Error generating ku from authentication pass phrase

Error generating Ku from authentication pass phrase. #4

I just installed your template into Zabbix 4.4. I have a Synology DS416 NAS that has SNMP v3 configured and enabled on it. I imported your template and then created a new host for the Synology NAS using the template. I then created these 3 macros:
<$SNMP_USERNAME>
<$SNMP_AUTHPASS>

I then entered the values for the macros by cut/paste (so there would be no typos). After about 30 minutes, the SNMP availability indicator for the Synology NAS is red and if I click on it, it gives this error: «Error generating Ku from authentication pass phrase.»

The only thing I can think of that might be causing a problem are the pass erases. I am using long (20 character), complex (upper, lower, number, symbol) as well. Do think that this could be the cause of my problem?

The text was updated successfully, but these errors were encountered:

Did you select AES for privacy protocol and SHA for username/pw protocol?
You may also double check if you did not mix up the two passwords

I went back and double-checked everything, and I’m pretty sure that I have it set correctly. I even to the cli and did a snmpwalk with the v3 creds and I received a lot of data back.

So this is odd. I had to rebuild my Zabbix server as the old hard drive was too slow and generating a lot of errors. Anyway, I rebuilt everything from scratch, and now the template appears to be working fine. The only thing I did differently this time was to run and snap v3 snmpwalk on the NAS before creating the client. I know it shouldn’t matter, and maybe it doesn’t, but it is working now while it didn’t work yesterday.

Anyway, happy that it works now for you!

© 2023 GitHub, Inc.

You can’t perform that action at this time.

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.

Источник

snmpv3 monitoring on Procurve switches

Not getting anywhere with getting snmpv3 to work, however its failing on the test. Has anyone got this working, there are something missing from the recent comments, l have tried everything.

if anyone got «how to» documented from command line (switch) (enabling snmpv3) to entering the snmpv3 account on Spiceworks to test?

i have enabled the snmpv3 on the switch and entered username/password on the account to test

Still failing, driving me up the wall.

appreciate your help.

Popular Topics in HP Hardware

Is your password at least 8 characters long? You’ll get the «Error generating Ku» error if it is shorter than 8 characters.

When you run the test, does the switch reflect the attempted access in the logs?

Try deleting all the snmpv3 accounts you have setup in SpiceWorks. Then make a new one and test.

i have already deleted the account and recreated three times; as a recap the the following command was entered on the switch;

snmpv3 user auth md5 priv «

snmpv3 group managerpriv user sec-model ver3

I have used the same username/pwd to avoid confusion, on testing l’m getting the error;

Test failed: Error generating Ku from authentication pass phrase

no logs seen on the switch

I know this is not to the point of your question, but does your environment specifically require snmp v3? In some environments this is a mandatory requirement, if it isn’t in yours, drop back to v1 you will have a lot less grief in the long run IMO.

thanks, George, the request from the audit report was to disable snmpv1/2 and use V3 for security reason

Delete the creds in your switch, and lets try a new one with a bit different commands. I specifically don’t use the priv, here is how I do it.

snmpv3 user auth md5

snmpv3 group ManagerAuth user » » sec-model ver3
snmpv3 only

deleted the original account, added the command as you requested, then tested the connection with the username in the following format;

still getting the same error;

Test failed: Error generating Ku from authentication pass phrase

Try with just the username and password in SpiceWorks without the «authPriv:md5:des:»

Getting the same error.

OK, delete the accounts, reboot SpiceWorks, then re-enter and test.

you mean delete the snmpv3 account on the switch? or on spiceworks?

reboot, the server or log off from the portal?

Delete on SpiceWorks, then reboot SpiceWorks either by rebooting the server it’s installed on or restart the service from the server it’s installed on.

deleted the account as requested, restarted the services, re-created the account on spicework, used just the username/password and authPriv:md5:des

didn’t work, same old error message

I know your audit doesn’t like snmpv1 and 2, been there dealt with it, but just for testing can we eliminate the snmpv3 on the switch and setup a snmpv1 on it and then try it in SW just to see if it can communicate with the switch? Once complete you can turn snmpv1 back off.

Then we can go from there.

You may also want to setup something like snmpwalk to see if you can retrieve anything from the switch. It is not clear in my mind if the issue is with SW or the switch. Using an independent program may help you figure out where the problem isn’t.

iReasoning’s mib browser support snmp v1,2,3 you can test out their personal (free) version at http:/ Opens a new window / ireasoning.com/ mibbrowser.shtml Opens a new window The goal here is to see if you can get anything from the switch. If it returns results then you can focus on SW, otherwise find out why the switch is not responding, like if a SNMP management device is or is not defined properly.

have enabled snmp using ;

snmp-server community restricted

snmp-server host x.x.x.x.x public

getting bad authorisation or device is offline

Is there anything in between the server and the switch that may be preventing communication?

nothing in between, is the command correct?

