46 lines
2.1 KiB
Plaintext
46 lines
2.1 KiB
Plaintext
|
Our net-snmp package was audited by Thomas Biege of the SuSE Security team
|
||
|
|
prior to the release of CERT Advisory CA-2002-03. Of course, this
|
||
|
|
is not a guarantee that future problems will not be found and does not
|
||
|
|
address flaws and insecurities inherent in software as powerful and
|
||
|
|
complex as an SNMP implementation. Because of this we recommend that
|
||
|
|
SNMP access (161/udp,162/udp) be blocked at your firewall.
|
||
|
|
|
||
|
|
There are also some important changes that have been made in this release
|
||
|
|
of our package:
|
||
|
|
o the daemon now sets a PID file in /var/run/
|
||
|
|
|
||
|
|
o logging is now done directly to /var/log/net-snmp.log instead
|
||
|
|
of sending stderr/stdout through syslog. If you don't want logging,
|
||
|
|
remove the '-l /var/log/net-snmp.log' from /etc/init.d/snmpd.
|
||
|
|
|
||
|
|
o the daemon is now started with the '-r'. This option prevents
|
||
|
|
snmpd from exiting if it doesn't have permission to read something.
|
||
|
|
This only occurs if you start snmpd on a high port as a non-root
|
||
|
|
root user.
|
||
|
|
|
||
|
|
o If you need to run snmptrapd, we've provided an example init
|
||
|
|
script in /usr/share/doc/packages/net-snmp/rc.snmptrapd. SNMP
|
||
|
|
traps should be avoided whenever possible because they are
|
||
|
|
unreliable (you should poll with snmpget instead) and snmptrapd
|
||
|
|
has been the source of many of the security problems with snmp
|
||
|
|
so please don't run this unless you are sure of what you are doing.
|
||
|
|
To install the script,
|
||
|
|
cp rc.snmptrapd /etc/init.d/snmptrapd
|
||
|
|
innserv /etc/init.d/snmptrapd
|
||
|
|
cd /usr/sbin && ln -s ../../etc/init.d/snmptrapd .
|
||
|
|
and create a configuration file named /etc/snmptrapd.conf. Then,
|
||
|
|
start the daemon with
|
||
|
|
rcsnmptrapd start
|
||
|
|
Logging is done to /var/log/net-snmptrapd.log.
|
||
|
|
|
||
|
|
o Master agentx support is enabled if you have modules in
|
||
|
|
/usr/lib/net-snmp/--the domain socket is created as
|
||
|
|
/var/run/agentx/master. You can change this to a network
|
||
|
|
interface if needed (see snmpd(1)). The snmpd init script
|
||
|
|
automatically detects and starts any sub-agents in placed into
|
||
|
|
/var/lib/net-snmp.
|
||
|
|
|
||
|
|
More documentation on the net-snmp package can be found in this directory
|
||
|
|
as well as the project's homepage: http://net-snmp.sourceforge.net/
|
||
|
|
|