Detections
Analytics

6.4.1 (L1) Host SNMP services, if enabled, must limit access

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

To manage hosts securely, if SNMP is enabled, access must be restricted. Preferably, SNMPv3 should be employed as it offers superior security through key authentication and encryption compared to SNMPv1 or SNMPv2. Configuring the destination for SNMP traps is essential for ensuring monitoring data is directed to a legitimate and secure host.

Proper SNMP configuration is crucial to reduce the risk of misuse or compromise, especially if other management means are in place. SNMPv3's enhanced security features are pivotal for secure management and monitoring.

Solution

To correct the SNMP configuration, perform the following from the ESXi Shell or vCLI:

 - If SNMP is not needed, disable it by running:

esxcli system snmp set --enable false

 - If SNMP is needed, refer to the vSphere Monitoring and Performance guide, chapter 8 for steps to configure it.

Additionally, the following PowerCLI command may be used to implement the configuration:

# Update the host SNMP Configuration (single host connection required)
Get-VmHostSNMP | Set-VMHostSNMP -Enabled:$true -ReadOnlyCommunity '<secret>'

Notes:

 - SNMP must be configured on each ESXi host
 - SNMP settings can be configured using Host Profiles

Impact:

Improper SNMP configuration can redirect sensitive monitoring data to malicious hosts, risking exploitation and compromising host security.

See Also

https://workbench.cisecurity.org/benchmarks/21888

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CM-6, 800-53|CM-7, 800-53|SC-23, CSCv7|9.2

Plugin: Unix

Control ID: 755961f88598c59152a2e65493a726ce4d36adf851969eeb9f6fcf3467c1372d