ELTEX-MES-AAA DEFINITIONS ::= BEGIN

-- Title:      ELTEX MES AAA Extension Private
-- Version:    2.2
-- Date:       15 Nov 2017
--
-- 11-Jul-2016 - Added eltAAAAccountingCommandsMethod
-- 15-Nov-2017 - Added eltMesAAALine objects
-- 10-Apr-2023 - Added eltRadiusAttrFramedIPAddressAccessEnable

IMPORTS
    eltMes, eltMesRadius, eltMesTacacs              FROM ELTEX-MES
    MODULE-IDENTITY, OBJECT-TYPE, Unsigned32        FROM SNMPv2-SMI
    TEXTUAL-CONVENTION, TruthValue, RowStatus       FROM SNMPv2-TC
    DisplayString                                   FROM SNMPv2-TC
    RlAAAAccountingMethod, rlAAALocalUserEntry      FROM RADLAN-AAA
    rlAAALineEntry, rlRadiusServerInetEntry         FROM RADLAN-AAA
    rndErrorDesc, rndErrorSeverity                  FROM RADLAN-DEVICEPARAMS-MIB;

--
-- AAA MIB
--

eltMesAAA MODULE-IDENTITY
        LAST-UPDATED "201509210000Z"
        ORGANIZATION "Eltex Ltd."
        CONTACT-INFO
                "http://www.eltex.nsk.ru"
        DESCRIPTION
                "The private MIB module definition for Authentication, Authorization and Accounting
                 in Eltex MES devices."
        ::= { eltMes 79 }

EltAAAServiceType  ::= TEXTUAL-CONVENTION
   STATUS current
   DESCRIPTION    "Line service type."
   SYNTAX INTEGER {
      console(0),
      telnet(1),
      ssh(2)
}

eltMesAAANotifications OBJECT IDENTIFIER ::= { eltMesAAA 0 }
        
EltAAAMethodListModeType  ::= TEXTUAL-CONVENTION
   STATUS current
   DESCRIPTION    "Authentication mode type."
   SYNTAX INTEGER {
      eltAAAMethodListModeTypeChain(0),
      eltAAAMethodListModeTypeBreak(1)
}

eltAAAMethodListMode OBJECT-TYPE
    SYNTAX   EltAAAMethodListModeType
    MAX-ACCESS   read-write
    STATUS   current
    DESCRIPTION "Specify the authentication mode."
  ::= { eltMesAAA 1 }

eltAAAAccountingCommandsMethod OBJECT-TYPE
    SYNTAX   RlAAAAccountingMethod
    MAX-ACCESS   read-write
    STATUS   current
    DESCRIPTION "Specify a method used for accounting of user commands."
  ::= { eltMesAAA 2 }

---
--- Line MIB Objects
---

eltMesAAALine          OBJECT IDENTIFIER ::= { eltMesAAA 3 }

eltAAALineTelnetMaxLoginAttempts OBJECT-TYPE
    SYNTAX      INTEGER  (1..10)
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION "The maximum number of unsuccessful login attempts into
                 a Telnet session made before the connection is closed."
    ::= { eltMesAAALine 1 }

eltAAALineSshMaxLoginAttempts OBJECT-TYPE
    SYNTAX      INTEGER  (1..10)
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION "The maximum number of unsuccessful login attempts into
                 a SSH session made before the connection is closed."
    ::= { eltMesAAALine 2 }

eltAAALineSessionLimit OBJECT-TYPE
    SYNTAX      INTEGER  (1..6)
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION "The maximum number of CLI sessions."
    ::= { eltMesAAALine 3 }

--
-- RADIUS attributes
--

eltMesRadiusAttr OBJECT IDENTIFIER ::= { eltMesRadius 1 }

eltRadiusAttrNasIdAccessEnable OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "Enable or disable including NAS-Identifier attribute in Access Request messages"
    DEFVAL      { false }
    ::= { eltMesRadiusAttr 1 }

eltRadiusAttrNasIdFormatString OBJECT-TYPE
    SYNTAX      OCTET STRING (SIZE(0..32))
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "The format string for NAS-Identifier RADIUS attribute."
    DEFVAL      { "%h" }
    ::= { eltMesRadiusAttr 2 }

eltRadiusAttrFramedIPAddressAccessEnable OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "Enable or disable including Framed-IP-Address(8) attribute in 
         Access-Request and Accounting-Request messages for RADIUS-server."
    DEFVAL      { false }
    ::= { eltMesRadiusAttr 3 }

--
-- RADIUS server tracking configuration table
--
eltRadiusServerTrackingTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF EltRadiusServerTrackingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "RADIUS Server tracking configuration table which enables periodic
         messages sending to RADIUS server in order to check whether the
         server is still reachable. Abscense of any reply from the server
         (Accept, Reject) is considered as server unreachable case."
    ::= { eltMesRadius 2 }

eltRadiusServerTrackingEntry OBJECT-TYPE
    SYNTAX        EltRadiusServerTrackingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "RADIUS Server tracking configuration table. eltRadiusServerTrackingId must
         correspond to particular track ID configured in eltRadiusServerInetTable
         (which augments rlRadiusServerInetEntry) in order for tracking mechanism
         to start working."
    INDEX { eltRadiusServerTrackingId }
    ::= { eltRadiusServerTrackingTable 1 }

