Synopsis #
OpenBSD includes snmpd(8) and the snmp(1) client. The base daemon supports SNMPv1, SNMPv2c, and SNMPv3, including authentication and encryption. It exposes system, interface, PF, and supported sensor information; configurable custom OIDs can also permit writes.
Configure the Listener #
Create /etc/snmpd.conf before enabling the daemon. With no explicit listener, the daemon listens on all addresses. There is no default community string. SNMPv3 is the default listener protocol; select older protocols explicitly when required.
For a local SNMPv2c test:
listen on 127.0.0.1 read snmpv2c
read-only community "replace-this-community"
system description "OpenBSD Router"
system location "Data Center 1"
system contact "noc@example.org"
SNMPv2c communities are sent in plaintext. Keep this example bound to loopback. For remote monitoring, prefer SNMPv3 with encryption and restrict access with PF.
SNMPv3 #
The following alternative uses an address assigned to the monitoring interface. Replace the address and both example secrets before use:
listen on 192.0.2.1 read snmpv3
seclevel enc
user "monitor" auth hmac-sha256 authkey "replace-authentication-secret" enc aes enckey "replace-encryption-secret"
Protect the configuration and validate it before starting:
doas chmod 600 /etc/snmpd.conf
doas snmpd -n && doas rcctl enable snmpd
doas rcctl start snmpd
After editing an active configuration:
doas snmpd -n && doas rcctl restart snmpd
The service does not support configuration reload. Use the same username, security level, authentication algorithm, and encryption algorithm in the monitoring client. Test both a successful authenticated query and rejection with incorrect credentials.
Querying the Local Test #
The base client can query the loopback SNMPv2c configuration:
snmp get -v 2c -c replace-this-community 127.0.0.1 sysUpTime.0
snmp walk -v 2c -c replace-this-community 127.0.0.1 system
Walk only the relevant subtree when diagnosing larger agents. The daemon provides its supported MIBs directly; there are no include pf, include interfaces, or sensor temperature configuration directives. Sensor availability depends on the hardware and drivers, and does not require enabling sensorsd merely for SNMP exposure.
Firewall and Diagnostics #
Integrate a restricted listener rule into the existing PF policy, adapting the interface and monitoring subnet:
block in proto udp to port 161
pass in on em0 inet proto udp from 192.0.2.0/24 to 192.0.2.1 port 161
Check rule ordering against the complete ruleset. Restricting a community does not restrict source addresses; PF supplies that boundary. Do not expose monitoring access indiscriminately to the Internet.
Inspect daemon messages in /var/log/daemon. For foreground debugging, stop the regular service before running snmpd -dv; restart the regular service afterward. Debug mode is not needed for routine operation.
Alternative Implementation #
The net-snmp package provides a separate implementation with its own configuration and extension model. It is not required merely to obtain SNMPv3 on OpenBSD. Avoid running two agents on the same listening address and port, and follow the installed package documentation when selecting that implementation.