<Group id="snmp">
<title>SNMP Server</title>
<description>The Simple Network Management Protocol allows
administrators to monitor the state of network devices, including
computers. Older versions of SNMP were well-known for weak
security, such as plaintext transmission of the community string
(used for authentication) and usage of easily-guessable
choices for the community string.</description>

<Group id="disabling_snmp_service">
<title>Disable SNMP Server if Possible</title>
<description>The system includes an SNMP daemon that allows for its remote
monitoring, though it not installed by default. If it was installed and
activated but is not needed, the software should be disabled and removed.
</description>

<Rule id="disable_snmpd">
<title>Disable <tt>snmpd</tt> Service</title>
<description>
<service-disable-macro service="snmpd" />
</description>
<ocil>
<service-disable-check-macro service="snmpd" />
</ocil>
<rationale>
Running SNMP software provides a network-based avenue of attack, and
should be disabled if not needed.
</rationale>
<ident cce="26906-8" />
<oval id="service_snmpd_disabled" />
</Rule>

<Rule id="package_net-snmp_removed">
<title>Uninstall <tt>net-snmp</tt> Package</title>
<description>The <tt>net-snmp</tt> package provides the snmpd service.
<package-remove-macro package="net-snmp" />
</description>
<ocil>
<package-check-macro package="net-snmp" />
</ocil>
<rationale>
If there is no need to run SNMP server software,
removing the package provides a safeguard against its
activation.
</rationale>
<ident cce="26332-7" />
<oval id="package_net-snmp_removed" />
</Rule>

</Group> <!-- <Group id="disabling_snmp_service"> -->

<Group id="snmp_configure_server">
<title>Configure SNMP Server if Necessary</title>
<description>If it is necessary to run the snmpd agent on the system, some best
practices should be followed to minimize the security risk from the
installation. The multiple security models implemented by SNMP cannot be fully
covered here so only the following general configuration advice can be offered:
<ul>
<li>use only SNMP version 3 security models and enable the use of authentication and encryption</li>
<li>write access to the MIB (Management Information Base) should be allowed only if necessary</li>
<li>all access to the MIB should be restricted following a principle of least privilege</li>
<li>network access should be limited to the maximum extent possible including restricting to expected network
addresses both in the configuration files and in the system firewall rules</li>
<li>ensure SNMP agents send traps only to, and accept SNMP queries only from, authorized management
stations</li>
<li>ensure that permissions on the <tt>snmpd.conf</tt> configuration file (by default, in <tt>/etc/snmp</tt>) are 640 or more restrictive</li>
<li>ensure that any MIB files' permissions are also 640 or more restrictive</li></ul>
</description>

<Rule id="snmpd_use_newer_protocol" severity="medium">
<title>Configure SNMP Service to Use Only SNMPv3 or Newer </title>
<description>
Edit <tt>/etc/snmp/snmpd.conf</tt>, removing any references to <tt>rocommunity</tt>, <tt>rwcommunity</tt>, or <tt>com2sec</tt>.
Upon doing that, restart the SNMP service:
<pre>$ sudo service snmpd restart</pre>
</description>
<ocil clause="there is output">
To ensure only SNMPv3 or newer is used, run the following command:
<pre>$ sudo grep 'rocommunity\|rwcommunity\|com2sec' /etc/snmp/snmpd.conf | grep -v "^#"</pre>
There should be no output.
</ocil>
<rationale>
Earlier versions of SNMP are considered insecure, as they potentially allow 
unauthorized access to detailed system management information.
</rationale>
<oval id="snmpd_use_newer_protocol" />
<ident cce="27365-6" stig="RHEL-06-000340" />
</Rule>

<Rule id="snmpd_not_default_password" severity="high">
<title>Ensure Default Password Is Not Used</title>
<description>
Edit <tt>/etc/snmp/snmpd.conf</tt>, remove default community string <tt>public</tt>.  
Upon doing that, restart the SNMP service:
<pre>$ sudo service snmpd restart</pre>
</description>
<ocil clause="there is output">
To ensure the default password is not set, run the following command:
<pre>$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep public</pre>
There should be no output.
</ocil>
<rationale>
Presence of the default SNMP password enables querying of different system
aspects and could result in unauthorized knowledge of the system.
</rationale>
<oval id="snmpd_not_default_password" />
<ident cce="27593-3" stig="RHEL-06-000341" />
<tested by="MAN" on="20121214"/>
</Rule>

</Group>

</Group> <!-- <Group id="snmp"> -->
