<Group id="snmp">
<title>SNMP Server</title>
<description>The Simple Network Management Protocol allows
administrators to monitor the state of network devices, including
computers. Older versions of SNMP were well-known for weak
security, such as plaintext transmission of the community string
(used for authentication) and usage of easily-guessable
choices for the community string.</description>

<Group id="snmp_configure_server">
<title>Configure SNMP Server</title>
<description>If it is necessary to run the snmpd agent on the system, some best
practices should be followed to minimize the security risk from the
installation. The multiple security models implemented by SNMP cannot be fully
covered here so only the following general configuration advice can be offered:
<ul>
<li>use only SNMP version 3 security models and enable the use of authentication and encryption</li>
<li>write access to the MIB (Management Information Base) should be allowed only if necessary</li>
<li>all access to the MIB should be restricted following a principle of least privilege</li>
<li>network access should be limited to the maximum extent possible including restricting to expected network
addresses both in the configuration files and in the system firewall rules</li>
<li>ensure SNMP agents send traps only to, and accept SNMP queries only from, authorized management
stations</li>
<li>ensure that permissions on the <tt>snmpd.conf</tt> configuration file (by default, in <tt>/etc/snmp</tt>) are 640 or more restrictive</li>
<li>ensure that any MIB files' permissions are also 640 or more restrictive</li></ul>
</description>

<Rule id="snmpd_use_newer_protocol" severity="medium">
<title>Configure SNMP Service to Use Only SNMPv3 or Newer </title>
<description>
Edit <tt>/etc/snmp/snmpd.conf</tt>, removing any references to <tt>v1</tt>, <tt>v2c</tt>, or <tt>com2sec</tt>.  
Upon doing that, restart the SNMP service:
<pre># service snmpd restart</pre>
</description>
<ocil clause="there is output">
To ensure only SNMPv3 or newer is used, run the following command:
<pre># grep 'v1\|v2c\|community\|com2sec' /etc/snmp/snmpd.conf | grep -v "^#"</pre>
There should be no output.
</ocil>
<rationale>
Earlier versions of SNMP are considered insecure, as they potentially allow 
unauthorized access to detailed system management information.
</rationale>
<oval id="snmpd_use_newer_protocol" />
<ident stig="GEN005305" />
<ref nist="DCPP-1" disa="1435" />
</Rule>

<Rule id="snmpd_not_default_password" severity="high">
<title>Ensure Default Password Is Not Used</title>
<description>
Edit <tt>/etc/snmp/snmpd.conf</tt>, remove default community strings <tt>public</tt>, <tt>private</tt>, <tt>snmp-trap</tt>, <tt>password</tt>.
Upon doing that, restart the SNMP service:
<pre># service snmpd restart</pre>
</description>
<ocil clause="there is output">
To ensure the default password is not set, run the following command:
<pre># grep -v "^#" /etc/snmp/snmpd.conf| grep 'public\|private\|snmp-trap\|password'</pre>
There should be no output.
</ocil>
<rationale>
Presence of the default SNMP password enables querying of different system
aspects and could result in unauthorized knowledge of the system.
</rationale>
<oval id="snmpd_not_default_password" />
<ident stig="GEN005300" />
<ref nist="IAAC-1" disa="178" />
</Rule>

<Rule id="snmpd_use_approved_hash" severity="medium">
<title>Ensure Approved Hash Is Used</title>
<description>
Edit <tt>/etc/snmp/snmpd.conf</tt>, ensure every line beginning with <tt>createUser</tt> 
includes <tt>SHA</tt>, similar to the following:
<pre># createUser myuser SHA -l 0x0001020304050607080900010203040506070809 AES -l 0x00010203040506070809000102030405</pre>
Upon doing that, restart the SNMP service:
<pre># service snmpd restart</pre>
</description>
<ocil clause="there is output">
To ensure SHA is used for SNMPv3 users, run the following command:
<pre># grep -v '^#' /etc/snmp/snmpd.conf | grep -i createUser | grep -vi SHA</pre>
There should be no output.
</ocil>
<rationale>
The SNMP service must use SHA-1 or a FIPS 140-2 approved successor for 
authentication and integrity.
</rationale>
<oval id="snmpd_use_approved_hash" />
<ident stig="GEN005306" />
<ref nist="DCNR-1" disa="1453" />
</Rule>

<Rule id="snmpd_use_approved_encryption" severity="medium">
<title>Ensure Approved Encryption Is Used</title>
<description>
Edit <tt>/etc/snmp/snmpd.conf</tt>, ensure every line beginning with <tt>createUser</tt> 
includes <tt>AES</tt>, similar to the following:
<pre># createUser myuser SHA -l 0x0001020304050607080900010203040506070809 AES -l 0x00010203040506070809000102030405</pre>
Upon doing that, restart the SNMP service:
<pre># service snmpd restart</pre>
</description>
<ocil clause="there is output">
To ensure AES is used for SNMPv3 users, run the following command:
<pre># grep -v '^#' /etc/snmp/snmpd.conf | grep -i createUser | grep -vi AES</pre>
There should be no output.
</ocil>
<rationale>
The SNMP service must use AES or a FIPS 140-2 approved successor algorithm 
for protecting the privacy of communications.
</rationale>
<oval id="snmpd_use_approved_encryption" />
<ident stig="GEN005307" />
<ref nist="DCNR-1" disa="68" />
</Rule>

</Group>

</Group> <!-- <Group id="snmp"> -->