Looks to be right. You disabled SNMPv3 first I’m assuming. I think it throws an error if you don’t.

While in the CLI you could type,

Then from there I think it is option 5 where you can configure the SNMP.

This will show the version and the strings as well.

had to disable snmpv3 first, which is why it didnt work, now that’s done, the test is showing as passed.

Really wants to get snmpv3 working

OK cool, so we know it can communicate with the SNMP, we just need to figure out now why it doesn’t like SNMPv3

In my experience with ProCurve and the SNMP settings they can be weird sometimes and disabling, re-enabling, then re-enter, blah, blah, blah, there is no rhyme or reason. And this is just setting it up to communicate with it’s ProCurve manager, not even SpiceWorks yet lol.

Now that you disabled SNMPv3, and got 1 to work we can re-enable the V3 and try again.

We can try this through the menu option, or we can do it through commands.

The simple copy and paste commands would be in order

snmpv3 enable

snmpv3 group ManagerAuth user » » sec-model ver3
snmpv3 only
wr me

Enabling SNMPv3 likes to auto do the «initial» user which I always get rid of. If you view the SNMP names either through command or through CLI after setting them up you should only see the one you created. If you see more than that, eliminate them using the

This could be causing a problem when trying to access with the credentials you supplied in SW.

Источник

Error generating Ku from authentication pass phrase. about synology-diskstation-zabbix-snmpv3 HOT 4 CLOSED

Did you select AES for privacy protocol and SHA for username/pw protocol?
You may also double check if you did not mix up the two passwords

servebeer commented on January 16, 2023

I went back and double-checked everything, and I’m pretty sure that I have it set correctly. I even to the cli and did a snmpwalk with the v3 creds and I received a lot of data back.

servebeer commented on January 16, 2023

So this is odd. I had to rebuild my Zabbix server as the old hard drive was too slow and generating a lot of errors. Anyway, I rebuilt everything from scratch, and now the template appears to be working fine. The only thing I did differently this time was to run and snap v3 snmpwalk on the NAS before creating the client. I know it shouldn’t matter, and maybe it doesn’t, but it is working now while it didn’t work yesterday.

kko commented on January 16, 2023

Anyway, happy that it works now for you!

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.

Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

TensorFlow

An Open Source Machine Learning Framework for Everyone

Django

The Web framework for perfectionists with deadlines.

Laravel

A PHP framework for web artisans

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

Some thing interesting about web. New door for the world.

server

A server is a program made to process requests and deliver data to clients.

Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

Visualization

Some thing interesting about visualization, use data art

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.

Microsoft

Open source projects and samples from Microsoft.

Источник

Мониторинг сервера Dell через idrac по snmp

Поделюсь информацией на тему мониторинга популярных брендовых серверов на одном примере. Я настрою в zabbix мониторинг сервера Dell с помощью консоли управления idrac, которая передает данные по snmp. За основу будет взят готовый популярный шаблон с github.

Введение

Вопрос мониторинга за сервером по snmp очень простой. Мониторинг любых железок по snmp не требует особых настроек. Это как раз тот случай, когда производитель уже сам обо всем позаботился и подготовил данные, а нам их надо только забрать на сервер мониторинга. Основная сложность тут с шаблонами, которые надо создавать вручную. В случае с dell и idrac этого делать не придется, потому что в сети уже полно готовых шаблонов. Я выбрал наиболее полный — https://github.com/endersonmaia/zabbix-templates/tree/master/dell/idrac.

Он хоть и старый, но полностью рабочий. В моем случае все завелось идеально без ручных правок. Была пара непонятных моментов, которые я разобрал. В принципе, именно из-за них я и решил сделать заметку, чтобы остальным было проще разобраться и не тратить время.

Ниже в статье речь пойдет о следующих версиях софта и железа.

Если у вас еще нет своего сервера для мониторинга, то рекомендую материалы на эту тему. Для тех, кто предпочитает систему CentOS:

То же самое на Debian 10, если предпочитаете его:

Настройка idrac для мониторинга

Первым делом нам надо убедиться, что у нас есть пользователь, которому разрешен доступ по snmp. Это первый момент, о который я споткнулся. В дефолте в idrac стоял всем доступ к Community public, но шаблон настроен на работу с авторизацией по snmp. Шаблон объемный, мне не захотелось его переделывать под работу без авторизации.

