mirror of
https://github.com/hsnodgrass/snmp_mib_archive.git
synced 2025-04-17 16:03:04 +00:00
492 lines
15 KiB
Plaintext
492 lines
15 KiB
Plaintext
|
|
-- *****************************************************************
|
|
-- CISCO-AAA-CLIENT-MIB.my: Cisco AAA Client MIB
|
|
--
|
|
-- February 2000, Edward Pham
|
|
-- May 2001, Liwei Lue
|
|
-- October 2001, Jayakumar Kadirvelu
|
|
--
|
|
-- Copyright (c) 2000-2001 by cisco Systems, Inc.
|
|
-- All rights reserved.
|
|
-- *****************************************************************
|
|
--
|
|
|
|
CISCO-AAA-CLIENT-MIB DEFINITIONS ::= BEGIN
|
|
|
|
IMPORTS
|
|
MODULE-IDENTITY,
|
|
OBJECT-TYPE,
|
|
Integer32
|
|
FROM SNMPv2-SMI
|
|
MODULE-COMPLIANCE,
|
|
OBJECT-GROUP
|
|
FROM SNMPv2-CONF
|
|
TEXTUAL-CONVENTION,
|
|
TruthValue
|
|
FROM SNMPv2-TC
|
|
ciscoMgmt
|
|
FROM CISCO-SMI;
|
|
|
|
|
|
ciscoAAAClientMIB MODULE-IDENTITY
|
|
LAST-UPDATED "200111190000Z"
|
|
ORGANIZATION "Cisco Systems, Inc."
|
|
CONTACT-INFO
|
|
" Cisco Systems
|
|
Customer Service
|
|
|
|
Postal: 170 W. Tasman Drive
|
|
San Jose, CA 95134
|
|
USA
|
|
|
|
Tel: +1 800 553-NETS
|
|
|
|
E-mail: cs-aaa@cisco.com"
|
|
DESCRIPTION
|
|
"This MIB module provides data for authentication method
|
|
priority based on Authentication, Authorization,
|
|
Accounting (AAA) protocols.
|
|
|
|
|
|
References:
|
|
The TACACS+ Protocol Version 1.78, Internet Draft
|
|
RFC 1411 Telnet Authentication: Kerberos Version 4.
|
|
RFC 1964 The Kerberos Version 5 GSS-API Mechanism.
|
|
"
|
|
REVISION "200111190000Z"
|
|
DESCRIPTION
|
|
"Deprecate object cacLockoutPeriod and add a new object
|
|
cacLockoutPeriodExt.
|
|
"
|
|
REVISION "200105100000Z"
|
|
DESCRIPTION
|
|
"Initial version
|
|
"
|
|
::= { ciscoMgmt 158 }
|
|
|
|
|
|
--
|
|
-- Textual Conventions
|
|
--
|
|
|
|
--
|
|
-- Session Type textual convention
|
|
--
|
|
SessionType ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Represents a session type.
|
|
|
|
telnet(1) indicates telnet session.
|
|
|
|
console(2) indicates console session.
|
|
|
|
http(3) indicates http session.
|
|
|
|
"
|
|
SYNTAX INTEGER {
|
|
telnet (1),
|
|
console (2),
|
|
http (3)
|
|
}
|
|
|
|
|
|
|
|
--
|
|
-- Authentication method textual convention
|
|
--
|
|
AuthenMethod ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Represents authentication method.
|
|
|
|
tacacs(1) indicates that TACACS method is used for
|
|
authentication.
|
|
|
|
radius(2) indicates that RADIUS method is used for
|
|
authentication.
|
|
|
|
kerberos(3) indicates that KERBEROS method is used
|
|
for authentication.
|
|
|
|
local(4) indicates that local password is used
|
|
for authentication. Which password is used depend
|
|
on what login mode users specified.
|
|
"
|
|
SYNTAX INTEGER {
|
|
tacacs (1),
|
|
radius (2),
|
|
kerberos (3),
|
|
local (4)
|
|
}
|
|
|
|
|
|
--
|
|
-- Login Mode textual convention
|
|
--
|
|
LoginMode ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Represents login mode.
|
|
|
|
login(1) indicates the normal mode.
|
|
|
|
enable(2) indicates the privileged mode.
|
|
"
|
|
SYNTAX INTEGER {
|
|
login (1),
|
|
enable (2)
|
|
}
|
|
|
|
|
|
-- AAA Client MIB objects definitions
|
|
|
|
cacMIBObjects OBJECT IDENTIFIER ::= { ciscoAAAClientMIB 1 }
|
|
|
|
|
|
-- The AAA Client MIB consists of the following groups
|
|
-- [1] AAA Client Priority Group (cacPriority)
|
|
-- [2] AAA Client Login Config Group (cacLoginConfig)
|
|
|
|
cacPriority OBJECT IDENTIFIER ::= { cacMIBObjects 1 }
|
|
cacLoginConfig OBJECT IDENTIFIER ::= { cacMIBObjects 2 }
|
|
|
|
|
|
|
|
|
|
--****************************************************************************
|
|
-- AAA Client Priority Group
|
|
--****************************************************************************
|
|
--
|
|
--
|
|
|
|
--
|
|
-- Priority Table
|
|
--
|
|
|
|
cacPriorityTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF CacPriorityEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This table contains entries for AAA authentication
|
|
methods configured in the system. At startup, agent
|
|
set up all the entries of the table. All authentication
|
|
methods will be disabled except local authentication will
|
|
be enabled for each session type and login mode. Users
|
|
later can enable/disable a specific authentication method
|
|
through cacEnable object.
