# Ensure snmp services are not in use

Necessity: The Simple Network Management Protocol (SNMP) is used for network device management but is often misconfigured with weak community strings (e.g., 'public', 'private'). Attackers can exploit SNMP to gather detailed system information, including network interfaces, running services, and user accounts, which facilitates network reconnaissance and mapping. If write access is enabled, it could even allow unauthorized configuration changes. Disabling SNMP is crucial for reducing the system's attack surface unless it is explicitly required for network monitoring.

Auditing and Remediation: The audit script verifies the system's state by checking for the presence of the 'net-snmp' package, which provides the SNMP daemon (snmpd). The remediation script removes this package, thereby uninstalling the service and eliminating the associated risks.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Not Installed'. There is no secure middle ground for an unnecessary network service that provides extensive system information. Unless there is a documented and approved operational requirement for SNMP, it should be removed entirely to adhere to the principle of least functionality. This single recommendation applies across all security postures as the risk of information disclosure from an unused SNMP service is significant.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'net-snmp' package is installed. The script should use 'rpm -q net-snmp'. If the package is installed, the script must output only the string 'Installed'. If it is not installed, it must output only the string 'Not Installed'.

## Remediation Script Working

Bash script that accepts one positional argument. If the argument is 'Not Installed', the script must attempt to remove the 'net-snmp' package using 'yum -y remove net-snmp' or 'dnf -y remove net-snmp'. The script must output 'true' on successful removal or if the package was already not present, and 'false' if the removal fails.

