partyEntry 11 } partyStatus OBJECT-TYPE SYNTAX RowStatus | MAX-ACCESS read-only | STATUS current | DESCRIPTION "The status of the locally-held information on a particular SNMPv2 party. | Note well that the maximum access to this object | is read-only. | This object will typically provide unrestricted read-only access to the status of parties. In contrast, partySecretsStatus will typically | provide restricted read-create access to the | status of parties." | ::= { partyEntry 12 } Expires June 6, 1993 [Page 21] Draft SNMPv2 Party MIB Dec 1992 partyLocal OBJECT-TYPE | SYNTAX TruthValue | MAX-ACCESS read-write | STATUS current | DESCRIPTION | "An indication of whether this party executes at | this agent. If this object has a value of | true(1), then the local agent will listen for | SNMPv2 messages on the partyTAddress associated | with this party. If this object has the value | false(2), then the local agent will not listen for | SNMPv2 messages on the partyTAddress associated | with this party." | ::= { partyEntry 13 } | Expires June 6, 1993 [Page 22] Draft SNMPv2 Party MIB Dec 1992 -- the SNMPv2 party secrets database group | -- -- The secret party information. + -- + -- Implementation of the objects in this group is mandatory. partySecretsTable OBJECT-TYPE + SYNTAX SEQUENCE OF PartySecretsEntry | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "The SNMPv2 Party Secrets database." | ::= { partyPrivate 1 } | partySecretsEntry OBJECT-TYPE SYNTAX PartySecretsEntry | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "Locally held secret information about a | particular SNMPv2 party, which is | available for access by network management. When a SNMPv2 Set-Request is used to update the | values of instances of objects in this table, it | is recommended that the same SNMPv2 Set-Request | also alter the value of a non-secret object instance (e.g., an instance of partyAuthPublic or partyPrivPublic). This allows a Get-Request of that non-secret object instance to determine if the Set-Request was successful in the event that no response which matches the Set-Request is | received, see [4]." | AUGMENTS { partyEntry } | ::= { partySecretsTable 1 } PartySecretsEntry ::= SEQUENCE { partySecretsAuthPrivate OCTET STRING, | partySecretsPrivPrivate OCTET STRING, | partySecretsStatus RowStatus | } Expires June 6, 1993 [Page 23] Draft SNMPv2 Party MIB Dec 1992 partySecretsAuthPrivate OBJECT-TYPE SYNTAX OCTET STRING | -- for v2md5AuthProtocol: (SIZE (16)) | MAX-ACCESS read-create | STATUS current | DESCRIPTION "An encoding of the party's private authentication key which may be needed to support the authentication protocol. Although the value of this variable may be altered by a management | operation (e.g., a SNMPv2 Set-Request), its value | can never be retrieved | by a management operation: when read, the value of this variable is the zero length OCTET STRING. The private authentication key is NOT directly represented by the value of this variable, but rather it is represented according to an encoding. This encoding is the bitwise exclusive-OR of the old key with the new key, i.e., of the old private authentication key (prior to the alteration) with the new private authentication key (after the alteration). Thus, when processing a received protocol Set operation, the new private authentication key is obtained from the value of this variable as the result of a bitwise exclusive-OR of the variable's value and the old private authentication key. In calculating the exclusive-OR, if the old key is shorter than the new key, zero-valued padding is appended to the old key. If no value for the old key exists, a zero-length OCTET STRING is used in the calculation." DEFVAL { ''H } -- the empty string | ::= { partySecretsEntry 1 } | Expires June 6, 1993 [Page 24] Draft SNMPv2 Party MIB Dec 1992 partySecretsPrivPrivate OBJECT-TYPE SYNTAX OCTET STRING | -- for desPrivProtocol: (SIZE (16)) | MAX-ACCESS read-create | STATUS current | DESCRIPTION "An encoding of the party's private encryption key which may be needed to support the privacy protocol. Although the value of this variable may be altered by a management operation (e.g., a | SNMPv2 Set-Request), its value can never be | retrieved | by a management operation: when read, the value of this variable is the zero length OCTET STRING. The private encryption key is NOT directly represented by the value of this variable, but rather it is represented according to an encoding. This encoding is the bitwise exclusive-OR of the old key with the new key, i.e., of the old private encryption key (prior to the alteration) with the new private encryption key (after the alteration). Thus, when processing a received protocol Set operation, the new private encryption key is obtained from the value of this variable as the result of a bitwise exclusive-OR of the variable's value and the old private encryption key. In calculating the exclusive-OR, if the old key is