ucd-snmpd default configuration
Hi, I played around with MRTG which worked out-of-the-box. I just started rcsnmpd on the hosts and adjusted the firewalls to allow UDP:161 for the "monitor" host. Now the hosts run snmpd without configuration (at least it looks that there is no configuration file). I just started snmpd. Now I want to hear some statement about the risks. Since SNMP is very powerful, I fear that I opened some security leaks. OK, the firewalls are restrictive but I could sleep better if I could be sure that the default config garantes "read-only" accesses only. Second, snmpwalk reports really much things, but for MRTG I need the interface stats only. I looked for some example configuration files but they are complex to understand. Any sugesstions? Since I run SNMP now, I think about useing the check_snmp plugin with netsaint. I could imagine to check via snmp if i.e. the process "ypbind" is still running and so on. Is this secure? Or should I better not doing this? I would be glad if I could find anyone who uses check_snmp for more that checking snmpd itself. We could discuss this is little, but maybe this list is OT for that particular issue. I'm looking forward to any statements, thank you. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.
SNMP is not only read but write typically. Community strings are often easy to guess, easier to sniff (cleartext). I suggest _heavilly_ firewalling snmp and maybe using ssh port forwarding or ipsec to encrypt it. Kurt
* Kurt Seifried wrote on Sat, Sep 01, 2001 at 13:49 -0600:
SNMP is not only read but write typically.
In it's default configuration, really?
Community strings are often easy to guess,
defaults to public - nothing to guess :)
easier to sniff (cleartext).
I thought it's possible to set up SNMP using some encryption by itself, but a quick search didn't found a useful HOWTO neither about SNMP nor encryption nor security... Except "disable if not needed"...
I suggest _heavilly_ firewalling snmp
Yep, of course the firewalls restrict it to just one machine, but I would like to make sure that the snmpd will not allow bad things under any cirumstances. Firewalling is quite clear, like always :)
and maybe using ssh port forwarding or ipsec to encrypt it.
IPSec with each machine is to expensive and won't help, since it the monitor gets compromised IPSec can be used by unauthorized software - same for SSH, so I don't see a big improvement. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.
participants (2)
-
Kurt Seifried -
Steffen Dettmer