{
  "id": "CB-UBU-SVC-006",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-SVC-006",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-SVC-006.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-SVC-006.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-SVC-006",
    "title": "Disable the SNMP agent and trap receiver when they are not used",
    "finding": {
      "title": "An SNMP agent or trap receiver can run on a system that is not monitored through SNMP",
      "description": "SNMP versions 1 and 2c authenticate with a clear-text community string and reveal detailed system information."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "services",
      "snmp",
      "attack-surface"
    ],
    "description": "Net-SNMP provides the agent `snmpd`, which answers monitoring queries on UDP port 161, and the\ntrap receiver `snmptrapd` (`snmptrapd.service` and `snmptrapd.socket`) on UDP port 162.\n\nThe control passes when each unit is masked or not installed at all.\n",
    "rationale": "With SNMPv1 and v2c, anyone who sniffs or guesses the community string reads the process list,\nnetwork configuration and installed software, and may change settings if write access is\nconfigured. The agent is also remotely reachable code.\n",
    "impact": "Masking a unit stops it and prevents it from starting again. The `snmpget`/`snmpwalk` client\ntools are not affected. Systems monitored through SNMP must exclude this control in their\ntailoring file and use SNMPv3 with authentication and encryption.\n",
    "notes": "A unit that does not exist counts as compliant, so removing the package is an equally valid fix.\n",
    "audit": {
      "manual": "For each unit, run `systemctl is-enabled <unit>`. It must print `masked`, or fail because the\nunit does not exist: `snmpd.service`, `snmptrapd.service`, `snmptrapd.socket`.\n",
      "logic": "all",
      "checks": [
        {
          "id": "snmpd",
          "engine": "systemd-unit",
          "description": "SNMP agent.",
          "spec": {
            "unit": "snmpd.service",
            "state": "masked"
          }
        },
        {
          "id": "snmptrapd",
          "engine": "systemd-unit",
          "description": "SNMP trap receiver.",
          "spec": {
            "unit": "snmptrapd.service",
            "state": "masked"
          }
        },
        {
          "id": "snmptrapd-socket",
          "engine": "systemd-unit",
          "description": "SNMP trap receiver socket activation.",
          "spec": {
            "unit": "snmptrapd.socket",
            "state": "masked"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Stop and mask each unit that is installed: `systemctl mask --now <unit>`. If the packages are not\nneeded at all, remove them instead: `apt purge snmpd snmptrapd`.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Run `systemctl unmask <unit>` then `systemctl enable --now <unit>`.\n",
      "scripts": [
        {
          "id": "snmpd",
          "from_check": "snmpd"
        },
        {
          "id": "snmptrapd-socket",
          "from_check": "snmptrapd-socket"
        },
        {
          "id": "snmptrapd",
          "from_check": "snmptrapd"
        }
      ]
    },
    "references": [
      {
        "title": "snmpd(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/snmpd.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "systemctl(1), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man1/systemctl.1.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R62",
        "relation": "partial",
        "note": "R62 asks to disable every unneeded service; this control covers SNMP."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "partial"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1082"
      },
      {
        "framework": "mitre-attack",
        "id": "T1210"
      },
      {
        "framework": "cwe",
        "id": "CWE-319"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Stock image passes (units absent); with snmpd installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Stock image passes (units absent); with snmpd and snmptrapd installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Stock image passes (units absent); with snmpd and snmptrapd installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Stock image passes (units absent); with snmpd and snmptrapd installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}