SNMPD.CONF(5)

NAME
snmpd.conf - SNMP daemon configuration file

DESCRIPTION
snmpd.conf is the configuration file for the snmpd(8) daemon.

The snmpd.conf file is divided into the following main sections:

Macros
    Definitions of variables that can be used later, simplifying the configuration file.

Global configuration
    Global runtime settings for snmpd(8).

User configuration
    USM user definitions.

OID configuration
    Custom configuration of SNMP object identifiers and values.

The current line can be extended over multiple lines using a backslash (‘\’). Comments can be put anywhere in the file using a hash mark (‘#’), and extend to the end of the current line. Care should be taken when commenting out multi-line text: the comment is effective until the end of the entire block.

Arguments not beginning with a letter, digit, or underscore must be quoted.

Additional configuration files can be included with the include keyword, for example:

    include "/etc/snmpd.conf.local"

  Macros
A macro is defined with a command of the form name=value. The macro name can contain letters, digits, and underscores and cannot be a reserved word (for example, community, system, or oid). Within unquoted arguments, the string $name is later expanded to value.

For example:

    ext_addr="192.168.0.1"
    listen on $ext_addr

  Global configuration
The following options can be set globally:

blocklist oid
    Remove the oid subtree from view. Multiple blocklist statements are supported.

filter-routes (yes | no)
    If set to yes, ask the kernel to filter route update messages on the routing socket. Routing table information will not be available, but CPU use will be reduced during bulk updates. The default is no.

listen on [tcp | udp] address [port port] [flags]
    Specify the local address snmpd(8) should listen on for incoming SNMP messages, or any to listen on all local IPv4 and IPv6 addresses. Multiple listen on statements are supported. If no listen on statement is present, the default is listen on any.

    The flags are as follows:

    read
        Accept get, getnext and bulkget requests.

    write
        Accepts set requests.

    notify
        Accepts trapv1 and trapv2 requests.

    snmpv1
        Enable SNMPv1 subsystem on the listen address.

    snmpv2c
        Enable SNMPv2c subsystem on the listen address.

    snmpv3
        Enable SNMPv3 subsystem on the listen address.

    The default protocol is udp. The default port is 161, unless notify is the only permission flag; which sets the port to 162. If no permission flags are specified it defaults to “read write”, or notify when port is 162. If no subsystem flags are specified, it defaults to snmpv3.

    Having notify set requires at least one trap handle statement.

agentx [path path] [owner owner] [group group] [mode mode]
    Set up an agentx master socket at path and defaults to /var/agentx/master. Socket owner, group, and permissions can be set with owner, group, and mode respectively and defaults to root, _agentx, and 660. Multiple agentx statements are supported. Only unix sockets are supported.

engineid [pen enterprise] format
    Set the snmp engineid, used for instance identification and key generation for the user auth and key. enterprise specifies the private enterprise number of the instance and can be either an integer or openbsd (default).

    format can be one of the following:

    ipv4 address
        The engineID's format identifier is set to 1 and the ipv4 address is used in the format.

    ipv6 address
        The engineID's format identifier is set to 2 and the ipv6 address is used in the format.

    mac address
        The engineID's format identifier is set to 3 and the mac address is used in the format.

    text text
        The engineID's format identifier is set to 4 and the ASCII text is used in the format.

    octets octetstring
        The engineID's format identifier is set to 5 and the octetstring in hexadecimal is used in the format.

    hosthash [hostname]
        The engineID's format identifier is set to 129 and the first 27 bytes of the sha256 hash of the hostname are used in the format. This option is only valid for enterprise openbsd. If used for the local engineID, then hostname defaults to the value of hostname(1). This format is the default.

    number octetstring
        The engineID's format identifier is set to number and the octetstring in hexadecimal is used in the format. This format is only available if enterprise is not openbsd.

    agentid octetstring
        RFC1910 legacy format. octetstring must be 8 bytes (or 16 characters in hexadecimal format).

mib directory path
    Specify which directories to recursively search for MIB files. Multiple directories can be specified. If no directory is specified it defaults to /usr/share/snmp/mibs.

read-only community string
    Specify the name of the read-only community. There is no default value.

read-write community string
    Specify the name of the read-write community. There is no default value.

seclevel (none | auth | enc)
    Specify the lowest security level that snmpd(8) accepts on SNMPv3:

    none
        Both authentication and encryption of messages is optional.

    auth
        Authentication of messages is mandatory. snmpd(8) will discard any messages that don't have a valid digest. Encryption of messages is optional.

    enc Messages must be encrypted and must have a valid digest for authentication. Otherwise they will be discarded. This is the default value.