shorter than the new key, zero-valued padding is appended to the old key. If no value for the old key exists, a zero-length OCTET STRING is used in the calculation." DEFVAL { ''H } -- the empty string | ::= { partySecretsEntry 2 } | Expires June 6, 1993 [Page 25] Draft SNMPv2 Party MIB Dec 1992 partySecretsStatus OBJECT-TYPE SYNTAX RowStatus | MAX-ACCESS read-create | STATUS current | DESCRIPTION "The status of the locally-held information on a particular SNMPv2 party. | This object may not be set to `active(1)' unless | the following columnar objects exist in this row: | partySecretsAuthPrivate and | partySecretsPrivPrivate. | The creation of instances in the partyTable | (but not in the aclTable or viewTable) occurs as a direct result of the creation of instances in this table. Setting an instance of this object to the value | 'underDestruction(3)' has the effect of | invalidating all local knowledge | of the corresponding party, including the invalidating of any/all entries in the partyTable, the partySecretsTable, the aclTable, and the | viewTable which reference said party." | DEFVAL { underModification } | ::= { partySecretsEntry 3 } | Expires June 6, 1993 [Page 26] Draft SNMPv2 Party MIB Dec 1992 -- the SNMPv2 access privileges database group | -- -- This group of objects allows the SNMPv2 itself to be used | -- to configure new SNMPv2 parties, or to manipulate the | -- access privileges of existing parties. | -- | -- Implementation of the objects in this group is mandatory. | aclTable OBJECT-TYPE SYNTAX SEQUENCE OF AclEntry | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "The access privileges database." ::= { partyAccess 1 } | aclEntry OBJECT-TYPE SYNTAX AclEntry | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "The access privileges for a particular requesting | SNMPv2 party in accessing a particular target | SNMPv2 party." | INDEX { aclTarget, aclSubject } | ::= { aclTable 1 } AclEntry ::= SEQUENCE { aclTarget Party, | aclSubject Party, | aclPrivileges INTEGER, | aclStatus RowStatus | } Expires June 6, 1993 [Page 27] Draft SNMPv2 Party MIB Dec 1992 aclTarget OBJECT-TYPE SYNTAX Party | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "The target SNMPv2 party whose performance of | management operations is constrained by this set | of access privileges. | Note that the authentication protocol for this | party is required to be the same as the | authentication protocol for the party identified | by the corresponding instance of aclSubject." | ::= { aclEntry 1 } aclSubject OBJECT-TYPE SYNTAX Party | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "The subject SNMPv2 party whose requests for | management operations to be performed is | constrained by this set of access privileges. | Note that the authentication protocol for this | party is required to be the same as the | authentication protocol for the party identified | by the corresponding instance of aclTarget." | ::= { aclEntry 2 } Expires June 6, 1993 [Page 28] Draft SNMPv2 Party MIB Dec 1992 aclPrivileges OBJECT-TYPE SYNTAX INTEGER (0..255) | MAX-ACCESS read-create | STATUS current | DESCRIPTION "The access privileges which govern what management operations a particular target party may perform when requested by a particular subject party. These privileges are specified as a sum of values, where each value specifies a SNMPv2 PDU | type by which the subject | party may request a permitted operation. The value for a particular PDU type is computed as 2 raised to the value of the ASN.1 context-specific | tag for the appropriate SNMPv2 PDU type. | The values (for the tags defined in [5]) are | defined in [3] as: | Get : 1 GetNext : 2 Response : 4 | Set : 8 unused : 16 | GetBulk : 32 | Inform : 64 | SNMPv2-Trap : 128 | The null set is represented by the value zero." DEFVAL { 35 } -- Get, Get-Next & Get-Bulk | ::= { aclEntry 3 } aclStatus OBJECT-TYPE SYNTAX RowStatus | MAX-ACCESS read-create | STATUS current | DESCRIPTION "The status of the access privileges for a particular requesting SNMPv2 party in accessing a | particular target SNMPv2 party." | DEFVAL { valid } ::= { aclEntry 4 } Expires June 6, 1993 [Page 29] Draft SNMPv2 Party MIB Dec 1992 -- the MIB view database group | -- This group of objects allows the SNMPv2 itself to be used | -- to configure new SNMPv2 parties, or to manipulate the MIB | -- MIB views of existing parties. | -- -- Implementation of the objects in this group is mandatory. | Expires June 6, 1993 [Page 30] Draft SNMPv2 Party MIB Dec 1992 viewTable OBJECT-TYPE SYNTAX SEQUENCE OF ViewEntry | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "The table contained in the local database which defines local MIB views. Each SNMPv2 party has a | single MIB view which is defined by two | collections | of view subtrees: the included view subtrees, and the excluded view subtrees. Every such subtree, both included and excluded, is defined in this table. To determine if a particular