Bug 972520 - The snmpd service must use only SNMP protocol version 3 or newer.
The snmpd service must use only SNMP protocol version 3 or newer.
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: net-snmp (Show other bugs)
6.6
All Linux
unspecified Severity high
: rc
: ---
Assigned To: Josef Ridky
BaseOS QE Security Team
:
Depends On:
Blocks: 1359119 1359123
  Show dependency treegraph
 
Reported: 2013-06-09 16:25 EDT by Jason Pyeron
Modified: 2016-07-22 06:48 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1359119 (view as bug list)
Environment:
Last Closed: 2016-07-22 06:44:44 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
srcrpm patch (specfile/sources) (1.40 KB, patch)
2013-06-09 16:27 EDT, Jason Pyeron
no flags Details | Diff
srcrpm (5.45 MB, application/x-rpm)
2013-06-09 16:28 EDT, Jason Pyeron
no flags Details
srcrpm patch (specfile/sources) (1.49 KB, patch)
2013-06-09 16:32 EDT, Jason Pyeron
no flags Details | Diff
srcrpm (5.45 MB, application/x-rpm)
2013-06-09 16:34 EDT, Jason Pyeron
no flags Details

  None (edit)
Description Jason Pyeron 2013-06-09 16:25:05 EDT
Description of problem:

The default configuration is not conforming to best practices. The Red Hat Enterprise Linux 6 Security Technical Implementation Guide (STIG) v1.2 published by the Defense Information Systems Agency recommends the changes in the attached patch.

Version-Release number of selected component (if applicable):

http://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/net-snmp-5.5-44.el6_4.1.src.rpm

How reproducible:

Always

Steps to Reproduce:

perform a yum install

Actual results:

root@test /tmp/setup
# grep 'v1\|v2c\|com2sec' /etc/snmp/snmpd.conf | grep -v '^#'
com2sec notConfigUser  default       public
group   notConfigGroup v1           notConfigUser
group   notConfigGroup v2c           notConfigUser

Expected results:

# grep 'v1\|v2c\|com2sec' /etc/snmp/snmpd.conf | grep -v '^#'

There should be no output.

Additional info:

see: http://iase.disa.mil/stigs/os/unix/red_hat.html
Comment 1 Jason Pyeron 2013-06-09 16:27:41 EDT
Created attachment 758937 [details]
srcrpm patch (specfile/sources)
Comment 2 Jason Pyeron 2013-06-09 16:28:52 EDT
Created attachment 758938 [details]
srcrpm
Comment 3 Jason Pyeron 2013-06-09 16:32:56 EDT
Created attachment 758939 [details]
srcrpm patch (specfile/sources)
Comment 4 Jason Pyeron 2013-06-09 16:34:59 EDT
Created attachment 758940 [details]
srcrpm
Comment 6 Jan Safranek 2013-06-10 08:50:59 EDT
Thanks for the bug report. While I agree that the default snmpd.conf file is suboptimal, changing it in the middle of RHEL6 lifetime is dangerous. Please keep in mind that bugzilla is not a support tool or means of accessing support. Please contact Red Hat support at access.redhat.com, where this change can be properly tracked and reviewed.
Comment 7 RHEL Product and Program Management 2013-10-13 23:23:14 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Note You need to log in before you can comment on or make changes to this bug.