Uninstall net-snmp Package
Ensures the snmpd (Net-SNMP agent) package is not installed unless SNMP monitoring is an explicit, hardened requirement.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
snmpd is the Net-SNMP agent that exposes detailed host inventory and metrics over the network. If there is no need to run SNMP server software, removing the package provides a safeguard against its activation. SNMP, especially v1/v2c with default community strings like public, leaks system information to anyone on the network and has historically been a target for reconnaissance and amplification abuse.
What Pavois checks
Pavois asserts absence of snmpd via CINC/InSpec's package resource, reading the effective state from dpkg. This is what matters operationally: if the package is present, the agent can listen on UDP/161 and answer queries, a fact a config-file scan could miss if the daemon is enabled by a drop-in.
describe package('snmpd') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s snmpd; a compliant host returns package 'snmpd' is not installed. Also confirm nothing answers SNMP with ss -ulnp | grep ':161' (no output).
Inspect & investigate
- Removal is recorded in
/var/log/dpkg.logand/var/log/apt/history.log. - After removal,
systemctl status snmpdreports not-found and UDP/161 is no longer bound (ss -ulnp).
Remediation
The harden plan declares a package resource for snmpd with action remove; pavois harden apply uninstalls it via apt. The SNMP agent stops answering immediately.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | snmpd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If a monitoring platform (Zabbix, LibreNMS, Nagios, network NMS) polls this host over SNMP, removing snmpd will break those metrics and dashboards. Confirm the host is not a monitored target first. If SNMP is genuinely required, do not remove it, instead harden it (SNMPv3 with auth/priv, restrict to the management subnet) rather than running v1/v2c.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.15, 2.2.4 | direct | per OS, see the benchmark table | high |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.