Hardening SNMP on Debian

Posted on June 23, 2022 by admin

Hardening SNMP on Debian by disabling SNMP v1 and v2c, and configuring SNMP v3.

Modify /etc/snmp/snmpd.conf

First we’ll want to open up the /etc/snmp/snmpd.conf file and comment out all lines that begin with

rocommunity
view
rouser authPriv <– “This may be the last line by default, we don’t need it”

Alternatively, you can copy and paste the following sed commands instead of manually editing the file.

sudo sed -i 's/^rocommunity/# rocommunityc/g' /etc/snmp/snmpd.conf
sudo sed -i 's/^view/# view/g' /etc/snmp/snmpd.conf
sudo sed -i 's/^rouser authPriv/# rouser authPriv/g' /etc/snmp/snmpd.conf

Create SNMP v3 User

We can create a SNMP v3 user with the following command. There it will ask you for the username and passwords.

sudo net-snmp-create-v3-user -ro -a SHA-512 -x AES

You may receive an error about not being able to touch /snmp/snmpd.conf. I am not sure why Debian is attempting to create that file. Take the “rouser snmpuser” line and add it to the end of the /etc/snmp/snmpd.conf config.

Now we can start SNMPD

sudo systemctl start snmpd

Troubleshooting

My created user is not working! This could result from two different issues.

It appears that Debian/SNMP doesn’t like pass phrases with special characters. You can try using a different password or escaping the special characters in “/var/lib/snmp/snmpd.conf” file before starting SNMPD.
The user didn’t get added to /etc/snmp/snmpd.conf To fix, add “rouser snmpuser” (Change snmpuser to your snmp username) to the bottom of the config file.

Hardening SNMP on CentOS/RedHat/Fedora Etc.

Posted on June 23, 2022 by admin

These steps should be similar across Red Hat type distros.

Before we proceed, lets stop SNMP

sudo systemctl stop snmpd

Disable SNMP Versions 1 and 2c

First we are going to disable SNMP v1 and v2c

You can manually edit the /etc/snmp/snmpd.conf file and comment out or delete every line starting with com2sec, group, access. Or you can run the following sed commands to change it for you.

sudo sed -i 's/^com2sec/# com2sec/g' /etc/snmp/snmpd.conf
sudo sed -i 's/^group/# group/g' /etc/snmp/snmpd.conf
sudo sed -i 's/^access/# access/g' /etc/snmp/snmpd.conf

https://serverfault.com/questions/376688/how-to-disable-version-1-and-version-2c-in-snmpd

Create SNMP Version 3 User

Follow the prompts to create a SNMP v3 user.

sudo net-snmp-create-v3-user -ro -a SHA -x AES

Start SNMP

sudo systemctl start snmpd

You should be good to go.

If you are running a firewall, you will need to allow an exception for SNMP, UDP port 161. You may also need to allow an SELinux exception. Check out the last portion of both these articles.

Setting up SNMP V3 on CentOS

Allowing SNMP Through Firewall

semanage Allow and Delete ports in CentOS

SNMPv3 snmpwalk Mikrotik

Posted on July 16, 2019 by admin

Change AuthPass and CryptoPass to their respective passwords.
If needed, change MD5 to SHA1 and DES to AES.

 snmpwalk -v3 -a MD5 -A AuthPass -x DES -X CryptoPass -l authPriv -u privUser localhost

Configure AirOS SNMP settings over ssh

Posted on May 24, 2019 by admin

In this post we’ll see how we can configure AirOS SNMP settings from the command line.

ubntmod command with save without rebooting.

./ubntmod.sh -i 192.168.1.20 -s "private;monitor@incredigeek.com;[30.69636, -88.04811]" -X '/usr/etc/rc.d/rc.softrestart save'

Alternative manual method.

ssh ubnt@192.168.1.20

Open config file

vi /tmp/system.cfg

Find the SNMP settings and modify as needed. Example below

snmp.community=private
snmp.contact=monitor@incredigeek.com
snmp.location=[30.69636, -88.04811]

Save and exit file with :x

Apply settings

/usr/etc/rc.d/rc.softrestart save

cnMaestro configuration for SNMPv3

Posted on May 18, 2019 by admin

The following works for setting the snmpv3 configuration on cambium 450i 900’s. Once applied it’ll run change the SNMP settings and reboot the radio.

You’ll need to find the hashed password which can be found in a config backup.
Change the SNMP username/community as needed.

{
     "userParameters": {
         "snmpConfig": {
             "user2Group": 0,
             "snmpv3EngineId": "007000a9840a003e464e7a",
             "rwAuthPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "commStringROnly": "rocommunitystring2",
             "user2PrivPassword": "",
             "user1AuthPassword": "",
             "snmpv3AuthProt": 0,
             "snmpv3TrapEnable": 0,
             "snmpv3PrivProt": 0,
             "snmpMibPerm": 1,
             "roAuthPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "commStringRW": "communitystring",
             "userGroup1": 0,
             "user1Enable": 0,
             "snmpv3SecLvl": 2,
             "user2Enable": 0,
             "rwUserName": "Canopy",
             "roUserName": "snmpv3user",
             "roPrivPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "userName1": "",
             "snmpPort": 161,
             "rwUserEnable": 0,
             "trapDomainNameAppend": 0,
             "rwPrivPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "user1PrivPassword": "",
             "userName2": "",
             "user3PrivPassword": "",
             "user2AuthPassword": "",
             "userName3": "",
             "user3Enable": 0,
             "snmpTrapPort": 162,
             "user3AuthPassword": "",
             "user3Group": 0,
             "trapDelayAfterBootup": 5,
             "snmpIpAccessFilter": [
                 {
                     "address": "192.168.0.0",
                     "netmask": 24
                 },
                 {
                     "address": "10.0.1.0",
                     "netmask": 24
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 }
             ],
             "snmpTrapAddresses": [
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0"
             ]
         },
 }

Setup SNMP v3 on Mikrotik Router

Posted on December 21, 2018 by admin

Setting up SNMP via WinBox is straight forward, the following commands are how to set it up from the command line with some troubleshooting info at the end.

Setup SNMPv3

Setup Community (Change v3Private,encpass, and authpass to their respective names or passwords)

snmp community add name=v3Private encryption-protocol=DES encryption-password=encpass authentication-password=authpass security=private

Enable and set SNMP community (Trap Community needs to match the above command. Change contact and the location as needed.)

snmp set contact=admin@incredigeek.com location=DeviceLocation trap-community=V3Private

Troubleshooting

Sometimes, for no apparent reason it seems, routerOS will have issues using the default community. Work around is to create and use a new community.

Cannot connect with AES encryption

AES doesn’t always seem to work reliably. Seems to work on some and not other. Work around is to use DES.

Log shows Permission Denied

Double check the allowed from addresses, user, and passwords

Delete SNMPv3 User on Linux

Posted on July 2, 2018 by admin

Don’t know if this is the recommended way to delete a user, but it seems to work.

sudo service snmpd stop

Open up the snmpd.conf file in /var/lib and find the line with the SNMP user and delete the line

sudo vi /var/lib/snmp/snmpd.conf

The above file may be in the following location on RPM based systems.

sudo vi /var/lib/net-snmp/snmpd.conf

Save, exit, and start snmpd

sudo service snmpd start

These steps work for Ubuntu, but should work for any Debain based distro as well as CentOS, Fedora, RedHat etc.

semanage Allow and Delete ports in CentOS

Posted on April 27, 2018 by admin

The commands are for CentOS, but should work on Fedora and RedHat.

If semanage is not installed refer to here.

You would typically use this along with the systems firewall to allow a port through. Guide for firewalld and iptables. If you change it in the firewall and fail to add/edit it in semanage you can potentially get weird behavior like sshd not wanting to start after changing the port.

Add port

semanage port -a -t ssh_port_t -p tcp 2222

The above command allows the sshd service to start, using port 2222.

List allowed ports

semanage port -l

You can use grep to filter the results

Example:

[admin@localhost ~]# semanage port -l | grep ssh
ssh_port_t tcp 2222, 22
[admin@localhost ~]#

Delete port

semanage port -d -p tcp 2222

Other examples

Allow SNMP

semanage port -a -t snmp_port_t -p udp 161

SNMPv3 snmpwalk

Posted on March 16, 2018 by admin

Where AuthPass is your SNMPv3 Authorization password and CryptoPass is your SNMPv3 Encryption password.

snmpwalk -v3 -a MD5 -A AuthPass -x DES -X CryptoPass -l authPriv -u privUser localhost

If your not using encryption you should be able to drop the “-x des” and “-X CryptoPass” option, and change the “-l” option “authPriv” to “authNoPriv”

Setup SNMP on XenServer

Posted on January 22, 2018 by admin

log into the Xenserver via SSH, or get a console through XenCenter.

Open up the snmpd.conf file with your favorite text editor, nano, vi etc.

vi /etc/snmp/snmpd.conf

Find the line the following line

com2sec notConfigUser default public

and change the source “default” to the allowed IP ranges and the community “public” to whatever you want your new community string to be.

Example:

com2sec notConfigUser 192.168.1.0/24 privateString

Save, exit and start snmpd

service snmpd start

Add the following line in your iptables config. It needs to be above the COMMIT line.

-A RH-Firewall-1-INPUT -s 0.0.0.0/0 -m udp -p udp --dport 161 -j ACCEPT

Restart iptables

service iptables restart

You should be good to go.

Incredigeek

Tag Archives: snmp

Hardening SNMP on Debian

Modify /etc/snmp/snmpd.conf

Create SNMP v3 User

Troubleshooting

Hardening SNMP on CentOS/RedHat/Fedora Etc.

Disable SNMP Versions 1 and 2c

Create SNMP Version 3 User

SNMPv3 snmpwalk Mikrotik

Configure AirOS SNMP settings over ssh

cnMaestro configuration for SNMPv3

Setup SNMP v3 on Mikrotik Router

Setup SNMPv3

Troubleshooting

Delete SNMPv3 User on Linux

semanage Allow and Delete ports in CentOS

SNMPv3 snmpwalk

Setup SNMP on XenServer