documentation_complete: true

title: 'Configure SNMP Server if Necessary'

description: |-
    If it is necessary to run the snmpd agent on the system, some best
    practices should be followed to minimize the security risk from the
    installation. The multiple security models implemented by SNMP cannot be fully
    covered here so only the following general configuration advice can be offered:
    <ul>
    <li>use only SNMP version 3 security models and enable the use of authentication and encryption</li>
    <li>write access to the MIB (Management Information Base) should be allowed only if necessary</li>
    <li>all access to the MIB should be restricted following a principle of least privilege</li>
    <li>network access should be limited to the maximum extent possible including restricting to expected network
    addresses both in the configuration files and in the system firewall rules</li>
    <li>ensure SNMP agents send traps only to, and accept SNMP queries only from, authorized management
    stations</li>
    <li>ensure that permissions on the <tt>snmpd.conf</tt> configuration file (by default, in <tt>/etc/snmp</tt>) are 640 or more restrictive</li>
    <li>ensure that any MIB files' permissions are also 640 or more restrictive</li></ul>
