HPUX SNMP Security

[Ranjith_5]

Hi Experts,

How to secure SNMP community name on an HPUX machine. Presently I understand that it is set as PUBLIC. Attacker can now use this public community name to access the system and change system information. I want to use a private community name. How to achieve this in HPUX?

Thanks in advance

Regards,
Syam

[Alex Lavrov.]

Public community is read-only usually, so the properties cannot be changed with it. Here is a little explanation I found in Google, hope it will help a bit:

SNMP Communities
An SNMP community is the group that devices and management stations running SNMP belong to. It helps define where information is sent. The community name is used to identify the group. A SNMP device or agent may belong to more than one SNMP community. It will not respond to requests from management stations that do not belong to one of its communities. SNMP default communities are:

Write = private
Read = public
SNMP Security
SNMP should be protected from the internet with a firewall. Beyond the SNMP community structure, there is one trap that adds some security to SNMP.

Send Authentication Trap - When a device receives an authentication that fails, a trap is sent to a management station.
Other configuration parameters that affect security are:


Accepted Community Names - Only requests from computers in the list of community names will be accepted.
Accept SNMP Packets from Any Host - This is checked by default. Setting specific hosts will increase security.
Only Accept SNMP Packets from These Hosts - Only requests from hosts on the list of IP addresses are accepted. Use IP, or IPX address or host name to identify the host.

[Derek Whigham_1 · Accepted solution]

By changing the file /etc/snmpd.conf to contain the line "set-community-name: Secret"

The restart the snmpd , If you don't really need snmp I would stop the services from running. Nessus always returns a high security warning against the HP-UX snmpd

Hope this helps

[Ranjith_5]

Hi Derek Whigham,

Thanks a million..Thanks to Alex also for your tips.

Regards,
Syam

[Ranjith_5]

What will happen if I set the value to private? Is this less secureed than secret?

Regards,
Syam

[Alex Lavrov.]

"A community name is a plain-text password mechanism that is used to weakly authenticate queries to agents of managed network devices."

Generally it's not advised to use public/private/secret strings for the community names, since they are too obvious. Come up with your own strings and change them frequently, like the password.

Alex.

[Ranjith_5]

Hi Alex,

Thanks for the info.

Regards,
Syam

[Ranjith_5]

thanks for all who replied.