topic Re: weak snmp string in Operating System - HP-UX

weak snmp string

Mark Harshman_1 — Tue, 02 Oct 2007 08:28:32 GMT

i have a security issue for weak SNMP security. is there a patch that can fix this?
Weak SNMP Community String ’public’ Found
Weak SNMP Community String ’snmpd’ Found

running HPUX 11.11

thanks

Re: weak snmp string

Torsten. — Tue, 02 Oct 2007 08:31:15 GMT

Where did you find this string?

On the OS or the MP/GSP?

Re: weak snmp string

Mark Harshman_1 — Tue, 02 Oct 2007 08:36:24 GMT

i am not sure. the warning comes from our security group that scans servers for issues, then tells us they need to be fixed. as you might expect they don't provide alot of info.

Re: weak snmp string

Torsten. — Tue, 02 Oct 2007 08:44:27 GMT

You should ask them for the IP address at least and resolve this address.

Older GSP/MP firmware versions used to have "public" set by default. The value was not changable. With newer versions you can change or disable.

For the OS this value is set in

/etc/snmpd.conf
...
get-community-name: public

Change it and restart the daemon.

Re: weak snmp string

Geoff Wild — Tue, 02 Oct 2007 08:47:43 GMT

Just update /etc/snmpd.conf

Change get-community-name: public

to whatever you like - say secret

Then you have to stop/start snmpd

For 11.11, just re-run the daemon:

Stop SNMP

/sbin/init.d/SnmpTrpDst stop
/sbin/init.d/SnmpMib2 stop
/sbin/init.d/SnmpHpunix stop
/sbin/init.d/SnmpMaster stop

Start SNMP

/sbin/init.d/SnmpMaster start
/sbin/init.d/SnmpHpunix start
/sbin/init.d/SnmpMib2 start
/sbin/init.d/SnmpTrpDst start

Rgds...Geoff