Home » Blog » Setting Up SNMP on Ubuntu 22.04/Debian 11

Information

Setting Up SNMP on Ubuntu 22.04/Debian 11

Benhcmark Administrator

27/07/2025

0 Views 0

SaveSavedRemoved 0

A Step-by-Step Guide to Installing and Securing SNMP on Ubuntu 22.04 & Debian 11

Proactive network monitoring is the cornerstone of a stable and reliable IT infrastructure. By keeping a close watch on metrics like CPU load, memory usage, and network traffic, administrators can identify potential issues before they become critical. The Simple Network Management Protocol (SNMP) is a standardized and essential tool for collecting this vital information from network devices, including servers running Ubuntu or Debian.

This guide provides a comprehensive walkthrough for installing, configuring, and securing the SNMP service on Ubuntu 22.04 LTS and Debian 11.

What is SNMP?

SNMP operates on a simple model: a central manager (your monitoring server) polls an agent (the service running on the device you want to monitor). The agent provides access to a database of information, known as a Management Information Base (MIB), allowing the manager to query device status, performance metrics, and configuration details.

This guide focuses on setting up the snmpd daemon, which is the agent that runs on your server and responds to requests from your monitoring system.

Step 1: Install the SNMP Agent (snmpd)

The first step is to install the necessary packages on your server. Open your terminal and run the following commands to update your package list and install the SNMP daemon and related utilities.

sudo apt update
sudo apt install snmpd

This command installs snmpd, the agent that will listen for and respond to SNMP requests.

Step 2: Configure the SNMP Agent (snmpd.conf)

The default configuration file located at /etc/snmp/snmpd.conf is extensive and can be overwhelming. For a cleaner and more secure setup, it’s best practice to back up the original file and start with a fresh one.

1. Back up the default configuration:
   bash
sudo mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

2. Create a new, empty configuration file:
   bash
sudo nano /etc/snmp/snmpd.conf


Now, we will add our custom configuration to this new, empty file.

First, specify the IP address the SNMP agent should listen on. To listen on all IPv4 interfaces on the standard UDP port 161, add the following line. This is a common setting for servers within a trusted network.

# Listen for incoming SNMP requests
agentAddress udp:161,udp6:[::1]:161

Step 3: Choose Your Configuration – SNMPv2c vs. SNMPv3

You have two primary choices for SNMP configuration. Your decision has significant security implications.

• SNMPv2c: Simpler to set up but relies on a plaintext “community string” for access. It should only be used in completely isolated and trusted networks.
• SNMPv3: More complex but vastly more secure. It provides authentication (verifying the sender’s identity) and encryption (protecting the data in transit). We strongly recommend using SNMPv3 for any production environment.

Option A: Configuring SNMPv2c (The Quick Method)

If you must use SNMPv2c, you will define a read-only community string. This string acts like a password. Add the following line to your snmpd.conf file.

# Define a read-only community string for SNMPv2c
rocommunity public default -V systemonly

• rocommunity: Defines a read-only community. For read-write access (not recommended), you would use rwcommunity.
• public: This is the community string. You should change “public” to a long, complex, and unique string to improve security.
• default: Allows access from any IP address. You can restrict this by replacing default with a specific IP or network (e.g., 192.168.1.100 or 10.0.0.0/24).
• -V systemonly: Restricts access to a specific “view,” in this case, the system MIB tree, which contains basic system information.

Option B: Configuring SNMPv3 (The Secure & Recommended Method)

For a secure setup, SNMPv3 is the correct choice. Instead of a simple community string, you create a user with authentication and privacy (encryption) protocols and passphrases.

Add the following lines to your snmpd.conf file to create a secure user.

# Create a secure SNMPv3 user
createUser myadmin SHA "MyAuthPassword" AES "MyPrivPassword"

# Grant the user read-only access
rouser myadmin authPriv -V systemonly

Let’s break this down:

• createUser myadmin ...: This command creates a new user named myadmin.
• SHA: Specifies the authentication protocol (you can also use MD5, but SHA is stronger).
• "MyAuthPassword": This is the authentication passphrase. Replace this with a strong, unique password.
• AES: Specifies the privacy (encryption) protocol (you can also use DES, but AES is the industry standard).
• "MyPrivPassword": This is the privacy passphrase. Replace this with another strong, unique password.
• rouser myadmin authPriv: This line grants the user myadmin read-only access. The authPriv security level requires that any request from this user must be both authenticated and encrypted, ensuring maximum security.

Step 4: Apply Changes and Open the Firewall

After saving your snmpd.conf file, you need to restart the SNMP service for the new configuration to take effect.

sudo systemctl restart snmpd

Next, you must allow traffic on the SNMP port through your firewall. If you are using UFW (Uncomplicated Firewall), run the following command:

# Allow inbound traffic on UDP port 161
sudo ufw allow 161/udp

Step 5: Verifying Your SNMP Configuration

The final step is to test that your configuration is working correctly from your monitoring server or another machine with SNMP utilities installed.

To test an SNMPv2c setup:

Use the snmpwalk command with your community string.

snmpwalk -v2c -c public your_server_ip

(Remember to replace public with your custom community string and your_server_ip with the IP of your Ubuntu/Debian machine.)

To test an SNMPv3 setup:

The command is more complex as it requires all the user credentials.

snmpwalk -v3 -l authPriv -u myadmin -a SHA -A "MyAuthPassword" -x AES -X "MyPrivPassword" your_server_ip

• -v3: Specifies SNMP version 3.
• -l authPriv: Sets the security level to authentication and privacy.
• -u myadmin: The username.
• -a SHA: The authentication protocol.
• -A "MyAuthPassword": The authentication password.
• -x AES: The privacy (encryption) protocol.
• -X "MyPrivPassword": The privacy password.

If the command returns a long list of system information (MIBs), your SNMP agent is configured correctly and ready for your network monitoring system.

Source: https://kifarunix.com/install-and-configure-snmp-on-ubuntu-debian/