Disable the SNMP agent and trap receiver when they are not used

Description

Net-SNMP provides the agent snmpd, which answers monitoring queries on UDP port 161, and the trap receiver snmptrapd (snmptrapd.service and snmptrapd.socket) on UDP port 162.

The control passes when each unit is masked or not installed at all.

A unit that does not exist counts as compliant, so removing the package is an equally valid fix.

Rationale

With SNMPv1 and v2c, anyone who sniffs or guesses the community string reads the process list, network configuration and installed software, and may change settings if write access is configured. The agent is also remotely reachable code.

Impact

Masking a unit stops it and prevents it from starting again. The snmpget/snmpwalk client tools are not affected. Systems monitored through SNMP must exclude this control in their tailoring file and use SNMPv3 with authentication and encryption.

Audit

For each unit, run systemctl is-enabled <unit>. It must print masked, or fail because the unit does not exist: snmpd.service, snmptrapd.service, snmptrapd.socket.

Automated: every check must pass. Scanners report each check by its id.

snmpd

SNMP agent.

unit: snmpd.service
state: masked

snmptrapd

SNMP trap receiver.

unit: snmptrapd.service
state: masked

snmptrapd-socket

SNMP trap receiver socket activation.

unit: snmptrapd.socket
state: masked

Remediation

Stop and mask each unit that is installed: systemctl mask --now <unit>. If the packages are not needed at all, remove them instead: apt purge snmpd snmptrapd.

Rollback

Run systemctl unmask <unit> then systemctl enable --now <unit>.

snmpd

Generated from check snmpd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

snmptrapd-socket

Generated from check snmptrapd-socket: the engine writes the fix for every output, it sets the expected value and the check runs again after.

snmptrapd

Generated from check snmptrapd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• snmpd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle