The SNMP service must use only SNMPv3 or its successors.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-22447 | GEN005305 | SV-26716r1_rule | DCPP-1 | Medium |
| Description |
|---|
| SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an attacker or other unauthorized users may gain access to detailed system management information and use that information to launch attacks against the system. |
| STIG | Date |
|---|---|
| HP-UX 11.23 Security Technical Implementation Guide | 2015-12-02 |
Details
| Check Text ( C-36607r1_chk ) |
|---|
| Verify the SNMP daemon is not configured to use community strings. # cat /etc/SnmpAgent.d/snmpd.conf |egrep -i "get-community-name|set-community-name" If any configuration is found, this is a finding. |
| Fix Text (F-31975r1_fix) |
|---|
| Edit /etc/SnmpAgent.d/snmpd.conf and remove references to get-community-name and set-community-name. Restart the SNMP service. # /sbin/init.d/SnmpMaster The snmpd script (/usr/sbin/snmpd) will take care of starting the subagents. It if does not, check the options in /etc/rc.config.d/SnmpMaster that influence the startup behavior. |