documentation_complete: true


title: 'Ensure SNMP Read Write is disabled'

description: |-
    Edit <tt>/etc/snmp/snmpd.conf</tt>, remove any <tt>rwuser</tt> entries.
    Once the read write users have been removed, restart the SNMP service:
    <pre>$ sudo systemctl restart snmpd</pre>

rationale: |-
    Certain SNMP settings can permit users to execute system behaviors from user
    writes to the community strings.
    This may permit a compromised account to execute commands on a remote system.

severity: medium

identifiers:
    cce@rhel8: CCE-82733-7

ocil_clause: 'there are users who can write to SNMP values'

ocil: |-
    To ensure there are no read-write users, run the following command:
    <pre>$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep 'rwuser'</pre>
    There should be no output.

platform: package[net-snmp]
