KRB-USM-MIB
Detailed view of the defined objects, syntax rules, and hierarchical paths.
7
Objects
Active
Status
Objects
7 total| Object Name |
|---|
krbUsmMibPrinTableTable which maps Kerberos principals with USM
users as well as the per user variables to key
up sessions SEQUENCE OF krbUsmMibEntry .5 |
krbUsmMibPrinEntryan entry into the krbMibPrinTable which is a
parallel table to UsmUserEntry table KrbUsmMibPrinEntry .5.1 |
krbUsmMibApReqThis variable contains a DER encoded Kerberos
AP-REQ or KRB-ERROR for the USM user which is
to be keyed. This is sent from the Agent to
the Manager in an INFORM or TRAP request.
KRB-ERROR MUST only be sent to the Manager
if it is in response to a keying request from
the Manager.ro OCTET STRING .5.1.1 |
krbUsmMibApRepThis variable contains the DER encoded response
to an AP-REQ. This variable is SET by the
Manager to acknowledge receipt of an AP-REQ. If
krbUsmMibApRep contains a Kerberos AP-REP, the
Agent must derive keys from the session key
of the Kerberos ticket in the AP-REQ and place
them in the USM database in a manner specified
by [RFC2574]. If the Manager detects an error,
it will instead place a KRB-ERROR in this
variable to inform the Agent of the error.
This variable is in effect a write-only variable.
attempts to read this variable will result in a
null octet string being returnedrw OCTET STRING .5.1.2 |
krbUsmMibNonceSET'ing a krbUsmMibnonce allows a Manager to
determine whether an INFORM or TRAP from an
Agent is an outstanding keying request, or
unsolicited from the Agent. The Manager
initiates keying for a particular USM user
by writing a nonce into the row for which
desires to establish a security association.
The nonce is an ASCII string of the form
``host:port?nonce'' where:
host: is either an FQDN, or valid ipv4 or ipv6
numerical notation of the Manager which
desires to initiate keying
port: is the destination port at which that the
Manager may be contacted
nonce: is a number generated by the Manager to
correlate the transaction
The same nonce MUST be sent to the Manager in a
subsequent INFORM or TRAP with a krbUsmApReq.
The Agent MUST use the host address and port
supplied in the nonce as the destination of a
subsequent INFORM or TRAP. Unsolicited keying
requests MUST NOT contain a nonce, and should
instead use the destination stored Notifies of
this type.
Nonces MUST be highly collision resistant either
using a time based method or a suitable random
number generator. Managers MUST never create
nonces which are 0.
This variable is in effect a write-only variable.
Attempts to read this variable will result in a
nonce of value 0 being returnedrw OCTET STRING .5.1.3 |
krbUsmMibMgrTgtIf the Manager does not possess a symmetric
key with the KDC as would be the case with
a Manager using PKinit for authentication,
the Manager MUST SET its DER encoded ticket
granting ticket into KrbUsmMgrTgt along
with krbUsmMibNonce.
The agent will then attach the Manager's TGT
into the additional tickets field of the
TGS-REQ message to the KDC to get a User-User
service ticket.
This variable is in effect a write-only variable.
Attempts to read this variable will result in a
null octet string being returnedrw OCTET STRING .5.1.4 |
krbUsmMibUnsolicitedNotifyIf this variable is false, the Agent MUST NOT
send unsolicited INFORM or TRAP PDU's to the
Manager.
Attempts to SET this variable by the no-auth
no-priv user MUST be rejected.rw TruthValue (SNMPv2-TC) .5.1.5 |