0

I need to deploy about a thousand machines across the US later this year. I'm hoping to use SNMP to monitor their (collective and individual) status. The whole block will be connected via OpenVPN so I'm hoping that there is a way to limit SNMP access to this network.

The only setting I've discovered so far is to use:

rocommunity <community name> 10.20.0.0/16

where 10.20.xx.xx is the VPN.

I don't have any other users or communities defined. Will this be sufficient?

Improve this question

1 Answer 1

Reset to default
2

If you only use fully-configurable Net-SNMP clients, this should be sufficient, but I would add IPtables rules as an additional measure to block SNMP traffing from other networks outright.

Also note that on many embedded systems, you can't configure an allowed network in this form so if you have something like this in your network, you need to take this into account.

Improve this answer
2
  • Can you elaborate on what you mean by 'fully-configurable' and 'allowed network'? I've been testing with (what I believe is) net-snmp (via CentOS) using the VPN. I hadn't planned to use IPTables as the devices need to act as routers but I will revisit this decision.
    – ethrbunny
    Apr 10, 2013 at 14:48
  • 1
    I meant "fully configurable" as a contrast to the embedded devices I mentioned in the second paragraph. The phrase "allowed network" means the "10.20.0.0/16" network you added to the rocommunity statement, which limits access to this network. This configuration option doesn't exist in many embedded devices with SNMP functionality. In these devices, everyone who can reach the device and knows the community name can read and/or write to the SNMP device.
    – Sven
    Apr 10, 2013 at 14:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .