When working with servers on the internet and doing monitoring is there any dangers using SNMPv2?

I am working with observium and have the following: /etc/snmpd.conf

com2sec readonly  default         public
group MyROGroup v1         readonly
group MyROGroup v2c        readonly
group MyROGroup usm        readonly
view all    included  .1                               80
access MyROGroup ""      any       noauth    exact  all    none   none
syslocation City, Country
syscontact Admins sysadmins@example.com
#This line allows Observium to detect the host OS if the distro script is installed
extend . distro /usr/bin/distro

That depends. What is the risk you see with having some unknown entity be able to see your switch configuration?

By capturing SNMP v2 traffic (unencrypted) a potential attacker can map out what your network looks like, probably matching VLANs to departments and server networks, etc.

It is an information leak. You are not allowing write so they can't change anything, but they could get a very good idea of how your network works, and where to focus on attacking. If you set it up such that the observium station across the internet connects via VPN that terminates on a management VLAN so that the traffic is contained, you could minimize who might have access to the traffic between the switch and observium.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.