4.5.5.2 SNMP - disable system community string

Information

If snmpd is required within the environment, disable the system community string.

Rationale:

In AIX, two SNMP community names, private and system, are enabled with read/write privileges, but are allowed access only from localhost connections. As these SNMP names are the default, they must not be used. Any SNMP community name should be a combination of letters, numbers and special characters to enhance security.

Solution

Edit the file:

vi /etc/snmpd.conf

Comment out the system entry:

#community system 127.0.0.1 255.255.255.255 readWrite 1.17.2

Default Value:

Commented in

Additional Information:

Reversion:

Copy back the original /etc/snmpd.conf file:

cp -p /etc/snmpd.conf.pre_cis /etc/snmpd.conf

See Also

https://workbench.cisecurity.org/benchmarks/13069

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6

Plugin: Unix

Control ID: b297acbd013bd923266405d29e1a4c660f353650e22de844ce6ccb5a88cd3b85