---
title: "HOST-SVC-011 SNMP Agent or Squid Proxy Installed or Enabled"
canonical: https://openvapt.com/checks/HOST-SVC-011.html
html: https://openvapt.com/checks/HOST-SVC-011.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-SVC-011 SNMP Agent or Squid Proxy Installed or Enabled

Checks whether an SNMP agent or the Squid caching proxy is installed or enabled.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 4.8
- NIST CSF 2.0: PR.PS-01, PR.IR-01
- CWE: CWE-1188, CWE-319
- NIST SP 800-53 Rev. 5: CM-7, CM-7(1)
- Benchmark topic: SNMP and proxy servers are not installed unless required (CIS Controls v8 4.8) (topic only, no benchmark text)

## Why It Matters

SNMP v1 and v2c authenticate with a community string sent in clear text (public and private are the usual defaults) and reveal routing tables, interfaces, processes and installed software. Squid turns the machine into a relay for other traffic and is often left open. Both need a deliberate configuration to be anything but a liability. If this machine is one of the monitored hosts using SNMPv3 and dedicated proxy servers that legitimately run it, record the reason in the suppression file so the finding stays visible but accepted.

## How It Detects

Reads installed packages from /var/lib/dpkg/status (only entries marked 'install ok installed'; /var/lib/dpkg/info/*.list is a fallback used only when the status file cannot be read) and the allow-listed rpm -qa, and looks for snmpd, net-snmp, squid, squid-openssl. Reads the *.wants links under /etc/systemd/system (and asks the allow-listed systemctl is-enabled) for snmpd.service, squid.service. Either an installed package or an enabled unit fails. Incomplete when no package database and no systemd unit directory could be read.

## How to Fix

apt purge snmpd squid  or  dnf remove net-snmp squid , and  systemctl disable --now snmpd squid . If monitoring needs SNMP, use version 3 with authPriv and bind the agent to the management network. Before removing a package, check that no application on this machine or the network still uses the service, and keep console access when the service is remote-access related.

## How to Verify

```
dpkg -l snmpd net-snmp squid squid-openssl 2>/dev/null | grep '^ii' ; systemctl is-enabled snmpd.service squid.service 2>/dev/null
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)
- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go

Run it: `openvapt scan --only HOST-SVC-011`. Read it offline: `openvapt explain HOST-SVC-011`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-SVC-011.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.