SNMP Agent Default Community Name (public) (High) risk

[DCIM_Support]

Hi Team,

Our IT Security is recommendation below. Please advise how to over come this vulnerability of public string.

• Synopsis

  The community name of the remote SNMP server can be guessed.

• Description

  It is possible to obtain the default community name of the remote SNMP server.

  An attacker may use this information to gain more knowledge about the remote host, or to change the configuration of the remote system (if the default community allows such modifications).

• Solution

  Disable the SNMP service on the remote host if you do not use it. Either filter incoming UDP packets going to this port, or change the default community string

(CID:129412678)

[DCIM_Support · Accepted solution]

DCO?

Do any of the following from Webmin

1. Disable SNMPv1 if you are not monitoring DCO via SNMP
2. Use SNMPv3 instead
3. Or simply change the community string

Enabling Data Center Operation monitoring through Data Center Expert

Edit 1:

DCE:

SNMP access to DCE can be enabled/disabled or you can change the community name from:

Server Access

(CID:129412762)

[DCIM_Support]

In addition to Chris' comments, the "public" read string is a common default. It can simply be changed to something other than "public" as you yourself noted.

(CID:129412882)

[DCIM_Support]

Always change the SNMP V1 community string.

Depending on customer requirements and security considerations I often recommend not using SNMP V1 write.

You can further secure your SNMP agents by allowing only SNMP read (GET etc) from selected IP addresses, e.g. DCE.

(CID:129413909)

[DCIM_Support]

This question is closed for comments. You're welcome to start a new topic if you have further comments on this issue.