PakSecured Linux

DefConX - Replacing TripWire with SNMPv3
Talk by Matthew G. Marsh

In this file list is everything you need to get the example source code running on a 'nix (preferably Linux) system.

The original PPT from the DCX CD

The Actual talk PPT as given

The Corrected README from the DCX CD

The NET-SNMP v 5.0.3 source is latest as of 8/17/02.

The mhash library is the version used in developing.

The patch contains all else.

Quick Use:

1. Unpack, configure, install the mhash library.

2. Unpack the net-snmp source

3. Patch net-snmp

   cd net-snmp-5.0.3

   patch -p1 < ../PakSnmp.DefConX.patch (ignore errors)

4. Run PakConfigure - bash PakConfigure

5. make

6. make install


Now configure the software for testing assuming you did not edit PakConfigure:

Create SNMP Config file:

cat > /usr/local/share/snmp/snmp.conf
mibs ALL
^D

Now create the Daemon Config file:

cat > /usr/local/share/snmp/snmpd.conf
rwuser defconx
^D

Create the run time data directory:

mkdir /var/net-snmp

Create the first run secure user data:

cat > /var/net-snmp/snmpd.conf
createUser defconx MD5 defconxv3 DES defconxencrypt
^D

Now you are ready to fire it up and play.

/usr/local/sbin/snmpd

Now try out the default setup:

/usr/local/bin/snmpwalk -v 3 -u defconx -l authPriv -a MD5 -A defconxv3 -x DES -X defconxencrypt localhost .1.3.6.1.4.1.9248

and you should get:

PAKDEFCONX-MIB::PakTestFileString.0 = STRING: "/etc/hosts"

PAKDEFCONX-MIB::PakTestFileHash.0 = STRING: "5b41d38e2a46d028902e3cecf808c582"

Now let us change the file to hash:

/usr/local/bin/snmpset -v 3 -u defconx -l authPriv -a MD5 -A defconxv3 -x DES -X defconxencrypt localhost .1.3.6.1.4.1.9248.1.1.1.0 s "/etc/services"

PAKDEFCONX-MIB::PakTestFileString.0 = STRING: "/etc/services"

Now check that you get the new hash:

/usr/local/bin/snmpwalk -v 3 -u defconx -l authPriv -a MD5 -A defconxv3 -x DES -X defconxencrypt localhost .1.3.6.1.4.1.9248

PAKDEFCONX-MIB::PakTestFileString.0 = STRING: "/etc/services"

PAKDEFCONX-MIB::PakTestFileHash.0 = STRING: "49b9ab95c2a4e5bdd3b2e1778cc34eb6"

FV Oiler.

mgm
7/9/02
rev 8/19/02

Copyright © 1996 - 2002 Paktronix Systems, LLC Revised Aug 20, 2002