Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When working with servers on the internet and doing monitoring is there any dangers using SNMPv2?

I am working with observium and have the following: /etc/snmpd.conf

com2sec readonly  default         public
group MyROGroup v1         readonly
group MyROGroup v2c        readonly
group MyROGroup usm        readonly
view all    included  .1                               80
access MyROGroup ""      any       noauth    exact  all    none   none
syslocation City, Country
syscontact Admins sysadmins@example.com
#This line allows Observium to detect the host OS if the distro script is installed
extend .1.3.6.1.4.1.2021.7890.1 distro /usr/bin/distro
share|improve this question

1 Answer 1

That depends. What is the risk you see with having some unknown entity be able to see your switch configuration?

By capturing SNMP v2 traffic (unencrypted) a potential attacker can map out what your network looks like, probably matching VLANs to departments and server networks, etc.

It is an information leak. You are not allowing write so they can't change anything, but they could get a very good idea of how your network works, and where to focus on attacking. If you set it up such that the observium station across the internet connects via VPN that terminates on a management VLAN so that the traffic is contained, you could minimize who might have access to the traffic between the switch and observium.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.