Uninstall net-snmp Package
Removes the net-snmp package (the snmpd SNMP agent) when no SNMP server is required.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The net-snmp package provides the snmpd SNMP agent. SNMP, especially v1/v2c with community strings, exposes detailed system information over the network and is a frequent target: weak or default community strings allow attackers to enumerate and sometimes reconfigure the host. If there is no need to run an SNMP server, removing the package provides a safeguard against its activation and removes a listening network service from the attack surface.
What Pavois checks
Pavois queries the package database through the InSpec package('net-snmp') resource and asserts should_not be_installed, resolving via dpkg/rpm. Reading the effective package inventory is more reliable than checking whether snmpd is currently listening: a stopped service can still be installed and re-enabled, and a leftover /etc/snmp/snmpd.conf does not prove the daemon is gone. The package state is the ground truth.
describe package('snmpd') do
it { should_not be_installed }
endHow to verify it is applied
RHEL: rpm -q net-snmp should print package net-snmp is not installed. Debian/Ubuntu: dpkg -s snmpd should report not installed. Confirm nothing listens on the SNMP port with ss -lunp | grep :161 (no output expected).
Inspect & investigate
Removal is logged in /var/log/dpkg.log (Debian/Ubuntu) or dnf history (RHEL). Prior SNMP agent activity and authentication failures appear in journalctl -u snmpd and /var/log/snmpd.log if logging was configured. After removal, no snmpd unit should exist.
Remediation
Pavois's harden plan declares a package resource for net-snmp with action remove; pavois harden apply uninstalls it via the native package manager (apt/dnf), which also removes the snmpd service. Note: on Debian/Ubuntu the SNMP daemon ships in the snmpd package, adjust the name accordingly if your distro packages it separately.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | snmpd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If a monitoring system (Zabbix, Nagios, LibreNMS, network polling) depends on this host's SNMP agent, removing net-snmp will break that monitoring. Precautions: before applying, confirm no NMS polls this host over SNMP. If SNMP monitoring is genuinely required, do not remove it, instead disable v1/v2c, configure SNMPv3 with authentication and privacy, and restrict the listener to management addresses. Removing the package has no impact on hosts that never used SNMP.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.15, 2.2.4, 2.1.14 | direct | per OS, see the benchmark table | high |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.