0097-net-snmp-uninstalled-Ensure net-snmp is not installed¶
Rule ID¶
- 0097-net-snmp-uninstalled
Category¶
- system
Level¶
- warn
Compatible Versions¶
- Linux
Description¶
- The SNMP server can communicate using SNMPv1, which transmits data in clear text and does not require authentication to execute commands. SNMPv3 replaced the simple/clear text password sharing used in SNMPv2 with more secure parameter encoding. If the SNMP service is not needed, the net-snmp package should be removed to reduce the system attack surface.
Scan Frequency¶
0 */30 * * *
Rationale¶
- SNMP (Simple Network Management Protocol) is a widely used network monitoring protocol for monitoring the health of network devices, computer equipment, UPS, and other devices. Net-SNMP is a suite of applications for implementing SNMPv1 (RFC 1157), SNMPv2 (RFC 1901–1908), and SNMPv3 (RFC 3411–3418) using both IPv4 and IPv6. Support for the "classic" SNMPv2 version, "SNMPv2 Historic" (RFC 1441–1452), was dropped in the UCD-snmp package version 4.0. The SNMP server listens for SNMP commands, executes commands or collects information, and then sends the results back to the requesting system.
Risk Items¶
-
Hacker intrusion
-
Data leakage
-
Network security
-
Cryptomining risk
-
Botnet risk
Audit Method¶
- Execute the following command to verify whether net-snmp is installed.
Remediation¶
- Run the command to remove net-snmp.
Impact¶
- None
Default Value¶
References¶
CIS Controls¶
-
Version 7
-
2.6 Address Unapproved Software
Ensure that unauthorized software is either removed or updated in a timely manner. -
9.2 Ensure Only Approved Ports, Protocols, and Services Are Running
Ensure that only network ports, protocols, and services listening on a system that have been validated for business needs are running on each system.