The Definitions of Managed Objects for the Security Protocols of the Point-to-Point Protocol
Extracted elements (20)
Implementation of the PPP Security Group is optional because its variables provide configuration and control for PPP security functions, which should be protected by SNMPv2 security. Agents not supporting SNMPv2 with privacy are strongly advised not to implement this group.
Objects were selected for the MIB by applying four criteria: essentiality for fault or configuration management, evidence of current use, limiting total object count, and excluding objects derivable from other MIBs. Debug-only objects were explicitly excluded.
Management stations must be prepared to receive tabular information from agents corresponding to entries not currently in use (status = invalid), as it is implementation-specific whether agents remove invalidated entries from pppSecurityConfigTable or pppSecuritySecretsTable.
If the semantics of a MIB group are applicable to an implementation, then all objects in the group MUST be implemented. MIB Groups are the basic unit of conformance.
pppSecurityConfigEntry is indexed by pppSecurityConfigLink and pppSecurityConfigPreference and contains four fields: link identifier, preference value, protocol OID, and status.
pppSecurityConfigLink is an INTEGER(0..2147483647) identifying the ifIndex of the PPP link; a value of 0 indicates a default entry applying to all links for which no explicit entry exists.
pppSecurityConfigPreference is an INTEGER(0..2147483647) specifying relative preference order for security protocols; lower values are tried before higher values.
pppSecurityConfigProtocol is an OBJECT IDENTIFIER identifying the security protocol (PAP or CHAP-MD5) to attempt on a given link at a given preference level.
pppSecurityConfigStatus is an INTEGER with values invalid(1) or valid(2), defaulting to valid(2). Setting it to invalid(1) invalidates the corresponding table entry; agents may or may not remove invalidated entries.
pppSecurityConfigTable contains configuration and preference parameters for PPP Security, allowing the network manager to configure which security protocols are used on which link and in what order of preference.
pppSecuritySecretsDirection is an INTEGER with values local-to-remote(1) or remote-to-local(2), specifying whether the ID/Secret pair is used by the local entity when authenticating to the remote or expected from the remote entity.
pppSecuritySecretsIdentity is an OCTET STRING (SIZE 0..255) whose semantics depend on the protocol: for PAP it holds the Peer-ID; for CHAP-MD5 it holds the CHAP NAME parameter.
pppSecuritySecretsSecret is an OCTET STRING (SIZE 0..255) whose semantics depend on the protocol: for PAP it holds the PAP Password; for CHAP-MD5 it holds the CHAP MD5 Secret.
pppSecuritySecretsStatus is an INTEGER with values invalid(1) or valid(2), defaulting to valid(2), used to invalidate ID/Secret pairs without necessarily removing them from the table.
pppSecuritySecretsTable contains ID/Secret pairs used by PPP authentication protocols, supporting both local-to-remote and remote-to-local directions with multiple pairs per link via pppSecuritySecretsIdIndex.
Two protocol OID constants are defined: pppSecurityPapProtocol ({ pppSecurityProtocols 1 }) and pppSecurityChapMD5Protocol ({ pppSecurityProtocols 2 }), used to identify the authentication protocol in table entries.
Implementing security variables as READ-ONLY is explicitly not recommended because the PPP Authentication Protocol variables (peer identities and secrets) would still be readable and represent an unacceptable security risk.
Security-sensitive variables are placed in separate optional MIB Groups and separate MIB Tables to allow implementors to omit them entirely or restrict access via SNMPv2 MIB views with authentication and privacy protocols.
The PPP MIB contains objects defining PPP Peer Identities (analogous to userids) and authentication secrets (analogous to passwords). An intruder with write access could disable PPP security entirely by manipulating security configuration variables.
To preserve integrity and privacy of PPP security features, implementations MUST allow access to this MIB only via SNMPv2 with privacy enhancement. Access via SNMPv1 or SNMPv2 without privacy is described as 'very dangerous' and may compromise PPP service security.