Я добавил в шаблон пользователя для авторизации (взял существующего администратора для теста), но все равно данные в zabbix server не поступали, а в элементах данных была ошибка: Error generating Ku from authentication pass phrase. Тут даже гуглить не пришлось, и так понятно, что проблема с авторизацией по snmp. Проблема оказалась в том, что у пользователя не было прав доступа по snmp. Проверить это нужно в разделе iDRAC Settings -> User Authentication.

Я рекомендую создать отдельного пользователя для доступа по snmp. В моем случае у него были выбраны следующие параметры SNMP:

• Authentication type — SHA
• Privacy type — AES

Для того, чтобы убедиться, что все настроено правильно, рекомендую с zabbix server проверить, что данные по snmp с авторизацией нормально забираются. Для этого можно воспользоваться утилитой snmpwalk.

Здесь zabbix это имя пользователя, а PASS123 его пароль. Если у вас нет в системе snmpwalk, установите пакет net-snmp-utils.

Утилита snmpwalk должна вывести в консоль список MIB и значений. Их должно быть очень много. Если все в порядке, двигайтесь дальше. Если данные не поступают, разберитесь, в чем проблема.

Настройка мониторинга сервера через idrac в zabbix

Перемещаемся на zabbix сервер. У меня это версия 3.4. Нам нужно скачать из репозитория на гитхабе 2 файла:

Импортируем их по очереди в заббикс сервер. Я тут споткнулся второй раз, так как не сразу понял, что за файл с ValueMaps. Я его пропустил, а нужно было импортировать первым. Он содержит карту с преобразованием значений. Без этой карты шаблон невозможно импортировать, будет ошибка. Так что сначала импортируем ValueMaps, потом Template.

Далее создаем новый хост, у которого указываем только SNMP интерфейс.

Перемещаемся на вкладку Templates и прикрепляем импортированный шаблон.

Далее на вкладке Macros добавляем учетные данные для доступа по snmp.

Текст макросов для копирования: и .

Introduction

This document describes how to configure and troubleshoot the Simple Network Management Protocol (SNMP) version 3 for Cisco Emergency Responder (CER).

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Cisco Unified Communications Manager (CUCM)
• Cisco Emergency responder
• SNMP protocol

Components Used

The information in this document is based on these software and hardware versions:

• CUCM: 11.5.1.14900-8
• CER: 11.5.4.50000-6
• Switch: WS-C3560CX-12PC-S

The information in this document was created from the devices in a specific lab environment. All the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Background Information

Emergency Responder uses SNMP to obtain information about the ports on a switch. Once the information is obtained, CER admin user can assign the ports to Emergency Response Locations (ERL), and so that Emergency Responder can identify phones that are attached to the ports and update their ERL assignments.

SNMP V3 provides additional security features that cover message integrity, authentication, and encryption. In addition, SNMP V3 controls user access to specific areas of the MIB tree.

Emergency Responder only reads SNMP information, it does not write changes to the switch configuration, so you only have to configure the SNMP read community strings.

There are some conditions to track by switch ports in CER:

• CER fetches switch interfaces, ports and VLANs (just for CAM), Cisco Discovery Protocol (CDP) information.
• CER fetches registered phones from CUCM.
• CER looks at device name sent from CUCM and searches if MAC belongs to a switch port. If the MAC is found, CER updates its database with port location of a phone.

Configure

When you configure the SNMP strings for your switches, you must also configure the SNMP strings for your Unified Communications Manager servers. Emergency Responder must be able to make SNMP queries of all Unified CM servers where the phones are registered to in order to get the phone information.

CER offers the possibility to use patterns, for example 10.0.*.* or 10.1.*.* for those devices with IPs that begin with 10.0 or 10.1. If you want to include all the possible addresses, you can use the subnet *.*.*.*.

CER Configuration

In order to configure SNMPv3 for phone tracking in Cisco Emergency Responder follow these steps:

Step 1. As shown in the image, ensure that the SNMP Master Agent, the CER, and the Cisco Phone Tracking Engine services are started.

Step 2. In order to configure the SNMP settings used for switches and CUCM nodes, navigate to CER Admin > Phone tracking > SNMPv2/v3. You can configure the SNMP username, authentication, and privacy information as shown in the image.

In this example, 10.1.61.10 is the IP of the switch and 10.1.61.158 is the IP of the Call Manager. The SNMPv3 configuration in CER is as shown in the image.

