Obtaining user information via SNMP: Difference between revisions

Latest revision as of 10:40, 17 November 2023

This doc has been tested to work on alpine-2.3.2 (squark-0.4-r0, net-snmp-5.7.1-r1)

Introduction

This document describes how to use 'squark-auth-snmp' as a squid authentication helper to obtain a username or other useful information from a switch.
'squark-auth-snmp' queries the switch via SNMP using standard MIBs to obtain various information.
The information is then injected into the squid access logs (which can help auditors when analyzing the logs).

Switches that confirmed to function (at least in some degree):

HP Procurve 5400zl
HP Procurve 1810G 24GE
HP Procurve 2150-48
HP Procurve 2650

Note: The below examples will create/use a community called 'public'. You can replace each occurrence of 'public' with something that suits your needs.
In some examples an IP address might be mentioned. Change those to reflect your configuration.
Values such as <ip.of.switch> and other values marked as <something> should be replaced appropriately.

Configuring the switch

Enable SNMP Lookups

We need a 'SNMP community' configured on the switch (which has at least 'read-only' or 'restricted' permissions).
If your switch does not have such an 'SNMP community', you will need to create one.

Tip: Procedures on how to view/modify/create SNMP communities on a switch vary on depending on brand or model of the switch.
You will benefit from reading your manual to figure out how to apply the changes to your own switch.

Note: The upcoming examples assume you are using a "HP Procurve" switch.

Start by logging on to your switch (use telnet, ssh or a serial cable. The manual that came with your switch will describe how this is done for your switch).

View your snmp-server settings

Run the following command to view your current snmp-settings

show snmp-server

Create an SNMP community

In this case we will create an SNMP community called "public" and give it "restricted" rights.
We will also configure the switch to send SNMP replies from the same IP address as the one on which the corresponding SNMP request was received.

configure snmp-server community "public" restricted snmp-server response-source dst-ip-of-request exit

Run the above commands (exactly as they appear above) on all switches that the squark-auth-snmp plugin will run snmp queries against.

Warning: Your switch might need to be rebooted in order to apply the 'dst-ip-of-request' setting.

Link Layer Discovery Protocol

If you have multiple switches in your environment, Link Layer Discovery Protocol (LLDP) should be enabled in order for 'squark-auth-snmp' to work properly.
If the switch that you specify in the squark config below is a core switch (such as in a star topology network), and all the switches in your network have LLDP enabled (usually enabled by default), then your network topology should be automatically discoverable.

web-based authentication

{{tip|It is possible to configure HP Procurve switches to do port-based web authentication.
A network device initiates traffic on a port, and is assigned to a "guest" vlan with limited or no network access.
A browser needs to be opened, and the user is given a user-name and password prompt.

Configure squid & squark

Install squark

apk add squark

Configure squid

We assume you have installed squid and done some initial configuration to get it working.
The below examples should replace or append values to your working '/etc/squid/squid.conf'.

Tip: Consult https://wiki.squid-cache.org/ when configuring squid

General squid.conf modifications

Change (or edit) '/etc/squid/squid.conf' to reflect the following:

# Logging
logformat squark %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %un %Sh/%<A %mt %rG
access_log /var/log/squid/access.log squark

# Permissions
cache_effective_user squid
cache_effective_group squid

# Allow hosts on <some.zone> to access internet
http_access allow <some.zone> Zone_SquarkAuth

As you can see in the above example, we refer to the acl "Zone_SquarkAuth" which is not yet created.
The following examples will describe how to create it, depending on your needs.

Configure squark-auth-snmp to use SNMPv2c

Change (or edit) '/etc/squid/squid.conf' to reflect the following:

# External ACL squid auth helper
external_acl_type squark_auth children-startup=1 children-max=1 ttl=1800 negative_ttl=60 concurrency=128 grace=10 \
  %SRC /usr/bin/squark-auth-snmp -f "%N-%i-%M" -c public -r 10.82.96.1 -i eth1.96 -R 10.82.72.226 -v 96
acl Zone_SquarkAuth external squark_auth

{{Tip|For more information on the 'squark_auth' options available, run the command 'man squark-auth-snmp' in your terminal or browse the squark git tree.

