UCF STIG Viewer Logo

SNMP communities, users, and passphrases must be changed from the default.


Overview

Finding ID Version Rule ID IA Controls Severity
V-993 GEN005300 SV-993r2_rule IAAC-1 High
Description
Whether active or not, default SNMP passwords, users, and passphrases must be changed to maintain security. If the service is running with the default authenticators, then anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system or network(s).
STIG Date
VMware ESX 3 Server 2016-05-13

Details

Check Text ( C-816r2_chk )
Check the SNMP configuration for default passwords.

Locate and examine the SNMP configuration.
Procedure:
# find / -name snmpd.conf -print
# more snmpd.conf

Identify any community names or user password configuration. If any community name or password is set to a default value, such as public, private, snmp-trap, password, or any value which does not meet DISA password requirements, this is a finding.
Fix Text (F-1147r2_fix)
Change the default passwords. To change them, locate the snmpd.conf file and edit it. Locate the line system-group-read-community which has a default password of public and make the password something more random (less guessable). Make the same changes for the lines that read system-group-write-community, read-community, write-community, trap, and trap-community. Read the information in the file carefully. The trap is defining who to send traps to, for instance, by default. It is not a password, but the name of a host.