topic Re: SNMP Vulnerability in Operating System - HP-UX

SNMP Vulnerability

Bruce Baillie — Wed, 01 Sep 2004 11:11:54 GMT

Our security scans show a SNMP vulnerability. I installed all HP-UX 11.00 patches recomended by the security advisories but the system still does not pass the scan. The recommended workaround is to disable SNMP. This is an NFS client and also needs FTP. What will happen if I disable SNMP?

Re: SNMP Vulnerability

Jeff_Traigle — Wed, 01 Sep 2004 11:16:21 GMT

Nothing unless you're monitoring the system with a tool that uses it (Tivoli or ITO). No network services the system provides to clients depends on SNMP.

Re: SNMP Vulnerability

Sridhar Bhaskarla — Wed, 01 Sep 2004 11:20:09 GMT

Hi,

Unless you are using SNMP to manage your systems through any network management station like HP Openview/NNM/VPO etc., disabling SNMP will not have any affect on the systems.

If you are using SNMP, atleast you can set a community name so that others cannot query your system using the default community name. To set the community name, edit /etc/SnmpAgent.d/snmpd.conf and add

get-community-name:
set-community-name:

Restart SNMP from /sbin/init.d scripts
and make sure your management station knows these strings.

NFS and ftp are not affected by SNMP.

-Sri

Re: SNMP Vulnerability

Geoff Wild — Wed, 01 Sep 2004 11:24:04 GMT

Or just secure up snmp

change the get-community-name from public to something else

man snmpd.conf for more info...

Rgds...Geoff

Re: SNMP Vulnerability

Sundar_7 — Wed, 01 Sep 2004 11:28:56 GMT

Bruce,

Most probably you have the default SET/GET community name for the SNMP.

The default community name is public. That could be the reason why your security scan is complaing

Change the community name in /etc/SnmpAgent.d/snmpd.conf

If you disable SNMP, then often your network monitoring tools fail, like if you have Network Node Manager running in your enterprise to monitor the up/down status of the systems.

If you change the community name, again that is goign to break the Network monitoring tools.

So, analyze the consequences before disabling SNMP or changing the community name

Sundar.

Re: SNMP Vulnerability

Bruce Baillie — Wed, 01 Sep 2004 11:45:59 GMT