Configure net-snmp

Install net-snmp

apk add net-snmp

Configure net-snmp

Basic configuration

Modify '/etc/snmp/snmpd.conf' to reflect at least the following:

rocommunity public default
syslocation  "Location of our equipment"
sysservices  15
syscontact  "ComputerDept <computerdept@foo.bar>"

SNMPv3 Configuration (optional)

Squark will use the configuration specified in '/etc/snmp/snmp.conf' when snmpv3 is specified as the preferred version of SNMP to use. Ensure that you have at least the following in /etc/snmp/snmp.conf:

defContext none
defSecurityName <username>
defAuthPassphrase <password>
defVersion 3
defAuthType MD5
defSecurityLevel authNoPriv

Note: Adjust the above as dictated by the SNMPv3 configuration on your switch.

Start using it

Start it all up

rc-service squid start rc-service snmpd start

Make sure to configure you services to autostart at next reboot

rc-update add squid default rc-update add snmpd default

Debugging

Squark

If you are having trouble getting 'squark-auth-snmp' to give you the data you are wanting to see, you could run 'squark-auth-snmp' standalone in a terminal to debug your syntax.

Run the 'squark-auth-snmp' command with the options you are planning to use (below is just a example on how that might look):

/usr/bin/squark-auth-snmp -f "%N-%i-%M" -c public -r 10.82.72.221 -i eth1.96 -v 96

Note: Running 'squark-auth-snmp' standalone in a terminal will not give you information on nearby switches. You would need to configure 'squark-auth-snmp' to ask a specific switch in order to query it for valid results.

You will end up in the squark-proxy-cli mode.
Feed the CLI with 2 values separated with a whitespace.

An index (this could basically be anything without a whitespace)
An IP address of a host connected to your switch(es)

The command entered in the CLI could look like this:

a 10.82.96.123

Either you get "a ERR" or "a OK user=<switchname>_<portname>_<mac address>" result which will help you in your debugging.

