SRV-176 취약한 SNMP 버전을 사용

SRV-176 취약한 SNMP 버전을 사용

【 상세설명 】
SNMP v2를 사용하는 경우 community string을 평문으로 인증하고 있으며, 데이터의 무결성, 인증 또는 암호화를 지원하지 않아 데이터 변조, 도청 및 중간자 공격으로 시스템 정보 및 상태정보가 유출될 가능성이 존재하므로 안전한 SNMP 버전을 사용하지 여부를 점검

【 판단기준 】
- 양호 : SNMPv3 사용하는 경우
- 취약 : SNMPv3 사용하지 않는 경우

【 판단방법 】
  1. SNMP 버전 확인
  2. SNMP 서비스 설정 파일 확인
  3. SNMP v3 사용 여부 확인
       ※ "snmpwalk" 명령어를 사용하려면 "net-snmp-devel", "libsnmp-dev" 등 패키지 설치 필요
       ※ SNMP v3 "Passphrase" 길이가 7자 이하인 경우 SNMP v3 사용 불가
           Error: passphrase chosen is below the length requirements of the USM (min=8).
           snmpwalk: Generic error (Error generating a key (Ku) from the supplied authentication pass phrase.)
       ※ "snmpwalk" 명령어 주요 Error message
          - SNMP 서비스 미실행, 옵션 미설정 등 : snmpwalk: Timeout
          - username : snmpwalk: Unknown user name
          - AuthPassphrase : snmpwalk: Authentication failure (incorrect password, community or key)
          - PrivPassphrase : Timeout: No Response from <ip_address>
          - ip Address : snmpwalk: Invalid address (<ip_address>)

  ■ Linux
      # snmpd -v
      # snmpd --version
          NET-SNMP version:  5.9.3
          Web:               http://www.net-snmp.org/
          Email:             net-snmp-coders@lists.sourceforge.net
  또는
      # snmpget -V    
      # snmpget --version
          NET-SNMP version: 5.9.3

      # cat /etc/snmpd.conf
      # cat /etc/snmp/snmpd.conf
      # cat /etc/snmp/conf/snmpd.conf
          rwuser <username>
          rouser <username>
          …

      # snmpwalk -v3 -u <user_name> -l authPriv -a SHA -A <AuthPassphrase> -x AES -X <PrivPassphrase> localhost
          SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost 5.14.0-...

  ■ AIX
      # lslpp -l | grep -i snmp
          bos.net.tcp.snmp           7.2.4.0  COMMITTED  TCP/IP SNMP Client Application
          ...

      # cat /etc/snmpd.conf
      # cat /etc/snmpdv3.conf
          rwuser <username>
          rouser <username>
          …

      # snmpwalk -v3 -u <user_name> -l authPriv -a SHA -A <AuthPassphrase> -x AES -X <PrivPassphrase> localhost
          SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost 5.14.0-...

  ■ HP-UX
      # what /usr/sbin/snmpdm
          /usr/sbin/snmpdm:
              Copyright 1992-2001 SNMP Research, Incorporated
              ...

      # cat /etc/SnmpAgent.d/snmpd.conf
          usmUserEntry  localSnmpID <username> \
                  usmHMACMD5AuthProtocol usmDESPrivProtocol nonVolatile - \
                  <AuthPassphrase> \
                  <PrivPassphrase>
          …

      # snmpwalk -v3 -u <user_name> -l authPriv -a SHA -A <AuthPassphrase> -x AES -X <PrivPassphrase> localhost
          SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost 5.14.0-...

  ■ SOLARIS 9 이하
      # snmpd -v
      # snmpd --version
          NET-SNMP version:  5.4.1
          Web:               http://www.net-snmp.org/
          Email:             net-snmp-coders@lists.sourceforge.net
  또는
      # snmpget -V
      # snmpget --version
          NET-SNMP version: 5.4.1

      # cat /etc/snmp/conf/snmpd.conf
          rwuser <username>
          rouser <username>
          …

      # snmpwalk -v3 -u <user_name> -l authPriv -a SHA -A <AuthPassphrase> -x AES -X <PrivPassphrase> localhost
          SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost 5.14.0-...

  ■ SOLARIS 10
      # snmpd -v
      # snmpd --version
          NET-SNMP version:  5.4.1
          Web:               http://www.net-snmp.org/
          Email:             net-snmp-coders@lists.sourceforge.net
  또는
      # snmpget -V
      # snmpget --version
          NET-SNMP version: 5.4.1

      # cat /etc/sma/snmp/snmpd.conf
          rwuser <username>
          rouser <username>
          …

      # snmpwalk -v3 -u <user_name> -l authPriv -a SHA -A <AuthPassphrase> -x AES -X <PrivPassphrase> localhost
          SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost 5.14.0-...

  ■ SOLARIS 11
      # snmpd -v
      # snmpd --version
          NET-SNMP version:  5.4.1
          Web:               http://www.net-snmp.org/
          Email:             net-snmp-coders@lists.sourceforge.net
  또는
      # snmpget -V
      # snmpget --version
          NET-SNMP version: 5.4.1

      # cat /etc/net-snmp/snmpd.conf
          rwuser <username>
          rouser <username>
          …

      # snmpwalk -v3 -u <user_name> -l authPriv -a SHA -A <AuthPassphrase> -x AES -X <PrivPassphrase> localhost
          SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost 5.14.0-...
  
【 조치방법 】
  1. SNMP 설정 파일에서 SNMP v1, v2, v2c 설정 삭제 또는 주석 처리
  2. SNMP 서비스 재시작
 
  2024-01-13 : (조치과정 삭제)