Note: You can specify *.*.*.* or other wildcards/ranges in the IP Address/Hostname in order to include more than one server, otherwise, you can configure specific IP Addresses.

Step 3. In order to configure the switch IP on LAN switches, navigate to CER Admin > Phone tracking > LAN switch detail > Add LAN Switch as shown in the image.

Communications Manager Configuration

In CUCM, there are two levels of SNMP connectivity, the SNMP Master Agent and Cisco CallManager SNMP Service. You must enable both services in all those nodes with CallManager service activated. In order to configure your Cisco Unified Communications Manager server follow these steps.

Step 1. In order to check the status of the Cisco CallManager SNMP Service, navigate to Cisco Unified Serviceability > Tools > Feature services. Select the server and ensure that the status of the Cisco CallManager SNMP Service is activated as shown in the image.

Step 2. In order to check the status of the SNMP Master Agent, navigate to Cisco Unified Serviceability > Tools > Network services. Select the server and verify that the SNMP Master Agente service runs as shown in the image.

Step 3. In order to configure the SNMPv3 in CUCM, navigate to Cisco Unified Serviceability > SNMP > V3 > User. Select the server and configure the User Name, Authentication Information and Privacy Information as shown in the image.

Switch Configuration

In order to track phones by switchport, the SNMP configuration in the switch must match with the configuration in CER server. Use these commands to configure the switch.

snmp-server group <GroupName> v3 auth read <Name_of_View>

snmp-server user <User> <GroupName> v3 auth [sha/md5] <authentication_password>  priv [DES/AES128] <privacy_password>

snmp-server view <Name_of_View> iso included

Example:

Switch(config)#snmp-server group Grouptest v3 auth read Viewtest
Switch(config)#snmp-server user cersnmpv3 Grouptest v3 auth md5 cisco123 priv des cisco123
Switch(config)#snmp-server view Viewtest iso included

In order to verify your configuration, use the show run | s snmp as shown in the example.

Switch#show run | s snmp
snmp-server group Grouptest v3 auth read Viewtest
snmp-server view Viewtest iso included

Verify

Each CUCM that runs Cisco CallManager service must also run SNMP services. If all is configured correctly, you must see all the CallManager nodes when you click on the Cisco Unified Communications Manager List hyperlink and the phones must be tracked by switchport.

Step 1. In order to verify the CUCM nodes list, navigate to CER Admin > Phone tracking > Cisco Unified Communications Manager. Click on the hyperlink as shown in the image.

Step 2. In order to confirm that phones are tracked by switchport, navigate to CER Admin > ERL Membership > Switchport > Filter > and click on Find. The switch IP address and phones tracked must be listed as shown in the image.

Troubleshoot

SNMP Walk Version 3

In order to confirm that both CUCM and the switch respond to CER you can use the SNMP walk v3 command. The recommended Object Identifier (OID) is 1.3.6.1.2.1.1.2.0 as shown in the example.

Example of SNMP walk version 3 from CER to CUCM:

admin:utils snmp walk 3
Enter the user name:: cucmsnmpv3
Enter the authentication protocol [SHA]::
Enter the authentication protocol [SHA]:: MD5
Enter the authentication protocol pass phrase:: ********
Enter the privacy protocol [AES128]:: DES
Enter the privacy protocol pass phrase:: ********
Enter the ip address of the Server, use 127.0.0.1 for localhost.Note that you need to provide the IP address, not the hostname.:: 10.1.61.158
The Object ID (OID):: 1.3.6.1.2.1.1.2.0
Enter parameter as "file" to log the output to a file. [nofile]::
This command may temporarily impact CPU performance.
Continue (y/n)?y
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.9.1.1348

Example of SNMP walk version 3 from CER to the switch:

admin:utils snmp walk 3
Enter the user name:: cersnmpv3
Enter the authentication protocol [SHA]:: MD5
Enter the authentication protocol pass phrase:: ********
Enter the privacy protocol [AES128]:: DES
Enter the privacy protocol pass phrase:: ********
Enter the ip address of the Server, use 127.0.0.1 for localhost.Note that you need to provide the IP address, not the hostname.:: 10.1.61.10
The Object ID (OID):: 1.3.6.1.2.1.1.2.0
Enter parameter as "file" to log the output to a file. [nofile]::
This command may temporarily impact CPU performance.
Continue (y/n)?y
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.9.1.2134

Example of SNMP walk v3 with root access in CER:

snmpwalk -v3 -u <User> -l authPriv –A <auth_password> –a [MD5/SHA]  -x [DES/AES128] -X <Priv_password> IP_Device <OID>

Where:
-u : is the snmp v3 user.
-l : is the authentication mode [noAuthNoPriv|authNoPriv|authPriv].
-A : is the Authentication password.
-a : is the authentication protocol [MD5|SHA].
-x : is the privacy protocol [DES/AES128].
-X : is the privacy protocol password.

