SNMP communities, users, and passphrases must be changed from the default.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-993	GEN005300	SV-63371r1_rule	IAAC-1	High

Description
Whether active or not, default SNMP passwords, users, and passphrases must be changed to maintain security. If the service is running with the default authenticators, then anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system or network(s).

STIG	Date
Oracle Linux 5 Security Technical Implementation Guide	2015-03-26

Details

Check Text ( C-53035r2_chk )
Check the SNMP configuration for default passwords. Procedure: Examine the default install location /etc/snmp/snmpd.conf or: # find / -name snmpd.conf # more Identify any community names or user password configuration. If any community name or password is set to a default value such as "public", "private", "snmp-trap", or "password", or any value which does not meet DISA password requirements, this is a finding.

Check Text ( C-53035r2_chk )

Check the SNMP configuration for default passwords.

Procedure:
Examine the default install location /etc/snmp/snmpd.conf
or:
# find / -name snmpd.conf
# more

Identify any community names or user password configuration. If any community name or password is set to a default value such as "public", "private", "snmp-trap", or "password", or any value which does not meet DISA password requirements, this is a finding.

Fix Text (F-53981r2_fix)
Change the default passwords. To change them, locate the file snmpd.conf. Edit the file. Locate the line system-group-read-community which has a default password of "public" and make the password something more secure and less guessable. Do the same for the lines reading system-group-write-community, read-community, write-community, trap and trap-community. Read the information in the file carefully. The trap is defining who to send traps to, for instance, by default. It is not a password, but the name of a host.

Fix Text (F-53981r2_fix)

Change the default passwords.
To change them, locate the file snmpd.conf.

Edit the file.

Locate the line system-group-read-community which has a default password of "public" and make the password something more secure and less guessable.

Do the same for the lines reading system-group-write-community, read-community, write-community, trap and trap-community.

Read the information in the file carefully. The trap is defining who to send traps to, for instance, by default. It is not a password, but the name of a host.