File permissions do not match the ones of the net-snmp

[Tontonitch]

Hi,

After configuring the snmp services via your puppet module, the permissions of the following files do not match the ones of the net-snmp software rpm.

[root@rhtestsrv1-d ~]# rpm -Va | grep '^.M'
SM5....T.  c /etc/snmp/snmpd.conf
SM5....T.  c /etc/snmp/snmptrapd.conf

The puppet module sets the perm to 644 instead of 600.

Could it be changed in a future release of the module?
So that I won't receive any alerts in reports from SCAP.

Best regards,
Yannick

[jflorian]

@Tontonitch I'm not a developer of puppet-snmp, but a fellow user. Good catch here given this file has credentials stored that should be kept secret and protected. It seems that the Red Hat family of OSes have the wrong default mode for these files, as you can see here.

Until this gets resolved correctly, I've got the following in my Hiera data:
snmp::service_config_perms: '0600'
Alternatively, you could use something like

class { 'snmp':
  <snip>
  service_config_perms => '0600',
  <snip>
}

Thanks for pointing this out!

[Tontonitch]

Ok, thanks for your solution John!Best regards,Yannick

  De : John Florian <notifications@github.com>

À : razorsedge/puppet-snmp puppet-snmp@noreply.github.com
Cc : Yannick Charton tontonitch-pro@yahoo.fr; Mention mention@noreply.github.com
Envoyé le : Samedi 12 novembre 2016 17h52
Objet : Re: [razorsedge/puppet-snmp] File permissions do not match the ones of the net-snmp (#81)

@Tontonitch I'm not a developer of puppet-snmp, but a fellow user. Good catch here given this file has credentials stored that should be kept secret and protected. It seems that the Red Hat family of OSes have the wrong default mode for these files, as you can see here.Until this gets resolved correctly, I've got the following in my Hiera data:
snmp::service_config_perms: '0600'

Alternatively, you could use something likeclass { 'snmp':

service_config_perms => '0600',

}
Thanks for pointing this out!—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

[TomOnTime]

Please make this a parameter. We have certain machines that set the file perms to 0640 and the group to something non-standard. (Rationale: Certain processes need to read that file but we don't want those processes to run as root)

[jflorian]

It already is a parameter. See my comment above. Or I don't understand what you were asking for.

John Florian

[TomOnTime]

Its all good. Thanks!

[razorsedge]

@Tontonitch What OS/OS version/SNMP version are you using?

[Tontonitch]

RedHat 7.3, Net-Snmp 5.7.2