Disable snmpd Service
Ensures the snmpd.service (Simple Network Management Protocol agent) is neither enabled at boot nor running, unless SNMP monitoring is genuinely required.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The SNMP agent (snmpd, UDP 161) exposes detailed system information, interfaces, routes, running processes, sometimes ARP and routing tables, to anyone who can reach it. SNMPv1/v2c use a plaintext "community string" as the only credential, frequently left at the default public, which leaks data to passive sniffers and lets attackers fingerprint the host; SNMP is also a known UDP amplification DDoS reflector. Where no monitoring uses SNMP, the agent is pure exposure. If needed, it should run only with SNMPv3 (auth + privacy) and tight ACLs; otherwise it should be stopped and disabled.
What Pavois checks
Pavois reads the effective state of snmpd.service from systemd, asserting it is neither enabled nor running. This reflects what is actually bound to UDP 161 regardless of whether /etc/snmp/snmpd.conf exists, and catches a daemon started by a drop-in override or one that is installed but masked. A file/package check cannot tell you the live listening state.
describe service('snmpd.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled snmpd.service and systemctl is-active snmpd.service; expect disabled/masked and inactive. Confirm nothing listens with ss -ulnp | grep :161.
Inspect & investigate
Inspect journalctl -u snmpd.service for start/stop and query activity. systemctl show snmpd.service -p ActiveState -p UnitFileState gives the machine-readable state Pavois asserts. Confirm UDP 161 is closed with ss -ulnp | grep :161.
Remediation
Pavois's harden plan acts on the service resource named snmpd with actions disable then stop: it removes boot enablement and stops the agent. Applied with pavois harden apply. Existing /etc/snmp/ config is left untouched.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | snmpd |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling snmpd stops this host from being polled via SNMP: NMS/monitoring platforms (Zabbix, LibreNMS, Nagios, Cacti, PRTG…) will lose interface counters, health metrics and traps from it, potentially triggering 'host down' alerts. Before applying: confirm the host is not monitored over SNMP, or that monitoring has an alternative agent (node_exporter, Zabbix agent). If SNMP is required, exclude this rule and instead harden the agent: SNMPv3 only, no default community, source ACLs. Disabling snmpd does not affect outbound SNMP trap senders configured elsewhere.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.15 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.