Can't poll PAM using SNMP v3

Products

• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager (PAM)

Issue/Introduction

You are trying to obtain information from the CA PAM MIB using version 3. You are running the following query:

snmpwalk -v 3 -u snmppoll -a SHA -A auth1234 -x AES -X priv1234 <PAM address> UCD-SNMP-MIB::memory 

But this results in an error:

Error in packet. 
Reason: authorizationError (access denied to that object) 

The version 2c command works:

snmpwalk -v 2c -c xcdgkpub <PAM address> UCD-SNMP-MIB::memory

What is the correct syntax for the v3 command?

Resolution

Each SNMP v3 user has a name (called a securityName) an authentication protocol (authProtocol) and a privacy protocol (privProtocol, used for message encryption) as well as associated pass phrases for each of these, authPassword and privPassword. PAM uses authProtocol SHA and privProtocol AES. The pass phrases have to be at least 8 characters long.

Messages can be sent unauthenticated, authenticated, or authenticated and encrypted by setting the securityLevel to use. The original command specified the authorization and encryption/privacy parameters, but not the corresponding security level. The latter needs to be added with the "-l" command line option. Since both authentication and private passphrases are used, the security level should be "authPriv".

The correct command syntax is:

snmpwalk -v 3 -l authPriv -u snmppoll -a SHA -A auth1234 -x AES -X priv1234 <PAM address> UCD-SNMP-MIB::memory

Note that -a specifies the authorization protocol and -x the privacy protocol. Parameters -A and -X specify the corresponding pass phrases.