system contact string
    Specify the name or description of the system contact, typically a name or an email address. The default value is root@hostname using the hostname of the local machine.

system description string
    Specify a description of the local system. The default value is the operating system identification as printed by the uname(1) command using the -a flag:

        OpenBSD myhost.example.com 4.2 GENERIC#595 i386

system location string
    Specify the string describing the location of the local system, typically a physical location. The default value is an empty string.

system name string
    Specify the name of the local system, typically a fully-qualified domain name. The default value is the hostname of the local system.

system oid oid-string
    Specify the authoritative identification of the local system. The default value is 1.3.6.1.4.1.30155.23.1 (iso.org.dod.internet.private.enterprises.openbsd.23.1) identifying a common OpenBSD system.

system services number
    Specify a magic value which indicates the set of services that the local system may provide. Refer to the sysServices description in the SNMP MIB for details. The value is given in decimal.

trap community string
    Specify the name of the trap community. There is no default value.

trap handle oid "command"
    Execute command upon receipt of an SNMP trap that begins with a prefix of oid. Alternately, the string "default" may be used, in which case the prefix used is 1.3. The invoked command will receive the following information about the trap on standard input, one per line, in this order: the resolved hostname of the host sending the trap, the IP address of the host sending the trap, and any variable bindings contained in the trap (the OID followed by the value, separated by a single space). This option requires at least one listen on statement with a notify flag set. Traps over SNMPv3 are currently unsupported.

    trap receiver address [oid oid-string] snmpv2c [community string] [source-address address] Specify the address or FQDN of a remote trap receiver for outgoing traps sent by snmpd(8). This option may be specified multiple times. The daemon will send outgoing traps in snmpv2c format. The default community is specified by the global trap community option. The IPv4 or IPv6 source address of the traps can be enforced using

    trap receiver address [oid oid-string] [snmpv3] user name [seclevel level] [source-address address] Specify the address or FQDN of a remote trap receiver for outgoing traps sent by snmpd(8). This option may be specified multiple times. The daemon will send outgoing traps in snmpv3 format. user must point to an existing global user. If seclevel is not defined, it defaults to the global seclevel option. The IPv4 or IPv6 source address of the traps can be enforced using source-address.

  User configuration
Users for the SNMP User-based Security Model (USM, RFC 3414) must be defined in the configuration file:

    user name [authkey key auth hmac] [enckey key enc cipher] Defines a known user. The authkey keyword is required to specify the digest key used to authenticate messages. If this keyword is omitted then authentication is disabled for this user account. Optionally the HMAC algorithm used for authentication can be specified. hmac must be either hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, or hmac-sha512. If omitted, the default is hmac-sha1.

    With enckey the encryption key used to encrypt and decrypt messages for privacy is defined. Without an enckey specification the user account will neither accept encrypted incoming messages nor will it encrypt outgoing messages. The enc algorithm can be either des or aes and defaults to aes.

    Any user account that has encryption enabled requires authentication to be enabled too.

  OID configuration
It is possible to specify user-defined OIDs in the configuration file:

    oid oid-string name name [read-only | read-write] [type] value Return the specified value to the client for this OID. The read-write option may allow the client to override it, and the type is either string or integer.

FILES
/etc/snmpd.conf
    Default location of the configuration file.
/etc/examples/snmpd.conf
    Example configuration file.

EXAMPLES
The following example will tell snmpd(8) to listen on localhost for SNMPv2c messages only with the community “8LHQtm1QLGzk”, override the default system OID, set the magic services value, and provide some custom OID values:

    listen on 127.0.0.1 snmpv2c
    read-only community 8LHQtm1QLGzk
    system oid 1.3.6.1.4.1.30155.23.2
    system services 74
    oid 1.3.6.1.4.1.30155.42.1 name myName read-only string "humppa"
    oid 1.3.6.1.4.1.30155.42.2 name myStatus read-only integer 1

The next example will enforce SNMPv3 with authenticated and encrypted communication and the user-based security model. The configuration defines several users using varying encryption and authentication algorithms.

    seclevel enc
    user "mgmt" auth hmac-sha256 authkey "password123" enc aes enckey "321drowssap"
    user "hans" auth hmac-sha1 authkey "password456" enc aes enckey "654drowssap"
    user "sophie" auth hmac-md5 authkey "password789" enc des enckey "987drowssap"

SEE ALSO
snmp(1), snmpd(8)

HISTORY
The snmpd.conf file format first appeared in OpenBSD 4.3.

AUTHORS
The snmpd(8) program was written by Reyk Floeter <reyk@openbsd.org>.