|
|
|
|
The following table describes the startup state of each
|
|
authentication method and session type in normal login
|
|
mode and enable login mode.
|
|
|
|
AuthenMethod Console Session Telnet Session Http Session
|
|
------------ ---------------- ---------------- ------------
|
|
tacacs disabled disabled disabled
|
|
radius disabled disabled disabled
|
|
kerberos disabled disabled disabled
|
|
local enabled(*) enabled(*) enabled(*)
|
|
|
|
(*) denotes primary method.
|
|
"
|
|
::= { cacPriority 1 }
|
|
|
|
cacPriorityEntry OBJECT-TYPE
|
|
SYNTAX CacPriorityEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry containing the priority number of an authentication
|
|
method used in a session.
|
|
"
|
|
INDEX { cacSession, cacAuthen, cacLoginMode }
|
|
::= { cacPriorityTable 1 }
|
|
|
|
|
|
CacPriorityEntry ::=
|
|
SEQUENCE {
|
|
cacSession SessionType,
|
|
cacAuthen AuthenMethod,
|
|
cacLoginMode LoginMode,
|
|
cacEnable TruthValue,
|
|
cacPriorityNumber Integer32,
|
|
cacPrimaryMethod TruthValue
|
|
}
|
|
|
|
|
|
cacSession OBJECT-TYPE
|
|
SYNTAX SessionType
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the session type used to connect to the network
|
|
device.
|
|
"
|
|
::= { cacPriorityEntry 1 }
|
|
|
|
|
|
cacAuthen OBJECT-TYPE
|
|
SYNTAX AuthenMethod
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the authentication method used to authenticate
|
|
users.
|
|
"
|
|
::= { cacPriorityEntry 2 }
|
|
|
|
|
|
cacLoginMode OBJECT-TYPE
|
|
SYNTAX LoginMode
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the login mode user used to login to the network
|
|
device.
|
|
"
|
|
::= { cacPriorityEntry 3 }
|
|
|
|
|
|
cacEnable OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"It indicates whether the authentication method denoted by
|
|
cacAuthen is enabled or not.
|
|
|
|
When this object is true(1), the authentication method denoted
|
|
by cacAuthen is enabled.
|
|
|
|
When this object is false(2), the authentication method denoted
|
|
by cacAuthen is disabled.
|
|
|
|
If the value of cacAuthen is local, the value of this
|
|
object cannot be set to false(2).
|
|
"
|
|
::= { cacPriorityEntry 4 }
|
|
|
|
|
|
cacPriorityNumber OBJECT-TYPE
|
|
SYNTAX Integer32 (0..4)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the priority number of an authentication method to
|
|
be used in user authentication for a session. This value is
|
|
automatically assigned and reflects the relative priority
|
|
of the authentication method denoted by cacAuthen with
|
|
respected to already configured authentication methods.
|
|
It is assigned in the order in which the authentication
|
|
method is enabled by the user through cacEnable.
|
|
The higher value has the higher priority. This object
|
|
is used to determine the fallback order in case the
|
|
primary authentication method indicated by cacPrimaryMethod
|
|
failed.
|
|
|
|
If the authentication method denoted by cacAuthen is disabled
|
|
for the type of session denoted by cacSession, the value
|
|
of this object is equal to 0.
|
|
"
|
|
::= { cacPriorityEntry 5 }
|
|
|
|
|
|
cacPrimaryMethod OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"It indicates whether the authentication method denoted by
|
|
cacAuthen is the primary (first one to be tried) method
|
|
when there are multiple authentication method configured.
|
|
|
|
Setting this object to true(1) will make the authentication
|
|
method denoted by cacAuthen to be the primary authentication
|
|
method for the session denoted by cacSession. The previously
|
|
configured primary method will be changed to false(2).
|
|
|
|
Setting this object to false(2) is not allowed.
|
|
"
|
|
::= { cacPriorityEntry 6 }
|
|
|
|
|
|
-- -------------------------------------------------------------
|
|
-- AAA Client Login Config Group
|
|
-- -------------------------------------------------------------
|
|
|
|
cacLoginConfigTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF CacLoginConfigEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A table that contains login configuration
|
|
which is associated with this system.
|
|
"
|
|
::= { cacLoginConfig 1 }
|
|
|
|
cacLoginConfigEntry OBJECT-TYPE
|
|
SYNTAX CacLoginConfigEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry containing the configuration of the login.
