Ensure SNMP is SNMPv3 only with authentication and privacy (or disabled)

VisokaNivo 1Ručni pregledprinter

Opis

SNMPv1/v2c community strings (public/private by default) are sent in clear text and often allow configuration writes, including resetting the admin password on some models. SNMPv3 authPriv protects management traffic.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Networking > SNMP (Xerox: Connectivity > Setup > SNMP; Ricoh: Configuration > SNMPv3): SNMPv1/v2c disabled (or read-only with a non-default community if a monitoring tool cannot do v3), SNMPv3 enabled with security level authPriv using SHA (SHA-256 if available) and AES; no default 'public'/'private' community strings; write access restricted to the management station.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

EWS: disable SNMPv1/v2c, enable SNMPv3, create a user with SHA authentication and AES privacy, update fleet management/monitoring tools to use SNMPv3 credentials.

Svojstva

Operativni sistemi: Bilo koji
Oznake: printersnmpnetwork-management
Referenca: CIS Multi-Function Device Benchmark v1.0.0 - SNMP configuration (verify section number for your release)