View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)
obsoleted by
- rfc-2275 — View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)
Extracted elements (24)
Appendix A prescribes three installation security configurations (initial-minimum-security, initial-semi-security, initial-no-access) to let operators choose a tradeoff between out-of-box manageability and initial access restriction.
The ViewTreeFamily bitmask mechanism was introduced because specifying all columns of a single MIB table row (each in a separate subtree) would require an impractically large number of individual subtree entries; the mask aggregates them into one structure.
For securityLevel noAuthNoPriv, all groups are functionally equivalent because the assumption that securityName has been authenticated does not hold. The vacmAccessTable note explicitly flags this for implementors.
A conformant implementation MUST implement the SNMP-VIEW-BASED-ACM-MIB and SHOULD implement the initial configuration described in Appendix A.
If an implementation receives a create request for an instance-level access control entry but does not support instance-level granularity, it MUST return an inconsistentName error.
The isAccessAllowed procedure MUST execute five steps in order: (1) check vacmContextTable for contextName; (2) look up groupName in vacmSecurityToGroupTable; (3) look up access entry in vacmAccessTable; (4) select view name by viewType, returning noSuchView if the view name is empty; (5) check variableName membership in the view.
The vacmContextTable MUST be made accessible via the default context so that Command Responder applications have a standard way of retrieving the list of available contexts.
When multiple vacmAccessTable entries match a request, selection proceeds by: (a) prefer entries with an identical securityModel over 'any'; (b) prefer entries with an exact contextPrefix match; (c) prefer the longest matching contextPrefix; (d) select the entry with the highest securityLevel.
When multiple vacmViewTreeFamilyTable entries match an OID, the entry whose vacmViewTreeFamilySubtree has the most sub-identifiers determines inclusion or exclusion. Ties are broken by the lexicographically greatest value of vacmViewTreeFamilyType.
A group is a set of zero or more (securityModel, securityName) tuples sharing identical access rights. The combination of securityModel and securityName maps to at most one groupName, looked up via the vacmSecurityToGroupTable.
A ViewTreeFamily pairs an OBJECT IDENTIFIER (family name) with a bitmask (family mask). An OID belongs to the family if it has at least as many sub-identifiers as the family name and each sub-identifier matches where the corresponding mask bit is 1; mask bit 0 is a wildcard.
An access policy entry (vacmAccessEntry) is indexed by groupName, contextPrefix, securityModel, and securityLevel and contains three view references: vacmAccessReadViewName, vacmAccessWriteViewName, and vacmAccessNotifyViewName, any of which may be the empty string (no access).
securityLevel defines three access tiers: noAuthNoPriv, authNoPriv, and authPriv. VACM uses securityLevel as an input to the access-control check and as an index in the vacmAccessTable, with higher levels granting more privileged access.
The isAccessAllowed abstract service primitive takes securityModel, securityName, securityLevel, viewType (read/write/notify), contextName, and variableName as inputs and returns one of: accessAllowed, notInView, noSuchView, noSuchContext, noGroupName, noAccessEntry, or otherError.
vacmAccessTable is indexed by (vacmGroupName, vacmAccessContextPrefix, vacmAccessSecurityModel, vacmAccessSecurityLevel). vacmAccessContextMatch selects either exact(1) or prefix(2) matching of the contextName against vacmAccessContextPrefix.
vacmContextTable lists locally available SNMP contexts by contextName (SnmpAdminString SIZE 0..32). It is read-only and cannot be configured via SNMP; the empty string represents the default context.
vacmSecurityToGroupTable maps (vacmSecurityModel, vacmSecurityName) to vacmGroupName. The index vacmSecurityModel MUST NOT be 0 (the 'any' value). Entries carry RowStatus and StorageType columns for lifecycle management.
vacmViewSpinLock is a TestAndIncr advisory lock used to coordinate concurrent SNMP Command Generators when creating or modifying views. Its use is not enforced; implementations rely on cooperating managers to consult it.
vacmViewTreeFamilyTable stores included and excluded subtree families for each named MIB view, indexed by (vacmViewTreeFamilyViewName, vacmViewTreeFamilySubtree). vacmViewTreeFamilyType is either included(1) or excluded(2).
This document defines the SNMP-VIEW-BASED-ACM-MIB MODULE-IDENTITY at OID snmpModules 5 (1.3.6.1.6.3.16), including vacmContextTable, vacmSecurityToGroupTable, vacmAccessTable, vacmViewTreeFamilyTable, and associated conformance objects.
The vacmSecurityToGroupTable does not factor in securityLevel. Administrators must use the securityLevel index in vacmAccessTable to prevent noAuthNoPriv principals from gaining the same access as authPriv principals.
VACM assumes the calling module has already enforced authentication and privacy as specified by the passed securityLevel; VACM itself performs no authentication. The securityName is treated as already authenticated.
When creating entries in vacmViewTreeFamilyTable, excluded entries SHOULD be created before included entries. When deleting, included entries SHOULD be deleted before excluded entries. Reversing this order can transiently grant unwanted access.
vacmViewTreeFamilyMask is an OCTET STRING of SIZE 0..16. The most significant bit of the i-th octet corresponds to the (8i−7)-th sub-identifier of vacmViewTreeFamilySubtree; '1' requires exact match, '0' is wildcard. If the mask is shorter than the subtree OID, it is implicitly extended with 1s.