EltRadiusServerTrackingEntry ::= SEQUENCE {
    eltRadiusServerTrackingId
        Unsigned32,
    eltRadiusServerTrackingRowStatus
        RowStatus,
    eltRadiusServerTrackingMessageInterval
        INTEGER,
    eltRadiusServerTrackingMaxRetries
        INTEGER,
    eltRadiusServerTrackingTimeout
        INTEGER,
    eltRadiusServerTrackingUserName
        DisplayString,
    eltRadiusServerTrackingUserPassword
        DisplayString
}

eltRadiusServerTrackingId OBJECT-TYPE
    SYNTAX      Unsigned32 (1..8)
    MAX-ACCESS  read-write 
    STATUS      current
    DESCRIPTION
        "Unique ID number of the tracking configuration."
    ::= { eltRadiusServerTrackingEntry 1 }

eltRadiusServerTrackingRowStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "Indicates the RowStatus of this entry."
    ::= { eltRadiusServerTrackingEntry 2 }

eltRadiusServerTrackingMessageInterval OBJECT-TYPE
    SYNTAX      INTEGER (1..300)
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "The interval in seconds at which track messages are sent."
    DEFVAL { 5 }
    ::= { eltRadiusServerTrackingEntry 3 }

eltRadiusServerTrackingMaxRetries OBJECT-TYPE
    SYNTAX      INTEGER (1..10)
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "The number of additional attempts to get response from unresponsive
         server before marking it as dead."
    DEFVAL { 3 }
    ::= { eltRadiusServerTrackingEntry 4 }

eltRadiusServerTrackingTimeout OBJECT-TYPE
    SYNTAX      INTEGER (1..300)
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "Time in seconds before the next attempt to track unresponsive server again."
    DEFVAL { 60 }
    ::= { eltRadiusServerTrackingEntry 5 }

eltRadiusServerTrackingUserName OBJECT-TYPE
    SYNTAX      DisplayString (SIZE(1..128))
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "User name that is used in tracking messages."
    DEFVAL { "radius-tracker" }
    ::= { eltRadiusServerTrackingEntry 6 }

eltRadiusServerTrackingUserPassword OBJECT-TYPE
    SYNTAX      DisplayString (SIZE(0..128))
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "User password that is used in tracking messages. Empty password
         means tracking messages will be sent without a password."
    DEFVAL { "" }
    ::= { eltRadiusServerTrackingEntry 7 }

eltRadiusServerInetTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF EltRadiusServerInetEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "The (conceptual) table listing the RADIUS
        servers with which the client shares a secret.

        This table augments rlRadiusServerInetTable."
    ::= { eltMesRadius 3 }

eltRadiusServerInetEntry OBJECT-TYPE
    SYNTAX      EltRadiusServerInetEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "An entry (conceptual row) representing a RADIUS
         server with which the client shares a secret."
    AUGMENTS    { rlRadiusServerInetEntry }
    ::= { eltRadiusServerInetTable 1 }

EltRadiusServerInetEntry ::= SEQUENCE {
    eltRadiusServerInetTrackingId
        Unsigned32
}

eltRadiusServerInetTrackingId   OBJECT-TYPE
    SYNTAX      Unsigned32 (0..8)
    MAX-ACCESS  read-write 
    STATUS      current
    DESCRIPTION
        "Unique ID number of the tracking configuration. Must correspond to
         eltRadiusServerTrackingId key value of eltRadiusServerTrackingTable.
         The value of zero means there's no binding to any tracking configuration."
    DEFVAL { 0 }
    ::= { eltRadiusServerInetEntry 1 }

--
-- TACACS attributes
--

eltMesTacacsAttr OBJECT IDENTIFIER ::= { eltMesTacacs 1 }

eltTacacsAttrPortConfigTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF EltTacacsAttrPortConfigEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A list of TACACS attributes configuring mechanism."
    ::= { eltMesTacacsAttr 1 }

eltTacacsAttrPortConfigEntry OBJECT-TYPE
   SYNTAX      EltTacacsAttrPortConfigEntry
   MAX-ACCESS  not-accessible
   STATUS      current
   DESCRIPTION
       "An entry containing TACACS attributes configuring
        mechanism."
   INDEX { eltTacacsAttrPortLineType }
   ::= { eltTacacsAttrPortConfigTable 1 }

EltTacacsAttrPortConfigEntry ::=
    SEQUENCE {
        eltTacacsAttrPortLineType
            EltAAAServiceType,
        eltTacacsAttrPortFormat
            OCTET STRING
    }

eltTacacsAttrPortLineType OBJECT-TYPE
    SYNTAX      EltAAAServiceType
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "Line type."
    ::= { eltTacacsAttrPortConfigEntry 1 }

eltTacacsAttrPortFormat OBJECT-TYPE
    SYNTAX      OCTET STRING
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "User defined string to use as port attribute
         in TACACS packets. Specify port
         string template:
              <%n: line session index>,
              <%%: single %>."
    ::= { eltTacacsAttrPortConfigEntry 2 }

