SNMPv3 Error: passphrase chosen is below the length requirements of the USM (min=8)

CMK version:
Checkmk Raw Edition 2.2.0p5

OS version:
Checkmk for Docker

Error message:
SNMP Error on 10.4.1.115: Error: passphrase chosen is below the length requirements of the USM (min=8).
snmpbulkwalk: (The supplied password length is too short.)
Error generating a key (Ku) from the supplied authentication pass phrase. (Exit-Code: 1)

Other
Passphrase is correct as I’m able to snmpwalk using MIB Browser. Error is occurring with all Axis Communications security cameras, but the specific example provided above is a M3027-PVE running firmware version 6.50.5.10.

image

Hi @Adam and welcome to the forum.

Your passphrase has to be at least 8 characters long, otherwise Checkmk won’t take it.
I went through the SNMPv3 RFC (https://www.rfc-editor.org/rfc/rfc3414) but couldn’t find the 8 characters as a requirement (the min. length is based on the used security protocol).

I also asked ChatGPT about it and this was the response: :sweat_smile:

In SNMPv3 specifications, the minimum letter count (also known as the minimum password length) for the authentication and privacy (encryption) keys is determined by the security level and the chosen security mechanisms.

In SNMPv3, there are three security levels defined:

No Authentication and No Privacy (noAuthNoPriv): In this security level, there is no requirement for a password or key, so the minimum letter count is not applicable.

Authentication but No Privacy (authNoPriv): In this security level, only authentication is applied, and no encryption is used. The minimum letter count for the authentication key (password) is usually 8 characters.

Authentication and Privacy (authPriv): This is the highest security level where both authentication and encryption are used. The minimum letter count for the authentication key is usually 8 characters, and for the privacy key (encryption key), it is often 8 to 16 characters.

It’s essential to note that these minimum letter counts are not strict requirements imposed by the SNMPv3 standard itself but rather practical recommendations to ensure adequate security. Actual implementations might have varying requirements and guidelines.

Additionally, SNMPv3 supports various authentication protocols like MD5 and SHA-1, and encryption protocols like DES, AES, etc. The specific choices of these protocols can also influence the required key lengths for authentication and privacy.

So please make sure your used password is longer than 8 and not longer than 16 characters and you should be good to go.

Regards
Norm

Thanks for the reply! I should have mentioned we are using Authentication but No Privacy (authNoPriv) with a ten digit alphanumeric password, which is why this error is so frustrating.

Without seeing the real snmpwalk command it is hard to say whats wrong here.
As you are using the Raw edition it is very easy to see what the system does.
With cmk --debug -vvI hostname you get the snmpget command for your system to fetch the system description OID.
If you can show us booth, this one and your manual working snmpwalk, i hope that a difference is visible between booth.

Attached are results of both snmp-walk commands. It appears the Checkmk results are not as complete.

cmk snmpwalk.txt (14.6 KB)

MibBrowser SNMPWalk.txt (41.0 KB)

Booth walks have the same data. The MibBrowser walk also includes the OIDs .1.3.6.1.6… These are not relevant as it is internal SNMPv2 data. Normally not fetched by CMK.

But the snmpwalks are not the problem i think. You said that CMK will not use your SNMPv3 config.
That’s why i wanted to see the snmpwalk command not the output :slight_smile:

Please compare your manual walk command and the snmpget command you see after cmk --debug -vvI hostname

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.