Ensure SNMP is SNMPv3 only with authentication and privacy (or disabled)

高等級 1人工審核printer

說明

SNMPv1/v2c community strings (public/private by default) are sent in clear text and often allow configuration writes, including resetting the admin password on some models. SNMPv3 authPriv protects management traffic.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Networking > SNMP (Xerox: Connectivity > Setup > SNMP; Ricoh: Configuration > SNMPv3): SNMPv1/v2c disabled (or read-only with a non-default community if a monitoring tool cannot do v3), SNMPv3 enabled with security level authPriv using SHA (SHA-256 if available) and AES; no default 'public'/'private' community strings; write access restricted to the management station.

修補方式

修補方法: 操作指南或基礎設施修補檔

EWS: disable SNMPv1/v2c, enable SNMPv3, create a user with SHA authentication and AES privacy, update fleet management/monitoring tools to use SNMPv3 credentials.

屬性

作業系統: 不限
標籤: printersnmpnetwork-management
參考資料: CIS Multi-Function Device Benchmark v1.0.0 - SNMP configuration (verify section number for your release)