Nut upsuser - Apr 2020 - nut-scanner, SNMPv3, APC UPS not chatting

I'm trying to get SNMPv3 management working for an APC AP9617 card. It is
newly refurbed, running sumx v3.7.2 and aos v3.7.3.

In the SNMPv3 user profiles section I have (I don't care about the password
leaking, it's temporary):

  User Name: nut
  Authentication Passphrase: NutScan at Password43LongerWord
  Privacy Passphrase: NutScan at Password43LongerWord
  Authentication protocol: MD5 (only option other than none)
  Privacy Protocol: DES (only option other than none)

In access control I've enabled user nut.

However, when I try to use nut-scanner on it:
$ nut-scanner -S -s apcups --secLevel authPriv --secName nut --authProtocol
MD5 --authPassword NutScan at Password43LongerWord --privProtocol DES
--privPassword NutScan at Password43LongerWord
Scanning SNMP bus.
Error: unknown authtypeError generating Ku from authentication pass phrase

snmpwalk gives a different error:
$ snmpwalk -v 3 -u nut apcups -x DES -X NutScan at Password43LongerWord -a MD5
-A NutScan at Password43LongerWord
snmpwalk: Decryption error

I've tried it with all lowercase, mixed case, mixed case + numbers, and the
one you see here. I've also used an 18 character password. All get exactly
the same result.

I've tried setting the privacy protocol to none and leaving off the -x &
-X
flags, still get the same error messages.

I see a note in APC's documentation that it may take some time for the card
to be ready to talk SNMPv3. I've waited as long as 15 minutes with no
change in behavior.

snmpwalk and nut-scanner are both happy SNMPv1 -c public.

Can anyone tell me, please, what trivially obvious thing am I missing?

thanks,
nomad
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://alioth-lists.debian.net/pipermail/nut-upsuser/attachments/20200428/c461b613/attachment.html>

Just a hunch about your snmpwalk, what happens if you format like this?
snmpwalk -l authpriv -v 3 -u user -a MD5 -x DES -A authpassphrase -X
privpassphrase {host address}


so

snmpwalk -l authpriv -v 3 -u nut -a MD5 -x DES -A NutScan at
Password43LongerWord -X NutScan at Password43LongerWord apcups



Thank you,

David Zomaya

Tripp Lite


________________________________
From: Nut-upsuser <nut-upsuser-bounces+david_zomaya=tripplite.com at
alioth-lists.debian.net> on behalf of Lee Damon <nomad at
ee.washington.edu>
Sent: Tuesday, April 28, 2020 3:28 PM
To: nut-upsuser Mailing List
Subject: [EXTERNAL] [Nut-upsuser] nut-scanner, SNMPv3, APC UPS not chatting

This is an EXTERNAL email. Please take a moment and think before clicking any
links or opening any attachments from this email. If suspicious, please forward
to ishelpdesk at tripplite.com for review.
________________________________
I'm trying to get SNMPv3 management working for an APC AP9617 card. It is
newly refurbed, running sumx v3.7.2 and aos v3.7.3.

In the SNMPv3 user profiles section I have (I don't care about the password
leaking, it's temporary):

  User Name: nut
  Authentication Passphrase: NutScan at Password43LongerWord
  Privacy Passphrase: NutScan at Password43LongerWord
  Authentication protocol: MD5 (only option other than none)
  Privacy Protocol: DES (only option other than none)

In access control I've enabled user nut.

However, when I try to use nut-scanner on it:
$ nut-scanner -S -s apcups --secLevel authPriv --secName nut --authProtocol MD5
--authPassword NutScan at Password43LongerWord --privProtocol DES --privPassword
NutScan at Password43LongerWord
Scanning SNMP bus.
Error: unknown authtypeError generating Ku from authentication pass phrase

snmpwalk gives a different error:
$ snmpwalk -v 3 -u nut apcups -x DES -X NutScan at Password43LongerWord -a MD5
-A NutScan at Password43LongerWord
snmpwalk: Decryption error

I've tried it with all lowercase, mixed case, mixed case + numbers, and the
one you see here. I've also used an 18 character password. All get exactly
the same result.

I've tried setting the privacy protocol to none and leaving off the -x &
-X flags, still get the same error messages.

I see a note in APC's documentation that it may take some time for the card
to be ready to talk SNMPv3. I've waited as long as 15 minutes with no change
in behavior.

snmpwalk and nut-scanner are both happy SNMPv1 -c public.

Can anyone tell me, please, what trivially obvious thing am I missing?

thanks,
nomad
________________________________
This message is for the addressee's use only. It may contain confidential
information. If you receive this message in error, please delete it and notify
the sender. Tripp Lite disclaims all warranties and liabilities, and assumes no
responsibility for viruses which may infect an email sent to you from Tripp Lite
and which damage your electronic systems or information. It is your
responsibility to maintain virus detection systems to prevent damage to your
electronic systems and information.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://alioth-lists.debian.net/pipermail/nut-upsuser/attachments/20200428/f3f843ab/attachment.html>

On 4/28/20 1:58 PM, David Zomaya wrote:
> snmpwalk -l authpriv -v 3 -u user -a MD5 -x DES -A authpassphrase -X
> privpassphrase
Evidently, even with argument identifiers order matters. That worked
just fine and dandy.

Now I guess I need to play with the order of the nut-scanner arguments
to see if I get a similar result.

thanks,
nomad