# SECTION: Access Control Advanced
#
#   This section offers greater control over who is allowed to talk
#   to your running snmp agent.  Use this section, or "Access Control Basic",
#   but not both.
#
#   By default, the agent responds to the "public" community for read
#   only access, if run out of the box without any configuration in 
#   place.
#
#   The following lines change the access permissions of the agent so
#   that the COMMUNITY string provides read-only access to your entire
#   NETWORK (EG: 10.10.10.0/24), and read/write access to only the
#   localhost (127.0.0.1, not its real ipaddress).
#

####
# First, map the community name (COMMUNITY) into a security name
# (local and mynetwork, depending on where the request is coming
# from):

#       sec.name  source          community
com2sec local     localhost       COMMUNITY
#</IPNM_com2sec_local>
com2sec mynetwork NETWORK         COMMUNITY
#</IPNM_com2sec_mynetwork>

####
# Second, map the security names into group names:

#             	sec.model  sec.name
group MyRWGroup	v1         local
group MyRWGroup	v2c        local
group MyRWGroup	usm        local
group MyROGroup v1         mynetwork
group MyROGroup v2c        mynetwork
group MyROGroup usm        mynetwork

####
# Third, create a view for us to let the groups have rights to:

#           incl/excl subtree                          mask
view all    included  .1                               80

####
# Finally, grant the 2 groups access to the 1 view with different
# write permissions:

#                context sec.model sec.level match  read   write  notif
access MyROGroup ""      any       noauth    exact  all    none   none
access MyRWGroup ""      any       noauth    exact  all    all    none
