Configuring SNMP Agents on Linux for Remote Monitoring Infrastructure
Installing Net-SNMP Packages
For RHEL/CentOS/Fedora systems:
sudo yum install net-snmp net-snmp-utils -y
For Ubuntu/Debian systems:
sudo apt-get install snmpd snmp-mibs-downloader -y
Securing Agent Communications
Backup the original configuration before modification:
sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.default
sudo chmod 600 /etc/snmp/snmpd.conf
Edit the daemon configuration file to implement access controls:
sudo nano /etc/snmp/snmpd.conf
Replace default security entries with specific collector authorization:
# Define read-only community with source restriction
rocommunity secret_observium 10.0.5.50
# Agent binding configuration
agentAddress udp:161,udp6:[::1]:161
# System metadata
sysLocation "Datacenter Rack 15, Unit 4"
sysContact "noc@infrastructure.local"
Enable full MIB tree visibility:
view broadview included .1
view broadview included .1.3.6.1.2.1.25
access notConfigGroup "" any noauth exact broadview none none
System Resource Monitoring
Add process surveillance directives:
# Critical system processes
proc init
proc rsyslogd
proc sshd 8 1
Configure filesystem monitoring with percentage thresholds:
disk / 90%
disk /tmp 80%
disk /var/log 85%
Define processer load thresholds (1min, 5min, 15min):
load 6 4 3
Daemon Lifecycle Management
Activate and restart the SNMP service:
Modern systems (systemd):
sudo systemctl daemon-reload
sudo systemctl restart snmpd
sudo systemctl enable snmpd
sudo netstat -tulnp | grep snmpd
Legacy init-based systems:
sudo /etc/init.d/snmpd restart
sudo chkconfig snmpd on
Network Security Policies
iptables Implementation:
Insert a specific rule allowing the monitoring stasion:
sudo iptables -I INPUT 1 -p udp -s 10.0.5.50 --dport 161 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo /sbin/service iptables save
firewalld Implementation:
Create a dedicated service zone:
sudo firewall-cmd --permanent --new-service=snmp-collector
sudo firewall-cmd --permanent --service=snmp-collector --add-port=161/udp
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.5.50" service name="snmp-collector" accept'
sudo firewall-cmd --reload
sudo firewall-cmd --list-rich-rules
Validation Procedures
Test OID retrieval from the monitoring host:
snmpget -v2c -c secret_observium target.host.local 1.3.6.1.2.1.1.3.0
Perform comprehensive MIB walk:
snmpwalk -v2c -c secret_observium target.host.local system
Verify daemon listening status:
ss -lun | grep 161
