3.5.2.1 SNMP - disable private community string - disable private community string

Information

If snmpd is required within the environment, disable the private community string.

Rationale:

In AIX, two SNMP community names, private and system, are enabled with read/write privileges, but are allowed access only from localhost connections. As these SNMP names are the default, they must not be used. Any SNMP community name should be a combination of letters, numbers and special characters to enhance security.

Solution

Create a backup of /etc/snmpd.conf:

cp -p /etc/snmpd.conf /etc/snmpd.conf.pre_cis

Edit the file:

vi /etc/snmpd.conf

Comment out the private entry:

#community private 127.0.0.1 255.255.255.255 readWrite

Default Value:

Commented in

Additional Information:

Reversion:

Copy back the original /etc/snmpd.conf file:

cp -p /etc/snmpd.conf.pre_cis /etc/snmpd.conf

See Also

https://workbench.cisecurity.org/files/4119

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 8be44774204fb4adc97c789158043f12f5eed2b51cedc6dba00bddc2d4667c79