object instance is in | a particular SNMPv2 | party's MIB view, compare the object instance's Object Identifier with each entry (for this party) in this table. If none match, then the object instance is not in the MIB view. If one or more match, then the object instance is included in, or | excluded from, the MIB view according to the value | of viewType in | the entry whose value of viewSubtree has the most sub-identifiers. If multiple entries match and have the same number of sub-identifiers, then the | lexicographically greatest instance of viewType | determines | the inclusion or exclusion. An object instance's Object Identifier X matches an entry in this table when the number of sub- identifiers in X is at least as many as in the value of viewSubtree for the entry, and each sub- identifier in the value of viewSubtree matches its corresponding sub-identifier in X. Two sub- identifiers match either if the corresponding bit of viewMask is zero (the 'wild card' value), or if they are equal. Due to this 'wild card' capability, we introduce the term, a 'family' of view subtrees, to refer to the set of subtrees defined by a particular combination of values of viewSubtree and viewMask. In the case where no 'wild card' is defined in Expires June 6, 1993 [Page 31] Draft SNMPv2 Party MIB Dec 1992 viewMask, the family of view subtrees reduces to a single view subtree." ::= { partyViews 1 } | viewEntry OBJECT-TYPE SYNTAX ViewEntry | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "Information on a particular family of view subtrees included in or excluded from a particular | SNMPv2 party's MIB view." | INDEX { viewParty, viewSubtree } | ::= { viewTable 1 } ViewEntry ::= SEQUENCE { viewParty Party, | viewSubtree OBJECT IDENTIFIER, | viewType INTEGER, | viewMask OCTET STRING, | viewStatus RowStatus | } viewParty OBJECT-TYPE SYNTAX Party | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "The SNMPv2 party whose single MIB view includes | or | excludes a particular family of view subtrees." ::= { viewEntry 1 } Expires June 6, 1993 [Page 32] Draft SNMPv2 Party MIB Dec 1992 viewSubtree OBJECT-TYPE SYNTAX OBJECT IDENTIFIER | MAX-ACCESS not-accessible | STATUS current | DESCRIPTION "The view subtree which, in combination with the corresponding instance of viewMask, defines a family of view subtrees. This family is included | in, or excluded from the particular SNMPv2 party's | MIB view, according to the value of the corresponding instance of viewType. | For a subidentifier within the value of an | instance of viewSubtree which corresponds to a '0' | bit in the corresponding instance of viewMask, the | value of that subidentifier is ignored when | determining the family of view subtrees. The only | purpose served by the value of such a | subidentifier is to determine precedence when | multiple view subtrees are included and/or | excluded from a particular MIB view. | Note that access control with instance-level | granularity is considered beyond the scope of a | SNMPv2 entity acting in an agent role. As such, | no implementation of a SNMPv2 entity acting in an | agent role is required to support values of | viewSubtree which have more sub-identifiers than | is necessary to identify a particular leaf object | type. However, access control is used in | determining which SNMPv2 entities acting in a | manager role should receive trap notifications | (Section 5.6.2 of Protocol Operations for SNMPv2). | As such, agent implementors might wish to provide | instance-level granularity in order to allow a | management station to use fine-grain configuration | of trap notifications." | ::= { viewEntry 2 } Expires June 6, 1993 [Page 33] Draft SNMPv2 Party MIB Dec 1992 viewType OBJECT-TYPE | SYNTAX INTEGER { | included(1), | excluded(2) | } | MAX-ACCESS read-create | STATUS current | DESCRIPTION "The status of a particular family of view subtrees within the particular SNMPv2 party's MIB | view. | The value 'included(1)' indicates that the corresponding instances of viewSubtree and viewMask define a family of view subtrees included in the MIB view. The value 'excluded(2)' indicates that the corresponding instances of viewSubtree and viewMask define a family of view | subtrees excluded from the MIB view." | DEFVAL { included } ::= { viewEntry 3 } viewMask OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0..16)) | MAX-ACCESS read-create | STATUS current | DESCRIPTION "The bit mask which, in combination with the corresponding instance of viewSubtree, defines a family of view subtrees. Each bit of this bit mask corresponds to a sub- identifier of viewSubtree, with the most significant bit of the i-th octet of this octet string value (extended if necessary, see below) corresponding to the (8*i - 7)-th sub-identifier, and the least significant bit of the i-th octet of this octet string corresponding to the (8*i)-th sub-identifier, where i is in the range 1 through 16. Each bit of this bit mask specifies