7. Security Considerations

This document defines protocol operations for SNMP. The protocol operations themselves do not provide security. Rather, security is provided by the SNMP framework through use of the architecture defined in RFC 3411 [RFC3411] and the security subsystems defined in RFC 3414 [RFC3414] and RFC 3415 [RFC3415].

It is the responsibility of the network administrator to define security policies which take into account the resources being managed, the sensitivity of the management information, and the threats to which the network is exposed. It is then the responsibility of the architecture, the security subsystem, and the access control subsystem to enforce those policies.

Specifically, the SNMP architecture provides mechanisms for:

• Message authentication: Ensuring that messages have not been altered or spoofed.

• Message privacy: Ensuring that the contents of messages cannot be read by unauthorized parties.

• Message authorization: Ensuring that only authorized users can perform management operations.

The protocol operations defined in this document assume that:

1. The SNMP message containing the operation has been authenticated to establish the identity of the principal on whose behalf the operation is being performed.

2. Access control checks have been performed by the SNMP engine to determine whether the identified principal is authorized to perform the requested operation on the specified managed objects.

3. If privacy is required, the SNMP message has been encrypted to prevent disclosure to unauthorized parties.

These functions are performed by the message processing and security subsystems of the SNMP architecture, not as part of the protocol operations themselves.

However, applications using the protocol operations defined in this document should be aware of the following security considerations:

Information Disclosure

The GetRequest-PDU, GetNextRequest-PDU, and GetBulkRequest-PDU operations retrieve management information from managed objects. If this information is sensitive, it should be protected through the use of message privacy mechanisms. Without such protection, the information may be disclosed to unauthorized parties through passive monitoring of network traffic.

Unauthorized Modification

The SetRequest-PDU operation modifies the values of managed objects. If modification of a particular object could have security implications (for example, disabling a firewall rule or changing an access control list), access to that object should be carefully controlled. The access control mechanisms defined in RFC 3415 [RFC3415] provide the means to restrict which principals are authorized to modify which objects.

Denial of Service

All protocol operations consume resources (network bandwidth, processing time, memory) on both the originating and receiving SNMP entities. An attacker could potentially launch a denial-of-service attack by sending a large number of requests. Rate limiting and resource management are important considerations for implementations.

The GetBulkRequest-PDU is particularly susceptible to abuse, as it is specifically designed to retrieve large amounts of data. An attacker could request a very large number of repetitions (max-repetitions) to cause the responding entity to consume excessive resources or generate extremely large responses. Implementations should impose reasonable limits on the resources consumed by any single request.

Message Replay

Without proper message authentication and timeliness checking, an attacker could capture SNMP messages and replay them at a later time. This could have serious consequences, particularly for SetRequest-PDU operations that modify managed objects. The timeliness mechanisms defined in RFC 3414 [RFC3414] protect against message replay by including time-based information in authenticated messages.

Trap/Inform Spoofing

SNMPv2-Trap-PDU and InformRequest-PDU messages provide event notification. If these notifications are not authenticated, an attacker could send false notifications to mislead network administrators or trigger inappropriate automated responses. Message authentication mechanisms should be used to verify the source of notifications.

Summary

In summary, the protocol operations defined in this document must be used in conjunction with appropriate security mechanisms to ensure:

1. Authentication of message originators
2. Protection against message modification
3. Protection against message replay
4. Privacy of message contents (when required)
5. Authorization of management operations
6. Protection against denial-of-service attacks

The SNMP architecture provides the framework for these security services, and implementations should make full use of these capabilities to protect managed networks against security threats.