search

splunk / splunk-connect-for-snmp

Splunk connect for SNMP
https://splunk.github.io/splunk-connect-for-snmp/
Apache License 2.0
35 stars 16 forks source link

snmptrap V3 username issue #930

Open alfletch opened 10 months ago

alfletch commented 10 months ago

I have an issue where I may be using the same username for multiple secrets, but only the last listed in the values file is used for authentication.

For example, I have setup secrets secret1 - username=myuser, authkey=myauthkey1, privkey=myprivkey1 secret2 - username=myuser, authkey=myauthkey1, privkey=myprivkey2

Then in the values.yaml file, traps: usernameSecrets:

In this case when sending traps, only secret2 is authenticated, if I reverse the order of the secrets, then the only traps with secret1 are authenticated.

ajasnosz commented 10 months ago

Hello, thank you for spotting that, I checked this configuration and it is a bug, that occurs when you have the same usernames. We will try to investigate it further.

frankli-n commented 8 months ago

This bug is an issue for staff at my company too. Any more info on which code is causing the bug? My understanding is the main() function in traps.py seems to be handling it okay.

ajasnosz commented 8 months ago

Yes, from what we tested for now it looked like the issue might be in how pysnmp library is handling the secrets, we will look further into that.

ajasnosz commented 7 months ago

Hello All, after looking into pysnmp library this behaviour is the expected one. Pysnmp allows only one-to-one mapping between userName and securityName, which is the key for getting secret configuration. This solution is based on snmp standard mentioned in rfc: https://www.rfc-editor.org/rfc/rfc3414#page-12