Example of the output is as show in the image.

If you receive the following error «Error generating a key (Ku) from the supplied privacy pass phrase» try with the following syntax: 

snmpwalk -v3 -l authPriv -u <User> –a [MD5/SHA] –A <auth_password> -x [DES/AES128] -X <Priv_password> IP_Device <OID>

Verify that the OID returned is one of the supported devices in the CER release notes of your version.

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cer/11_5_1/english/release_notes/guide/CER_BK_C838747F_00_cisco-emergency-responder-version-1151.html#CER0_CN_SE55891C_00

Some of the OIDs that CER sends to the switch are:

• 1.3.6.1.2.1.1.1.0  — sysDescr
• 1.3.6.1.2.1.1.2.0 — sysObjectID
• 1.3.6.1.2.1.1.5.0 — sysName
• 1.3.6.1.2.1.1.3.0 – sysUpTime

Some of the OIDs that CER sends to the CUCM are:

• 1.3.6.1.4.1.9.9.156.1.1.2.1.7 —  ccmEntry/ ccmInetAddress
• 1.3.6.1.2.1.1.2.0 — sysObjectID
• 1.3.6.1.4.1.9.9.156.1.1.2.1.2  — ccmName

Packet Capture

It is very useful to get a packet capture in order to isolate issues with phone tracking, these are the steps to get a packet capture in CER.

Step 1. Start a packet capture via CLI with the command utils network capture eth0 file ExampleName size all count 10000, where ExampleName is the name for your packet capture.

Step 2. Replicate the issue (place the 911 call, SNMP walk, phone tracking update,etc).

Step 3. Stop the packet capture with Ctrl+C

Step 4. Confirm that the packet capture was saved in CER with the command file list activelog platform/cli/*

Step 5. Retrieve the packet capture with the command file get activelog platform/cli/ExampleName.cap (an SFTP server is required to export the file).

Enable the Logs in CER

In order to enable the logs in Emergency Responder Server, navigate to CER Admin > System > Server Settings. Activate all the checkboxes, it does not generate any service impact on the server.

In order to troubleshoot a switch that is not shown in the switchports (CER > Admin > ERL membership > Switch Ports), these steps must be taken:

1. Verify the configuration in Admin > Phone tracking > LAN Switch details.
2. Verify the configuration in Admin > Phone tracking > SNMP v2 / v3.
3. Verify the Enable CAM based Phone Tracking checkbox. If it is a non-Cisco switch, or CDP is disabled, check the Enable CAM based Phone Tracking checkbox.
4. Verify the SNMP configuration on the switch.
5. Collect phone tracking logs.

If switch ports show up but phones do not, these steps must be taken:

1. SNMP configuration on CER and Communications Managers.
2. Confirm the IP/Hostname under Cisco Unified Communications Manager.
3. Confirm if phones not showed belong to an specific Communications Manager.
4. Confirm both SNMP Services (SNMP Master Agent / CallManager SNMP Service) are started on all CallManager nodes in the cluster.
5. Confirm CUCM reachability via SNMP walk.
6. Collect phone tracking logs.

Example 1 of CER phone tracking logs:

305: Jun 30 12:05:17.385 EDT %CER-CER_PHONETRACKINGENGINE-7-DEBUG:SnmpSocketReader-47637:SnmpPrivacyParam encryptDESPrivParam Exception thrown while encrypting DES parameters :Cannot find any provider supporting DES/CBC/NoPadding

Possible reason: Wrong configuration on SNMPv3 Privacy Information.

Example 2 of CER phone tracking logs:

Snmp exception while reading ccmVersion on <IP address CCM Node>

Possible reason: Cisco CallManager SNMP Service is deactivated in one of the CUCM nodes.

Related Information

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cer/11_5_1/english/administration/guide/CER_BK_R00ED2C0_00_cisco-emergency-responder-administration-guide-1151/CER_BK_R00ED2C0_00_cisco-emergency-responder-administration-guide-1151_appendix_01101.html#CER0_RF_S51098E7_00

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cer/10_0_1/english/administration/guide/CER0_BK_CA66317A_00_cisco-emergency-responder-administration-10_0/CER0_BK_CA66317A_00_cisco-emergency-responder-administration-10_0_chapter_01100.pdf