SNMP Monitoring settings

Wget Download NET-SNMP Source code Package

wget http://sourceforge.net/projects/net-snmp/files/net-snmp/5.7.2.1/net-snmp-5.7.2.1.tar.gz

Unpack

[Email protected] home]# TAR-ZXF net-snmp-5.7.2.1.tar.gz

MV net-snmp-5.7.2.1 SNMP

Note the parameters of the compilation attention parameters:

--prefix=/usr/local/snmp

option, select the installation path for SNMP.

--with-mib-modules=ucd-snmp/diskio

option allows the server to support disk I/O monitoring.

–enable-mfd-rewrites

Option to allow the mid module to be rewritten with the new MfD so that the compiled SNMP can support 64-bit counters that will normally collect traffic.

SNMP needs to select the protocol version to use when installing, including three options: (for 2c) and 3. For security, the 1 version cannot add SNMP monitoring, so it is not recommended! Other options just skip over and you can.

[Email protected] snmp]#/configure--prefix=/usr/local/snmp--with-mib-modules=ucd-snmp/diskio- Enable-mfd-rewrites

Error configure:error:in '/HOME/SNMP ': configure:error:no acceptable C compile

Missing gcc yum–y install gcc

Finish running again./configure

Next, start compiling and installing:

Make && make install

Generally compiled source package will not have any errors, and when make the CentOS error.

Can ' t locate extutils/makemaker.pm in @INC (@INC contains:/usr/local/lib64/perl5/usr/local/share/perl5/usr/lib64/ Perl5/vendor_perl/usr/share/perl5/vendor_perl/usr/lib64/perl5/usr/share/perl5.) At makefile.pl Line 1.

BEGIN failed--compilation aborted at makefile.pl Line 1.

Make: * * [Perlmakefiles] Error 2

Workaround

Yum-y Install PERL-DEVEL-5.8.8-32.FC8 If the package is not found

or yum-y install perl-devel*

This can be installed normally without error.

Enter to view version

[Email protected] snmp]# snmpd-v

Net-snmp version:5.5

web:http://www.net-snmp.org/

Email: [Email protected]

Reference 360 Monitoring Document

★v3

Of course, we strongly recommend that you use the V3 version for authentication. For some earlier versions of Linux distributions, the built-in SNMP programs may not support V3, so we recommend that you compile and install the latest NET-SNMP, as described in the previous procedure.

V3 is using another authentication method that is more complex than the V2C version, we need to create a V3 account, and we also modify the following configuration file:

[Email protected]~# vim/usr/local/snmp/share/snmp/snmpd.conf

Then add a read-only account, as follows:

Rouser Yunjiankong Auth

Note: When adding a user, make sure that the SNMP service is not running or cannot be added.

In v3, "Rouser" is used to represent a read-only account type, and subsequent "Yunjiankong" is the specified user name, and the "auth" behind it indicates that authentication is required.

Next, we will add "Yunjiankong" This user, this is the special mechanism in V3, we open the following configuration file:

[Email protected]~# vim/var/net-snmp/snmpd.conf

This file will be called automatically when the SNMPD is started, and we need to add the instructions to create the user inside it, as follows:

CreateUser Yunjiankong MD5 MyPassword

This line of configuration means creating a user named "Yunjiankong" with a password of "mypassword" and encrypted transmission with MD5. Here are the reminders:

Password must be at least 8 bytes

This is the provision of the SNMP protocol, and if it is less than 8 bytes, communication will not be possible.

It is worth noting that once SNMPD is started, for security reasons, the above line configuration will be snmpd automatically deleted, of course, SNMPD will be in the form of ciphertext to record in other files, restart snmpd do not need to add these configurations again, unless you want to create a new user.

The user name, password, and encryption in the above configuration need to be added when the cloud monitor is added to the server.

Start the SNMP agent

After configuration, it is now possible to start snmpd (preferably with an absolute path), as follows:

/usr/local/snmp/sbin/snmpd

If you want to close, you can kill the process directly, as follows:

Killall-9 SNMPD

Enhanced Security mechanisms

Note that this step is not a required step, and it is recommended that you understand that the Linux network Firewall (iptables) is not set up, which may prevent your site from being accessed. Under normal circumstances, SNMP is very safe if you do not expose your server IP.

With the above verification mechanism, you can safely use the SNMP agent. However, if your SNMP agent version is low, there may be some malicious attackers exploit some inherent vulnerability, such as sending longer data to cause an SNMP agent memory leak or denial of service, for this reason, You can also use firewalls (iptables) for enhanced security filtering.

In Linux, we use iptables to implement firewalls, and in general, we should discard other incoming IP packets in addition to the packets that flow into the specified port. You may have configured some firewall rules, so just add the rules for SNMP.

The SNMP agent is monitored by default on the udp161 port, adding the following rules for your iptables:

Iptables-a input-i eth0-p udp-s 220.181.150.98--dport 161-j ACCEPT

Iptables-a input-i eth0-p udp-s 180.153.229.230--dport 161-j ACCEPT

The above settings assume that the server extranet network card is eth0, you can modify according to the actual situation.

This way, only cloud-monitored dedicated monitors can send UDP packets to your server's 161 port to communicate with the SNMP agent.

PS: Of course if you find that you still can't monitor then please open the UDP port.

I've been confused by this thing for a long time.

Iptables-i input-p UDP--dport 161-j ACCEPT

This article is from the "Network Engineering topic" Blog, please be sure to keep this source http://houzhibo.blog.51cto.com/3103241/1597833

SNMP Monitoring settings