Finding unwanted SNMP strings

Question

Hi

There's a few posts out there about searching for the public and private SNMP strings, but I've not found any about searching for any unauthorised strings.  After a good deal of head scratching I've come up with the following regex...

^snmp-server community [a-zA-Z0-9]*[^(string1\s|| string2\s)]This matches any snmp-community string which isn't string1 or string2. Hope this helps someone.    Keith

DirtySouth · Answer

Keith, this is cool, but how do you actually use these rules?

keith.godber · Answer

Hi

Revisiting this again, I feel I have a working solution.

Making the presumption that you have 2 SNMP strings that you want rolled out on your devices, and that you don't want any other strings on the boxes.  Then we can frag up if someone adds an SNMP string that we don't expect.

We'll require 3 rules:

Rule 1: violate if not found

* ^snmp-server community ROstring$

Rule 2: violate if not found

* ^snmp-server community RWstring$

Rule 3: violate if found

* ^snmp-server community .*
* ^snmp-server community .*
* ^snmp-server community .*

So. We have 2 rules to look for specific strings, and the 3rd rule will violate if 3 strings are found.  As we only expect 3 strings everything should be fine.

If someone adds a new string, then rule 3 will violate.

If some removes a string and adds a new one (could be a typo) then rule 1 or rule 2 will violate.

Keith

keith.godber · Answer

Hi Guys.

After checking my results again, I find that my Regex will pass any SNMP string which is entirely made up of the letters and numbers in either of the 2 strings.  so modifying the example if I use Regex:

^snmp-server community [a-zA-Z0-9]*[^(abcd\s||1234\s)]

This will consider "abcd" and "1234" as valid strings,  "xxx" as an invalid string, but will consider "a2" or "bbc4" as valid.

Can anyone out there help remodel this Regex so it treats the 2 strings as strict text blocks?

Keith