@@ Line 1: / Line 1: @@
-{{Draft}}
+This doc has been tested to work on alpine-2.3.2 ''(squark-0.4-r0, net-snmp-5.7.1-r1)''
-This documents how to use the squark-auth squid authentication helper to obtain a user-name or other information from via SNMP from a switch. The example uses an HP Procurve 5400zl switch.
+== Introduction ==
+This document describes how to use 'squark-auth-snmp' as a squid authentication helper to obtain a username or other useful information from a switch.<BR>
+'squark-auth-snmp' queries the switch via SNMP using standard MIBs to obtain various information.<BR>
+The information is then injected into the squid access logs ''(which can help auditors when analyzing the logs)''.<BR>
-It is possible to configure HP Procurve switches to do port-based web authentication. A network device initiates traffic on a port, and is assigned to a "guest" vlan with limited or no network access. A browser needs to be opened, and the user is given a user-name and password prompt. For more information on configuring web-based authentication on an HP switch, see [http://h40060.www4.hp.com/procurve/uk/en/pdfs/application-notes/AN-S1_Web-Authentication-final-080608.pdf this link].
+Switches that confirmed to function (at least in some degree):<BR>
+* HP Procurve 5400zl
+* HP Procurve 1810G 24GE
+* HP Procurve 2150-48
+* HP Procurve 2650
-The squark-auth squid authentication helper queries the HP switch via SNMP using standard MIBs to obtain the user-name associated with the IP address, which it injects into the squid access logs, which can help web-log auditors analyse . For more information see the squark-auth documentation [http://insert.reallink.com here].
+{{Note|The below examples will create/use a community called 'public'. You can replace each occurrence of 'public' with something that suits your needs.<BR>In some examples an IP address might be mentioned. Change those to reflect your configuration.<BR>
+Values such as <ip.of.switch> and other values marked as <something> should be replaced appropriately.}}
-=== Enable SNMP Lookups on HP Procurve Device ===
+== Configuring the switch ==
-Create an SNMP read-only community on your HP Procurve Switch, or use one that already exists (the following example uses "public" as a community name - adjust as you like):
+=== Enable SNMP Lookups ===
+We need a 'SNMP community' configured on the switch (which has at least 'read-only' or 'restricted' permissions).<BR>
+If your switch does not have such an 'SNMP community', you will need to create one.
+{{Tip|Procedures on how to view/modify/create SNMP communities on a switch vary on depending on brand or model of the switch.<BR>You will benefit from reading your manual to figure out how to apply the changes to your own switch.}}
+{{Note|The upcoming examples assume you are using a "HP Procurve" switch.}}
+Start by logging on to your switch ''(use telnet, ssh or a serial cable. The manual that came with your switch will describe how this is done for your switch)''.
+==== View your snmp-server settings ====
+Run the following command to view your current snmp-settings
+{{cmd|show snmp-server}}
+==== Create an SNMP community ====
+In this case we will create an SNMP community called "public" and give it "restricted" rights.<BR>
+We will also configure the switch to send SNMP replies from the same IP address as the one on which the corresponding SNMP request was received.
 {{cmd|configure
@@ Line 16: / Line 38: @@
 exit }}
-The 2nd last command ensures that the SNMP replies are always returned from the switch's primary management interface. Run the above commands on all switches that the squark-auth plugin will run snmp queries against. Run them exactly as they appear.
+Run the above commands ''(exactly as they appear above)'' on all switches that the squark-auth-snmp plugin will run snmp queries against.
+{{warning|Your switch might need to be rebooted in order to apply the 'dst-ip-of-request' setting.}}
-=== Install Squark and Configure Squid ===
+=== Link Layer Discovery Protocol ===
+If you have multiple switches in your environment, Link Layer Discovery Protocol (LLDP) should be enabled in order for 'squark-auth-snmp' to work properly.<BR>
+If the switch that you specify in the squark config below is a core switch ''(such as in a star topology network)'', and all the switches in your network have LLDP enabled ''(usually enabled by default)'', then your network topology should be automatically discoverable.
+=== web-based authentication ===
+{{tip|It is possible to configure HP Procurve switches to do port-based web authentication.<BR>
+A network device initiates traffic on a port, and is assigned to a "guest" vlan with limited or no network access.<BR>
+A browser needs to be opened, and the user is given a user-name and password prompt.
+== Configure squid & squark ==
+=== Install squark ===
 {{cmd|apk add squark}}
-The squark-auth binary used by squid is copied into the /usr/local/bin directory. All further configuration is done in /etc/squid/squid.conf:
+=== Configure squid ===
+We assume you have installed squid and done some initial configuration to get it working.<BR>
-{{Note| The following configuration assumes that you are using SNMPv2c}}
