documentation_complete: true

prodtype: rhel7,fedora

title: 'Ensure Default SNMP Password Is Not Used'

description: |-
    Edit <tt>/etc/snmp/snmpd.conf</tt>, remove or change the default community strings of
    <tt>public</tt> and <tt>private</tt>.
    Once the default community strings have been changed, restart the SNMP service:
    <pre>$ sudo service snmpd restart</pre>

rationale: |-
    Whether active or not, default simple network management protocol (SNMP) community
    strings must be changed to maintain security. If the service is running with the
    default authenticators, then anyone can gather data about the system and the network
    and use the information to potentially compromise the integrity of the system and
    network(s).

severity: high

identifiers:
    cce@rhel7: 27386-2

references:
    disa: 366
    nist: IA-5.1(ii)
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "040800"

ocil_clause: 'the default SNMP passwords public and private have not been changed or removed'

ocil: |-
    To ensure the default password is not set, run the following command:
    <pre>$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep -E 'public|private'</pre>
    There should be no output.
