# Ensure snmp services are not in use

The Simple Network Management Protocol (SNMP) is a protocol for collecting and organizing information about managed devices on IP networks. While useful for network monitoring, it can pose a significant security risk if not required or improperly configured. Older versions of SNMP (v1 and v2c) transmit credentials (community strings) in cleartext, making them susceptible to interception. Attackers can exploit SNMP to gather sensitive network information, such as system configurations, network topology, and active services, which can be used to plan further attacks. If SNMP is not essential for system management, it must be disabled or removed to reduce the system's attack surface. The audit script verifies the status of the 'snmpd' service. The remediation script either disables the service or completely removes the associated packages. The recommended states progress from simply disabling the service (Basic), to allowing for either a disabled or uninstalled state (Moderate), to the most secure configuration where the package is completely removed (Strict), ensuring it cannot be accidentally started and eliminating all related potential vulnerabilities.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled', 'not installed']` |
| **Strict** | `['not installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'snmpd' service is enabled. The script should use 'systemctl is-enabled snmpd'. If the service is not found, it should be treated as 'not installed'. The script must return only one of the following strings: 'enabled', 'disabled', or 'not installed', with no additional text.

## Remediation Script Working

Bash script that accepts a single command-line argument: 'disabled' or 'uninstalled'. If the argument is 'disabled', the script must stop and disable the 'snmpd' service. If the argument is 'uninstalled', the script must purge the 'snmp' and 'snmpd' packages. The script must return 'true' on success and 'false' on failure.

