LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-01-2016, 01:58 PM   #1
Hiroshi
Member
 
Registered: Apr 2010
Posts: 34

Rep: Reputation: 0
How to open communication between RHEL server & snmp (udp port 161)


Hey Gurus, I'm implementing Solarwinds (snmp udp port 161) as my monitoring tool. I take the following steps:

1- # iptables -A INPUT -p udp --dport 161 -j ACCEPT
# /sbin/service iptables save

2- I edit /etc/hosts.allow and add the IP for the Solarwinds server as follows: snmpd: 129.105.106.0

These two steps usually does the trick, but in some cases it does not. Other than these two steps, what other files need to be edited for this communication to start.

Many thanks in advance for your excellent work.
 
Old 08-01-2016, 03:46 PM   #2
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,831
Blog Entries: 15

Rep: Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668
You'd have to start snmpd on the server so it is LISTENing on port 161.

Running "lsof -i :161" would show you if any ports are LISTENing (or otherwise active) on that port.

Running "service snmpd status" on RHEL6 and below would show you whether the snmpd init script has been started. On RHEL7 you'd run "systemctl status snmpd". Substitute "start" for "status" to run the daemons.

Note: Some things might require other services. e.g. on Dell servers we install Dell's Open Manage and our monitoring interrogates MIBs that provides.
 
Old 08-01-2016, 04:24 PM   #3
Hiroshi
Member
 
Registered: Apr 2010
Posts: 34

Original Poster
Rep: Reputation: 0
snmpd is also running. Is there anything else you can think of that can be blocking the traffic (other than iptables, hosts.deny, or snmpd)?

[root@bartlett-p etc]# service snmpd status
snmpd (pid 1103) is running...
[root@bartlett-p etc]#
 
Old 08-01-2016, 05:00 PM   #4
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Abingdon, VA
Distribution: Catalina
Posts: 9,374
Blog Entries: 37

Rep: Reputation: Disabled
On the Solarwinds server, run this:
Code:
sudo tcpdump -nn -i eth0 src 129.105.106.0 and port 514
and wait to "see" any traffic from 129.105.106.0
 
Old 08-01-2016, 06:50 PM   #5
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Abingdon, VA
Distribution: Catalina
Posts: 9,374
Blog Entries: 37

Rep: Reputation: Disabled
Quote:
Originally Posted by Hiroshi View Post
Hey Gurus, I'm implementing Solarwinds (snmp udp port 161) as my monitoring tool. I take the following steps:

1- # iptables -A INPUT -p udp --dport 161 -j ACCEPT
# /sbin/service iptables save

2- I edit /etc/hosts.allow and add the IP for the Solarwinds server as follows: snmpd: 129.105.106.0
Doesn't this also require an
Code:
snmpd:ALL
in /etc/hosts.deny?

Where are you getting your info?
 
Old 08-03-2016, 02:26 PM   #6
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,831
Blog Entries: 15

Rep: Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668Reputation: 1668
I just realized you wrote:
iptables -A INPUT -p udp --dport 161 -j ACCEPT

The "-A" adds to end of chain.

On RHEL5 and RHEL6 the end of the input chain is usually:
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

That causes it to ignore any other rules in the chain after that line. Typically the best way to do this is to use "-I" for insert instead. You also have to specify the line number with -I.

If you run "iptables -nL --line-numbers" you should see all the rules with the line numbers. Use "-D" to delete any rules in INPUT chain beneath the above REJECT line then use the "-I" with appropriate line number to insert the rule somehwere above the REJECT line.

By the way you can restrict the rule to a specific IP (e.g. that of your Solar Winds server) to prevent others from accessing the SNMP on this RHEL server.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
how to open UDP 161 port to allow only the SNMP monitoring server? cebo_myeza Linux - Networking 2 06-11-2015 11:11 AM
how to open UDP 161 port to allow only the SNMP monitoring server cebo_myeza Linux - Newbie 2 06-10-2015 05:27 AM
iptables port 161 UDP/TCP aocferreira Linux - Networking 7 03-18-2011 04:08 PM
UDP Port 161 kopper27 Linux - Newbie 8 06-09-2010 02:57 PM
UDP & TCP Port Communication is Filtered/Open in nmap benderan Linux - Networking 8 01-21-2009 05:15 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:48 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration