Check: GEN005300
HP-UX 11.31 STIG:
GEN005300
(in versions v1 r19 through v1 r13)
Title
SNMP communities, users, and passphrases must be changed from the default. (Cat I impact)
Discussion
Whether active or not, default SNMP passwords, users, and passphrases must be changed to maintain security. If the service is running with the default authenticators, then anyone can gather data about the system and the network using the information to potentially compromise the integrity of the system or network(s).
Check Content
Check the SNMP configuration for default passwords. Locate and examine the SNMP configuration. # more /etc/SnmpAgent.d/snmpd.conf Alternatively: # cat /etc/SnmpAgent.d/snmpd.conf | grep -i community Identify any community names or user password configuration. If any community name or password is set to a default value such as public, private, snmp-trap, or password, or any value which does not meet DISA password requirements, this is a finding.
Fix Text
Change the default passwords. To change them, edit the /etc/SnmpAgent.d/snmpd.conf file. Locate the line system-group-read-community which has a default password of public and make the password something more random (less guessable). Do the same for the lines reading system-group-write-community, read-community, write-community, trap, and trap-community. Read the information in the file carefully. The trap is defining who to send traps to, for instance, by default. It will not be a password, but the name of a host.
Additional Identifiers
Rule ID: SV-35172r1_rule
Vulnerability ID: V-993
Group Title: GEN005300
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000178 |
The organization manages information system authenticators for users and devices by changing default content of authenticators upon information system installation. |
Controls
Number | Title |
---|---|
No controls are assigned to this check |