Unsolved
This post is more than 5 years old
1 Rookie
•
357 Posts
0
72260
Authentication Error?
So every Friday Night/Saturday Morning we get spammed with a ton of Authentication Errors from our machines. The error has no details on what's trying to authenticate to what so I have no idea what the problem is or how to fix it. Does anyone have any ideas where I can start looking?
Thanks
DELL-Shivendra K
685 Posts
0
February 23rd, 2015 00:00
Hi, thanks for the query.
OME FAQ for your reference: en.community.dell.com/.../3265.openmanage-essentials-faq
10.2 Q: What are SNMP “authentication traps”?
A:
An authentication trap is sent when the SNMP agent is hit with an inquiry with a community name it does not recognize. These are case-sensitive also. The traps are useful to know if someone is probing your system, although its better nowadays to just sniff packets and find out the community name that way. If you use multiple community names on the network, and some management might overlap, people may want to turn these off as they become false positives (annoyances).
From MS (technet.microsoft.com/.../cc959663.aspx):Send Authentication Traps. When an SNMP agent receives a request that does not contain a valid community name or the host that is sending the message is not on the list of acceptable hosts, the agent can send an authentication trap message to one or more trap destinations (management systems). The trap message indicates that the SNMP request failed authentication. This is a default setting.
If you want to disable authentication failure traps on servers, please refer this thread for details: en.community.dell.com/.../20498986
Hope this helps!
kelemvor33
1 Rookie
1 Rookie
•
357 Posts
0
February 23rd, 2015 13:00
My OME server is set to "Accept SNMP packets from any host". My other servers are set to accept packets from "these hosts" which includes the OME server.
We only use one SNMP name so they all have the same settings. I'm not sure why some of these are having trouble authentication.
Is there any danger in turning off the Authentication Trap setting? And if not, do I need to turn it off on the OME server or the remote machines or both?
Thanks.
DELL-Shivendra K
685 Posts
0
February 23rd, 2015 21:00
As stated, this trap is sent when the device receives a request that does not contain a valid community name or the host that is sending the message is not on the list of acceptable hosts. I would suggest you to first confirm the SNMP settings on the servers sending this trap (community string and host addresses). You could also chose to disable this trap, this will disable the notifications about wrong SNMP access which you may be interested in knowing.
If you chose to turn the traps off, you are only required to do it for remote machines.
Hope this helps!