--
-- Dynamic Authorization MIB Objects
--
eltMesDynamicAuthorization OBJECT IDENTIFIER ::= { eltMesAAA 4 }
eltMesDynamicAuthorizationGlobals OBJECT IDENTIFIER ::= { eltMesDynamicAuthorization 1 }

eltDynamicAuthorizationRadiusEnable OBJECT-TYPE
   SYNTAX       TruthValue
   MAX-ACCESS   read-write
   STATUS       current
   DESCRIPTION
       "Specifies whether Dynamic Radius Server enabled on the switch. "
   DEFVAL  { false }
   ::= { eltMesDynamicAuthorizationGlobals 1 }

eltDynamicAuthorizationRadiusPort OBJECT-TYPE
    SYNTAX INTEGER (1..65535)
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "To define the accounting UDP port used for dynamic authentication requests."
    DEFVAL  { 3799 }
    ::= { eltMesDynamicAuthorizationGlobals 2 }

--
-- Command Authorization MIB Objects
--
eltAAAAuthorizationCommandsMethodListName OBJECT-TYPE
    SYNTAX   OCTET STRING (SIZE(3..20))
    MAX-ACCESS   read-write
    STATUS   current
    DESCRIPTION "Specify the name of authorization list used for authorization of user commands."
    DEFVAL { "cmd_default" }
  ::= { eltMesAAA 5 }

---
--- Notifications
---

eltAAAUserTrap NOTIFICATION-TYPE
    OBJECTS   {rndErrorDesc, rndErrorSeverity}
    STATUS current
    DESCRIPTION
        "A eltAAAUserTrap is generated when user
         connect/reject/disconnect from the session."
    ::= { eltMesAAANotifications 1 }

--
-- eltAAALocalUserTable
--
eltAAALocalUserTable OBJECT-TYPE
    SYNTAX           SEQUENCE OF EltAAALocalUserEntry
    MAX-ACCESS       not-accessible
    STATUS           current
    DESCRIPTION      "The table specifies all usernames, their passwords and
                      their authorizations."
    ::= { eltMesAAA 6 }

eltAAALocalUserEntry OBJECT-TYPE
    SYNTAX           EltAAALocalUserEntry
    MAX-ACCESS       not-accessible
    STATUS           current
    DESCRIPTION      "The row definition for this table."
    AUGMENTS         { rlAAALocalUserEntry }
    ::= { eltAAALocalUserTable 1 }

EltAAALocalUserEntry ::= SEQUENCE {
    eltAAAlocalUserTimeLeftToUnblock Unsigned32
}

eltAAAlocalUserTimeLeftToUnblock OBJECT-TYPE
   SYNTAX            Unsigned32
   MAX-ACCESS        read-only
   STATUS            current
   DESCRIPTION       "Time left for unblock"
   ::= { eltAAALocalUserEntry 1 }

--
-- eltAAATimeLeftToUnblock
--
eltAAATimeLeftToUnblock  OBJECT-TYPE
    SYNTAX           Unsigned32 (0..7200)
    MAX-ACCESS       read-write
    STATUS           current
    DESCRIPTION
                     "Time in seconds to unblock user after
                      a few authenticate fails"
    DEFVAL           { 0 }
    ::= { eltMesAAA 7 }

---
--- Interim update feature
---

eltAAAAccountingInterimUpdateEnable OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "Enables or disables interim updates."
    DEFVAL      { false }
  ::= { eltMesAAA 9 }

eltAAAAccountingInterimUpdateInterval OBJECT-TYPE
    SYNTAX      INTEGER  (1..300)
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "Time interval in minutes between periodic interim messages."
    DEFVAL      { 1 }
  ::= { eltMesAAA 10 }

--
-- eltAAALineTable
--
eltAAALineTable OBJECT-TYPE
    SYNTAX           SEQUENCE OF EltAAALineEntry
    MAX-ACCESS       not-accessible
    STATUS           current
    DESCRIPTION      "The table specifies line information"
    ::= { eltMesAAALine 4 }

eltAAALineEntry OBJECT-TYPE
    SYNTAX           EltAAALineEntry
    MAX-ACCESS       not-accessible
    STATUS           current
    DESCRIPTION      "The row definition for this table."
    AUGMENTS         { rlAAALineEntry }
    ::= { eltAAALineTable 1 }

EltAAALineEntry ::= SEQUENCE {
    eltAAALineDisableAuthorizationCommands TruthValue
}

eltAAALineDisableAuthorizationCommands OBJECT-TYPE
   SYNTAX            TruthValue
   MAX-ACCESS        read-write
   STATUS            current
   DESCRIPTION       "Ignore authorization commands on line"
   DEFVAL            { false }
   ::= { eltAAALineEntry 1 }


END
