Unsolved
This post is more than 5 years old
25 Posts
0
55011
Getting Alerts - Severity:Critical, Message:Authentication Failure
Hello,
Since setting up my RHEL Linux hosts to send SNMP traps Friday (thanks Rob!) I've gotten 15 or so alert emails over the weekend from various hosts with:
Device:xyz, Service Tag:xyz, Asset Tag:, Date:06/22/12, Time:23:08:23:000, Severity:Critical, Message:Authentication Failure
I've diffed the snmpd.conf files with machines that have sent alerts compared to those that haven't, and there is no difference. All the files have the following lines as per the FAQ:
view all included .1
access notConfigGroup "" any noauth exact all none none
smuxpeer .1.3.6.1.4.1.674.10892.1
Plus...
Trapsink ome-host-ip community-name
I restarted the snmpd service on each host after making these changes.
Would anyone be able to help me pinpoint where these messages are coming from?
Thanks
Nick
victor_waelchli
91 Posts
0
June 25th, 2012 08:00
Authentication traps are sent when a community or source ip address is not setup in the configuration of SNMP. For windows that is enabled or disabled through a check box. For Linux its a setting in the snmpd.conf file.
authtrapenable {1|2} determines whether to generate authentication failure traps (disabled(2) - the default). Ordinarily the corresponding MIB object (snmpEnableAuthenTraps.0) is read-write, but specifying this directive makes this object read-only, and attempts to set the value via SET requests will result in a notWritable error response.
http://net-snmp.sourceforge.net/docs/man/snmpd.conf.html
More info on Auth Traps:
Send Authentication Traps. When an SNMP agent receives a request that does not contain a valid community name or the host that is sending the message is not on the list of acceptable hosts, the agent can send an authentication trap message to one or more trap destinations (management systems). The trap message indicates that the SNMP request failed authentication. This is a default setting.
http://technet.microsoft.com/en-us/library/cc959663.aspx
nick-h
25 Posts
0
June 26th, 2012 04:00
Thanks for the info Victor.
nick-h
25 Posts
0
June 27th, 2012 10:00
Hello, I'm still a little confused over this.
From above "When an SNMP agent receives a request that does not contain a valid community name or the host that is sending the message is not on the list of acceptable hosts, the agent can send an authentication trap message to one or more trap destinations"
Could this mean that some other host on the network (unrelated to OME) is trying to do something with SNMP, and the fact it's set up wrong means it's generating an authentication trap that OME is then alerting about? I.e. it's nothing to do with my OME setup as such.
Could this be why I get Authentication Faliure traps at odd times, and only for certain hosts?
OME itself doesn't seem to have a problem querying by SNMP (e.g. I can run an inventory fine) and it seems fine receiving traps from hosts too.