whether or not the corresponding sub-identifiers must match when determining if an Object Identifier is in this family of view subtrees; a '1' indicates that an exact match must occur; a '0' indicates 'wild Expires June 6, 1993 [Page 34] Draft SNMPv2 Party MIB Dec 1992 card', i.e., any sub-identifier value matches. Thus, the Object Identifier X of an object instance is contained in a family of view subtrees if the following criteria are met: for each sub-identifier of the value of viewSubtree, either: the i-th bit of viewMask is 0, or the i-th sub-identifier of X is equal to the i-th sub-identifier of the value of viewSubtree. If the value of this bit mask is M bits long and there are more than M sub-identifiers in the corresponding instance of viewSubtree, then the bit mask is extended with 1's to be the required length. Note that when the value of this object is the zero-length string, this extension rule results in a mask of all-1's being used (i.e., no 'wild card'), and the family of view subtrees is the one view subtree uniquely identified by the corresponding instance of viewSubtree." DEFVAL { ''H } | ::= { viewEntry 4 } viewStatus OBJECT-TYPE + SYNTAX RowStatus + MAX-ACCESS read-create + STATUS current + DESCRIPTION + "The status of a particular family of view + subtrees within the particular SNMPv2 party's MIB + view." + DEFVAL { active } + ::= { viewEntry 5 } + Expires June 6, 1993 [Page 35] Draft SNMPv2 Party MIB Dec 1992 -- conformance information + partyMIBConformance OBJECT IDENTIFIER ::= { partyMIB 3 } + partyMIBCompliances + OBJECT IDENTIFIER ::= { partyMIBConformance 1 } + partyMIBGroups + OBJECT IDENTIFIER ::= { partyMIBConformance 2 } + -- compliance statements + partyMIBCompliance MODULE-COMPLIANCE + STATUS current + DESCRIPTION + "The compliance statement for SNMPv2 entities + which implement the Party MIB." + MODULE -- this module + MANDATORY-GROUPS { partyMIBGroup } + ::= { partyMIBCompliances 1 } + -- units of conformance + partyMIBGroup OBJECT-GROUP + OBJECTS { partyTDomain, partyTAddress, partyProxyFor, + partyAuthProtocol, partyAuthClock, + partyAuthPublic, partyAuthLifetime, + partyPrivProtocol, partyPrivPublic, + partyMaxMessageSize, partyStatus, partyLocal, + partySecretsAuthPrivate, + partySecretsPrivPrivate, partySecretsStatus, + aclPrivileges, aclStatus, viewType, viewMask, + viewStatus } + STATUS current + DESCRIPTION + "The collection of objects allowing the + description and configuration of SNMPv2 parties." + ::= { partyMIBGroups 1 } + END Expires June 6, 1993 [Page 36] Draft SNMPv2 Party MIB Dec 1992 4. Acknowledgments + This document is based, almost entirely, on RFC 1353. | Expires June 6, 1993 [Page 37] Draft SNMPv2 Party MIB Dec 1992 5. References [1] - Information processing systems - Open Systems Interconnection - Specification of Abstract Syntax Notation One (ASN.1), International Organization for Standardization. International Standard 8824, (December, 1987). [2] J.D. Case, K. McCloghrie, M.T. Rose, S.L. Waldbusser, | Structure of Management Information for version 2 of the | Simple Network Management Protocol (SNMPv2). Internet- | Draft, (December 4, 1992). | [3] J.R. Davin, J.M. Galvin, K. McCloghrie, Administrative | Model for version 2 of the Simple Network Management | Protocol (SNMPv2). Internet-Draft, (December 6, 1992). | [4] J.M. Galvin, K. McCloghrie, J.R. Davin, Security | Protocols for version 2 of the Simple Network Management | Protocol (SNMPv2). Internet-Draft, (December 6, 1992). | [5] J.D. Case, K. McCloghrie, M.T. Rose, S.L. Waldbusser, | Protocol Operations for version 2 of the Simple Network | Management Protocol (SNMPv2). Internet-Draft, (December | 4, 1992). | [5] J.D. Case, K. McCloghrie, M.T. Rose, S.L. Waldbusser, | Transport Mappings for version 2 of the Simple Network | Management Protocol (SNMPv2). Internet-Draft, (December | 4, 1992). | Expires June 6, 1993 [Page 38] Draft SNMPv2 Party MIB Dec 1992 Table of Contents 1 Introduction .......................................... 2 1.1 A Note on Terminology ............................... 2 2 Overview .............................................. 3 2.1 Structure ........................................... 3 2.2 Instance Identifiers ................................ 3 3 Definitions ........................................... 5 3.1 Textual Conventions ................................. 6 3.2 Administrative Assignments .......................... 7 3.3 Object Assignments .................................. 14 3.4 The SNMPv2 Party Public Database Group .............. 15 3.5 The SNMPv2 Party Secrets Database Group ............. 23 3.5 The SNMPv2 Access Privileges Database Group ......... 27 3.6 The MIB View Database Group ......................... 30 3.7 Conformance Information ............................. 36 4 Acknowledgments ....................................... 37 5 References ............................................ 38 Expires June 6, 1993 [Page 39]