System: Detected an unauthorized user attempting to access the SNMP interfa

[BillP]

Greetings,

I've seen a number of posts on this topic but have not seen a response that fixes my problem. Since having installed PowerChute Network Shutdown on my server, I am receiving this alert from the two UPS's that I have configured in the software. I receive 8 alerts from each UPS at 2:00 AM, 9:00 AM, 4:00 PM and 11:00 PM.

Name : UPSSERVER2
Location :
Contact :
http://UPSSERVER2.
http://192.168.100.4

Serial # :
Device Ser #:
Date: 09/02/2010
Time: 08:03:02
Code: 0x0004

Informational - System: Detected an unauthorized user attempting to access the SNMP interface from 192.168.100.10.

192.168.100.10 is the Windows 2003 server on which the PCNS utility is installed.

PowerChute Network Shutdown 2.2.4 for Microsoft® Windows®. Build 954

I have disabled SNMP from the HP printer driver that is installed on the server.

This is a file and print server so there is no other network monitoring software running on it that would explain this.

I don't see anywhere in the PCNS utility to even configure an SNMP string. It only asks for the administrator's userid, password and authentication phrase.


The management card has been upgraded with the latest OS.

Hardware Factory

Model Number: AP9617
Serial Number:
Hardware Revision: A10
Manufacture Date: 05/11/2007
MAC Address:
Management Uptime: 8 Days 20 Hours 29 Minutes


Application Module

Name: sumx
Version: v3.7.2
Date: 02/02/2010
Time: 19:08:16


APC OS (AOS)

Name: aos
Version: v3.7.3
Date: 02/02/2010
Time: 17:05:14


Because I have another UPS on the same network that is not reporting this SNMP attempt, I have got to believe that it is the PCNS utility sending unicast SNMP requests to these two UPS's. How can I configure the proper SNMP string in this utility to make these alerts stop?

TIA

Jeff

[BillP]

Hello LandLord,

Are you using SNMP on your network or on this UPS? If not, please login to the network management cards web interface and then click on the Administration tab. Then click on Network, from there you'll see SNMPv1 and SNMPv3. Click on access on both of them and if you see a check mark where it says Enable SNMPV1 or SNMPv3 access, click on it to remove the mark and hit on apply. After applying the settings you need to log off and wait for 1-2 minutes for the card to reboot.

[BillP]

Are you using SNMPv1 or SNMPv3? On the NMC interface whether you choose SNMP1 or 3 there should be a link that would take you on the configuration page for the community string and the NMPS IP/Hostname.

[BillP]

We are using SNMPv1. SNMPv3 is disabled. The NMS can see the UPS just fine. That is not the problem.

The PCNS server is the offending server. I have sniffed the packets and found it to be sending an SNMP query using the community string of 'public' to the UPS's configured when the software was installed.

How does one make the PCNS stop trying to communicate with the UPS's using SNMP and/or how does one change the string it's using?

Jeff

[BillP]

Let me see if I could find more information about this.

[BillP · Accepted solution]

Good day Jeff,

Can you download the config.ini, event.txt and data.txt of your NMC and attach it here in the forum and or send it to me thru PM? Also this it what I got from our product specialist. PowerChute Network Shutdown (PCNS) has no SNMP functionality/ libraries on it. By default our NMC has SNMPV1 enabled and it uses community string of public and it uses UDP port 161. PCNS sends UDP packets but it is using port 3052.

[BillP]

i have never seen this issue just randomly happen. there must be something running on that server, totally unrelated to PCNS, that is trying to do some SNMP GETs/walks or something and keeps hitting the NMC but it is not authorized to do so.

[BillP]

Hi Jeff,

I would like to double check with you. Based from you event log the IP address of the node that tries to access your NMC using SNMP is 192.168.100.10. Is this correct? Is this the IP address of the PC where the PCNS software is installed as well?

[BillP]

i have an idea - since this is happening quite frequently, can you possibly just turn off/stop the APC Powerchute Network Shutdown service via Administrative Tools for 10-15 minutes to see if the messages stop, then don't forget to restart it after your testing. once the service is stopped, if you access PCNS at http://127.0.0.1:6547 or however you access it, it should not respond since the service is stopped. it of course would also say stopped in the services window.

[BillP]

Greetings,

I've seen a number of posts on this topic but have not seen a response that fixes my problem. Since having installed PowerChute Network Shutdown on my server, I am receiving this alert from the two UPS's that I have configured in the software. I receive 8 alerts from each UPS at 2:00 AM, 9:00 AM, 4:00 PM and 11:00 PM.

Name : UPSSERVER2
Location :
Contact :
http://UPSSERVER2.
http://192.168.100.4

Serial # :
Device Ser #:
Date: 09/02/2010
Time: 08:03:02
Code: 0x0004

Informational - System: Detected an unauthorized user attempting to access the SNMP interface from 192.168.100.10.

192.168.100.10 is the Windows 2003 server on which the PCNS utility is installed.

PowerChute Network Shutdown 2.2.4 for Microsoft® Windows®. Build 954

I have disabled SNMP from the HP printer driver that is installed on the server.

This is a file and print server so there is no other network monitoring software running on it that would explain this.

I don't see anywhere in the PCNS utility to even configure an SNMP string. It only asks for the administrator's userid, password and authentication phrase.


The management card has been upgraded with the latest OS.

Hardware Factory

Model Number: AP9617
Serial Number:
Hardware Revision: A10
Manufacture Date: 05/11/2007
MAC Address:
Management Uptime: 8 Days 20 Hours 29 Minutes


Application Module

Name: sumx
Version: v3.7.2
Date: 02/02/2010
Time: 19:08:16


APC OS (AOS)

Name: aos
Version: v3.7.3
Date: 02/02/2010
Time: 17:05:14


Because I have another UPS on the same network that is not reporting this SNMP attempt, I have got to believe that it is the PCNS utility sending unicast SNMP requests to these two UPS's. How can I configure the proper SNMP string in this utility to make these alerts stop?

TIA

Jeff