|
|
"
|
|
INDEX { cacLoginMode, cacSession }
|
|
::= { cacLoginConfigTable 1 }
|
|
|
|
CacLoginConfigEntry ::=
|
|
SEQUENCE {
|
|
cacMaxLoginAttempt Integer32,
|
|
cacLockoutPeriod Integer32,
|
|
cacLockoutPeriodExt Integer32
|
|
}
|
|
|
|
cacMaxLoginAttempt OBJECT-TYPE
|
|
SYNTAX Integer32 (0|3..10)
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates the maximum number of login attempts allowed.
|
|
Setting this variable to 0 will disable the attempt
|
|
limit checking.
|
|
|
|
If the login session type does not support this attempt
|
|
limit checking, the value of this object can only be set
|
|
to 0.
|
|
"
|
|
DEFVAL { 3 }
|
|
::= { cacLoginConfigEntry 1 }
|
|
|
|
|
|
cacLockoutPeriod OBJECT-TYPE
|
|
SYNTAX Integer32 (0|30..600)
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-write
|
|
STATUS deprecated
|
|
DESCRIPTION
|
|
"Indicates the lockout period after the maximum number
|
|
of login attempt is met. For console, the console input
|
|
will be frozen during this period. For remote logins, the
|
|
connection will be closed and any subsequent access
|
|
from that station will be closed during the lockout time.
|
|
|
|
Setting this variable to 0 will disable the lockout.
|
|
If the login session type does not support this lockout
|
|
period, the value of this object can only be set to 0.
|
|
|
|
If the lockout period is greater than the maximum value
|
|
reportable by this object then this object should report
|
|
its maximum value (600) and cacLockoutPeriodExt must be
|
|
used to report the lockout period.
|
|
"
|
|
DEFVAL { 30 }
|
|
::= { cacLoginConfigEntry 2 }
|
|
|
|
cacLockoutPeriodExt OBJECT-TYPE
|
|
SYNTAX Integer32 (0|30..43200)
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Specifies the lockout period after the maximum number
|
|
of login attempt is met. For console, the console input
|
|
will be frozen during this period. For remote logins, the
|
|
connection will be closed and any subsequent access
|
|
from that station will be closed during the lockout time.
|
|
|
|
Setting this variable to 0 will disable the lockout.
|
|
If the login session type does not support this lockout
|
|
period, the value of this object can only be set to 0.
|
|
"
|
|
DEFVAL { 30 }
|
|
::= { cacLoginConfigEntry 3 }
|
|
|
|
--****************************************************************************
|
|
-- Notifications
|
|
--****************************************************************************
|
|
cacMIBNotifications OBJECT IDENTIFIER ::= { ciscoAAAClientMIB 2 }
|
|
|
|
|
|
|
|
|
|
cacMIBConformance OBJECT IDENTIFIER ::=
|
|
{ ciscoAAAClientMIB 3 }
|
|
cacMIBCompliances OBJECT IDENTIFIER ::=
|
|
{ cacMIBConformance 1 }
|
|
cacMIBGroups OBJECT IDENTIFIER ::=
|
|
{ cacMIBConformance 2 }
|
|
|
|
-- compliance statements
|
|
|
|
cacMIBCompliance MODULE-COMPLIANCE
|
|
STATUS deprecated
|
|
DESCRIPTION
|
|
"The compliance statement for entities which
|
|
implement the CISCO AAA Client MIB"
|
|
MODULE -- this module
|
|
MANDATORY-GROUPS
|
|
{
|
|
cacPriorityGroup,
|
|
cacLoginConfigGroup
|
|
}
|
|
::= { cacMIBCompliances 1 }
|
|
|
|
|
|
cacMIBCompliance2 MODULE-COMPLIANCE
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The compliance statement for entities which
|
|
implement the CISCO AAA Client MIB"
|
|
MODULE -- this module
|
|
MANDATORY-GROUPS
|
|
{
|
|
cacPriorityGroup,
|
|
cacLoginConfigGroupRev1
|
|
}
|
|
::= { cacMIBCompliances 2 }
|
|
|
|
-- units of conformance
|
|
|
|
|
|
cacPriorityGroup OBJECT-GROUP
|
|
OBJECTS {
|
|
cacEnable,
|
|
cacPriorityNumber,
|
|
cacPrimaryMethod
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A collection of objects providing the
|
|
AAA client priority information.
|
|
"
|
|
::= { cacMIBGroups 1 }
|
|
|
|
|
|
cacLoginConfigGroup OBJECT-GROUP
|
|
OBJECTS {
|
|
cacMaxLoginAttempt,
|
|
cacLockoutPeriod
|
|
}
|
|
STATUS deprecated
|
|
DESCRIPTION
|
|
"A collection of objects providing the
|
|
AAA client login configuration.
|
|
"
|
|
::= { cacMIBGroups 2 }
|
|
|
|
cacLoginConfigGroupRev1 OBJECT-GROUP
|
|
OBJECTS {
|
|
cacMaxLoginAttempt,
|
|
cacLockoutPeriodExt
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A collection of objects providing the
|
|
AAA client login configuration.
|
|
"
|
|
::= { cacMIBGroups 3 }
|
|
|
|
END
|
|
|