SNMP Vulnerability

[Bruce Baillie]

Our security scans show a SNMP vulnerability. I installed all HP-UX 11.00 patches recomended by the security advisories but the system still does not pass the scan. The recommended workaround is to disable SNMP. This is an NFS client and also needs FTP. What will happen if I disable SNMP?

[Jeff_Traigle]

Nothing unless you're monitoring the system with a tool that uses it (Tivoli or ITO). No network services the system provides to clients depends on SNMP.

[Sridhar Bhaskarla]

Hi,

Unless you are using SNMP to manage your systems through any network management station like HP Openview/NNM/VPO etc., disabling SNMP will not have any affect on the systems.

If you are using SNMP, atleast you can set a community name so that others cannot query your system using the default community name. To set the community name, edit /etc/SnmpAgent.d/snmpd.conf and add

get-community-name:
set-community-name:

Restart SNMP from /sbin/init.d scripts
and make sure your management station knows these strings.

NFS and ftp are not affected by SNMP.

-Sri

[Geoff Wild]

Or just secure up snmp

change the get-community-name from public to something else

man snmpd.conf for more info...



Rgds...Geoff

[Sundar_7 · Accepted solution]

Bruce,

Most probably you have the default SET/GET community name for the SNMP.

The default community name is public. That could be the reason why your security scan is complaing

Change the community name in /etc/SnmpAgent.d/snmpd.conf

If you disable SNMP, then often your network monitoring tools fail, like if you have Network Node Manager running in your enterprise to monitor the up/down status of the systems.

If you change the community name, again that is goign to break the Network monitoring tools.

So, analyze the consequences before disabling SNMP or changing the community name

Sundar.

[Bruce Baillie]

close