unauthorized user attempting to access the SNMP interface

[Anonymous user]

model Smart-UPS RT 3000 XL
Unit is sending me an email and logging "System: Detected an unauthorized user attempting to access the SNMP interface from 172.20.1.9." in the error log.

Under SNMP access control that IP has a read access enabled.

[Anonymous user]

Hello,

You can always try just updating the firmware on your Network Card. The Firmware Executable can be found through the following link:

http://www.apcc.com/tools/download/software_comp.cfm?sw_sku=SFSUMX355&id=55&family=&part_num=&swfam=...

Other than that, you may want to carefully read what dirtfoot offered, because it does explain indepth how these errors come about.

Thanks.

[Anonymous user · Accepted solution]

Hello,

Which firmware revision is on the card? Do you know if it is 2.x or 3.x firmware?

For 2.x you can find the firmware under Help/About system. Under 3.x it should be under Administration/General/About.

Are there other Ip addresses listed under your SNMP section, or is the one you listed the only one?

Have you tried rebooting the management interface? To do so,

2.x is System/Tools/Reboot Management Interface

3.x is Administration/General/Reset-Reboot/Reboot Management Interface

Are there any other events that are getting logged that don't seem to be correct?

[Anonymous user]

Can't find a firmware for the card. Where do I find it using the web interface? Unit itself is 450.14.W.
There is one other IP located in the access control section.
The user attempting access the system is our monitoring system checking to see if the IP is still active/online.

Message was edited by: cbotari

[Anonymous user]

Hello,

What does the interface look like? Are all of the icons listed at the top with a blue background, or are they listed on the side with a white background?

Blue background: Administration/General/About.

White: Help/About System

Have you tried rebooting the management interface? To do so,

White background: is System/Tools/Reboot Management Interface

Blue background is Administration/General/Reset-Reboot/Reboot Management Interface

[Anonymous user · Accepted solution]

Left side, blue background, no icons just text.
hardware rev A10
Application module information version 2.6.1
APC OS(AOS) infomatiion version 2.6.4

[Anonymous user]

Is your read community string correct? The community name can be a maximum of 15 characters. If you are using any non standard characters, could you try somthing simpler just for test purposes? That would be an easy way to find out if the problem is the comm string, and you can stop looking elsewhere.

Is your NMS actually able to read the data from the Management card in spite of the alarm on the card, or is the GET being blocked? If it is getting the data it is polling for, perhaps the NMS is trying to write as well? If that is the case, you would need to configure write access as on the card as well.


You may already be familiar with this, but sometimes a clear definition of the SNMP access settings, and how they work can be helpful. This was taken from the help section of the Management Card (clicking the '?' in the top right area of your web interface.)


NMS IP/Domain Name IP address or domain name of the allowed NMS stations - Limits the access to the NMS or NMSs specified by the format used for the IP address.

159.215.12.1 allows only the NMS with that specified IP address or host name to have access.
159.215.12.255 allows access for any NMS on the 159.215.12 segment.
159.215.255.255 allows access for any NMS on the 159.215 segment.
159.255.255.255 allows access for any NMS on the 159 segment.
0.0.0.0 or 255.255.255.255 allows access for any NMS (Default).


SNMP Access Types:

Read - The NMS can use GETS at any time, but cannot use SETS.

Write - The NMS can use GETS at any time, and can use SETS when no user is logged into the Web or Control Console interfaces.

Write+ - The NMS can use GETS and SETS at any time, even when a user is logged into the Web or Control Console interfaces.

Disabled - The NMS cannot use GETS and SETS.

[Anonymous user]

You totally lost me with all that stuff. I thought there might be some simple setting that I missed when setting it up. I guess I will just ignore the errors.

[Anonymous user]

The Community string is like a password. In order for the management card to allow anyone/anything to get infomration from it via SNMP, the person or device accessing it must present the correct password (a matching community string). The person or device accessing the card must also be from an allowed IP address - all the IP settings I posted in my last response show how to enable specific IP addresses, or ranges of addresses.

If both the IP address of whatever is accessing the card is not allowed (based on the settings), and/or the community string does not match, the card will produce the event you are seeing in your log.

[Anonymous user]

I see the community name. I presume that is the same a community string. It is set the same as my 5 other UPSs. There is a second IP with the same community name that formerly gave this error until I entered it in the SNMP acces page. I am trying to verify with the network guys if they are using the same string everywhere.

Updating the firmware is beyond the scope my authorization.

[Anonymous user]

Have you tried rebooting the management interface as of yet? Go to System/Tools/Reboot Management Interface. This only reboots the card, not the UPS.

[Anonymous user]

I would try the reboot whenever you get a chance, just in case something in the card is sending out notifications incorrectly and needs a reset. If that doesn't work, I would clear the SNMP settings, log out, log in, insert the SNMP settings again.

[Anonymous user · Accepted solution]

I started getting these messages yesterday. The come in sets of 3, and I got 6 sets of them from one particular workstation yesterday. Today I have received 3 sets of them from a different workstation.

I rebooted the management interface but have gotten one set since then. I checked the SNMP page and there was one labeled "private" with 0.0.0.0 for the address and it had Write access. I disabled that one and am waiting to see if I get any more occurrences.

The two workstations that they have come from have users in completely different departments and wouldn't even know what a UPS is. I'm on version 2.5.1.

EDIT: just after I posted this, another set came in from a third workstation.

Message was edited by: yankeestom

[BillP]

this message is telling you that something is sending SNMP gets or sets to the NMC from those workstations. leaving the SNMP NMS IP setting to 0.0.0.0 allows any IP address to hit the SNMP interface on the NMC if they have the correct community string. the message is probably popping up because maybe the workstation(s) do not have the correct community name. thus, you should change it to a specific IP address if you monitor things via SNMP with a SNMP NMS or put a network segment in there such as 10.218.44.0 - this will allow anyone between 10.218.44.1-10.218.44.254 to be allowed to hit the SNMP interface on the card. additionally, you can change the community name. this is a configuration issue.

the NMC has more info on this in the help file.

also, firmware 2.5.1 is very old. you could upgrade it if you want from http://www.apc.com/tools/download/index.cfm by choosing firmware updates - network management card and choosing the appropriate version for what type of UPS you have.

if it is not a UPS, you can also find other firmware upgrades from that link provided.

[Anonymous user]

To risky. If something ever went wrong I would loose my job. I could put in a request and possibly get permission to do it at midnight on Saturday.