SNMP has a default community name

[Jose Mariano Bueno]

My SNMP has a default community name. I've read that this is a security issue. How can I fix this? I am running HP-UX 11.11 on a RP5430.

[Patrick Wallek · Accepted solution]

The default community name can be changed by modifying the /etc/SnmpAgent.d/snmpd.conf file. The file is documented fairly well and there is also a man page.

# man 4 snmpd.conf

If you are not using SNMP your best option is to just turn it off. You can do this by modifying the /etc/rc.config.d/Snmp* files and setting the appropriate variables in each file to 0 (zero) instead of 1.

[Sridhar Bhaskarla]

Hi,

In addition, if you don't want to turn off SNMP, then you can edit /etc/SnmpAgent.d/snmpd.conf file and add the strings

get-community-name:
set-community-name:

The default community name is 'public'.

-Sri

[Robert Fritz]

One additional note. Community names in SNMP weren't designed for security. They are a means to keep devices from interfereing with each other unintentionally. Evidence of this is the fact that community names are continually broadcast in clear-text over the subnet. Someone who wants to read your traffic merely sniffs the network. There is no meaningful authentication in SNMPv1.

You may want to consider moving to SNMPv3, which performs authentication. I believe OVO supports it, and I know other SNMP agents are available.

[Jeff_Traigle]

And don't forget the IP: option you can use to restrict what host(s) are allowed to get responses for get and set requests. Far from perfect security since it's still flying over the wire in clear text, but it's a little better than just having a text string with which the system will give a response to anyone... the would-be attacker at least has to take the extra step of spoofing an IP address then. :)