+The below examples should replace or append values to your working '/etc/squid/squid.conf'.
+{{Tip|Consult https://wiki.squid-cache.org/ when configuring squid}}
+==== General squid.conf modifications ====
+Change ''(or edit)'' '/etc/squid/squid.conf' to reflect the following:
 <pre>
-#external ACL squid auth helper
+# Logging
-# Squark authentication external acl
+logformat squark %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %un %Sh/%<A %mt %rG
-external_acl_type squark_auth children=1 ttl=1800 negative_ttl=60 concurrency=128 grace=10 %SRC /usr/local/bin/squark-auth -c <communityname> -r <ip.of.switch> -i VLAN<id> -v <id>
+access_log /var/log/squid/access.log squark
-acl Zone_D_SquarkAuth external squark_auth
-</pre>
-Replace <communityname> with the SNMPv2 community name you have configured on your switch. Replace <ip.of.switch> with the IP of your switch, and replace <id> with the VLAN Id number of the VLAN that the clients will be connected to.
+# Permissions
+cache_effective_user squid
+cache_effective_group squid
-Here is an example to illustrate how the above configuration could look:
+# Allow hosts on <some.zone> to access internet
+http_access allow <some.zone> Zone_SquarkAuth
+</pre>
+As you can see in the above example, we refer to the acl "Zone_SquarkAuth" which is not yet created.<BR>
+The following examples will describe how to create it, depending on your needs.
+==== Configure squark-auth-snmp to use SNMPv2c ====
+Change ''(or edit)'' '/etc/squid/squid.conf' to reflect the following:
 <pre>
-#external ACL squid auth helper
+# External ACL squid auth helper
-# Squark authentication external acl
+external_acl_type squark_auth children-startup=1 children-max=1 ttl=1800 negative_ttl=60 concurrency=128 grace=10 \
-external_acl_type squark_auth children=1 ttl=1800 negative_ttl=60 concurrency=128 grace=10 %SRC /usr/local/bin/squark-auth -c public -r 192.168.0.1 -i VLAN5 -v 5
+  %SRC /usr/bin/squark-auth-snmp -f "%N-%i-%M" -c public -r 10.82.96.1 -i eth1.96 -R 10.82.72.226 -v 96
-acl Zone_D_SquarkAuth external squark_auth
+acl Zone_SquarkAuth external squark_auth
 </pre>
-{{Note| If you have multiple switches in your environment, Link Layer Discovery Protocol (LLDP) should be enabled in order for squark-auth to work properly. If the IP of the switch that you have specified is a core switch (such as in a star topology network, and the all the switches in your network have LLDP enabled (usually enabled by default), then your network topology should be automatically discoverable.}}
+{{Tip|For more information on the 'squark_auth' options available, run the command 'man squark-auth-snmp' in your terminal or browse the [https://git.alpinelinux.org/aports/tree/main/squark?h=master squark git tree].
-{{Note| For more information on the squark_auth options available, run the command '''man squark-auth'''.}}
+== Configure net-snmp ==
+=== Install net-snmp ===
+{{cmd|apk add net-snmp}}
-=== Optional: SNMP v3 Configuration ===
+=== Configure net-snmp ===
+==== Basic configuration ====
-Squark will use the configuration specified in '''/etc/snmp/snmp.conf''' when snmpv3 is specified as the preferred version of SNMP to use.
+Modify '/etc/snmp/snmpd.conf' to reflect at least the following:
+<pre>
+rocommunity public default
+syslocation  "Location of our equipment"
+sysservices  15
+syscontact  "ComputerDept <computerdept@foo.bar>"
+</pre>
+==== SNMPv3 Configuration (optional) ====
+Squark will use the configuration specified in '/etc/snmp/snmp.conf' when snmpv3 is specified as the preferred version of SNMP to use.
 Ensure that you have at least the following in '''/etc/snmp/snmp.conf''':
 <pre>
 defContext none
@@ Line 63: / Line 114: @@
 </pre>
-Adjust the above as dictated by the SNMP v3 configuration on your switch.
+{{Note|Adjust the above as dictated by the SNMPv3 configuration on your switch.}}
+== Start using it ==
+Start it all up
+{{cmd|rc-service squid start
+rc-service snmpd start}}
+Make sure to configure you services to autostart at next reboot
+{{cmd|rc-update add squid default
+rc-update add snmpd default}}
+== Debugging ==
+=== Squark ===
+If you are having trouble getting 'squark-auth-snmp' to give you the data you are wanting to see, you could run 'squark-auth-snmp' standalone in a terminal to debug your syntax.
+Run the 'squark-auth-snmp' command with the options you are planning to use ''(below is just a example on how that might look)'':
+{{cmd|/usr/bin/squark-auth-snmp -f "%N-%i-%M" -c public -r 10.82.72.221 -i eth1.96 -v 96}}
+{{Note|Running 'squark-auth-snmp' standalone in a terminal will not give you information on nearby switches. You would need to configure 'squark-auth-snmp' to ask a specific switch in order to query it for valid results.}}
+You will end up in the squark-proxy-cli mode.<BR>
+Feed the CLI with 2 values separated with a whitespace.
+# An index ''(this could basically be anything without a whitespace)''
+# An IP address of a host connected to your switch(es)
+The command entered in the CLI could look like this:
+{{cmd|a 10.82.96.123}}
+Either you get "a ERR" or "a OK user=<switchname>_<portname>_<mac address>" result which will help you in your debugging.
+[[Category:Networking]]
+[[Category:Server]]
+[[Category:Monitoring]]