--- name: "snmpd.conf" section: "5" platform: "openbsd" package: "man" version: "8.0-current-20261101" release: "OpenBSD 8.0-current (2026-11-01)" platforms: ["linux", "openbsd"] url: "https://new.carta.tech/snmpd.conf" --- # snmpd.conf(5) SNMP daemon configuration file ## NAME **snmpd.conf** – SNMP daemon configuration file ## DESCRIPTION **snmpd.conf** is the configuration file for the [snmpd(8)](/snmpd/8.md) daemon. The **snmpd.conf** file is divided into the following main sections: - Macros Definitions of variables that can be used later, simplifying the configuration file. - Global configuration Global runtime settings for [snmpd(8)](/snmpd/8.md). - User configuration USM user definitions. - OID configuration Custom configuration of SNMP object identifiers and values. The current line can be extended over multiple lines using a backslash (‘\\’). Comments can be put anywhere in the file using a hash mark (‘#’), and extend to the end of the current line. Care should be taken when commenting out multi-line text: the comment is effective until the end of the entire block. Arguments not beginning with a letter, digit, or underscore must be quoted. Additional configuration files can be included with the **include** keyword, for example: ``` include "/etc/snmpd.conf.local" ``` ### Macros A macro is defined with a command of the form *name*=*value*. The macro *name* can contain letters, digits, and underscores and cannot be a reserved word (for example, **community**, **system**, or **oid**). Within unquoted arguments, the string $*name* is later expanded to *value*. For example: ``` ext_addr="192.168.0.1" listen on $ext_addr ``` ### Global configuration The following options can be set globally: - **blocklist** *oid* Remove the *oid* subtree from view. Multiple **blocklist** statements are supported. - **filter-routes** (**yes** \| **no**) If set to **yes**, ask the kernel to filter route update messages on the routing socket. Routing table information will not be available, but CPU use will be reduced during bulk updates. The default is **no**. - **listen** **on** \[**tcp** \| **udp**\] *address* \[**port** *port*\] \[*flags*\] Specify the local *address* [snmpd(8)](/snmpd/8.md) should listen on for incoming SNMP messages, or **any** to listen on all local IPv4 and IPv6 addresses. Multiple **listen** **on** statements are supported. If no **listen** **on** statement is present, the default is **listen** **on** **any**. The *flags* are as follows: - **read** Accept get, getnext and bulkget requests. - **write** Accepts set requests. - **notify** Accepts trapv1 and trapv2 requests. - **snmpv1** Enable SNMPv1 subsystem on the listen address. - **snmpv2c** Enable SNMPv2c subsystem on the listen address. - **snmpv3** Enable SNMPv3 subsystem on the listen address. The default protocol is **udp**. The default *port* is 161, unless **notify** is the only permission flag; which sets the *port* to 162. If no permission flags are specified it defaults to “**read** **write**”, or **notify** when *port* is 162. If no subsystem flags are specified, it defaults to **snmpv3**. Having **notify** set requires at least one **trap** **handle** statement. - **agentx** \[**path** *path*\] \[**owner** *owner*\] \[**group** *group*\] \[**mode** *mode*\] Set up an agentx master socket at *path* and defaults to */var/agentx/master*. Socket owner, group, and permissions can be set with *owner*, *group*, and *mode* respectively and defaults to root, \_agentx, and 660. Multiple **agentx** statements are supported. Only unix sockets are supported. - **engineid** \[**pen** *enterprise*\] *format* Set the snmp engineid, used for instance identification and key generation for the **user** *auth* and *key*. *enterprise* specifies the private enterprise number of the instance and can be either an integer or **openbsd** (default). *format* can be one of the following: - **ipv4** *address* The engineID's format identifier is set to 1 and the ipv4 *address* is used in the format. - **ipv6** *address* The engineID's format identifier is set to 2 and the ipv6 *address* is used in the format. - **mac** *address* The engineID's format identifier is set to 3 and the mac *address* is used in the format. - **text** *text* The engineID's format identifier is set to 4 and the ASCII *text* is used in the format. - **octets** *octetstring* The engineID's format identifier is set to 5 and the *octetstring* in hexadecimal is used in the format. - **hosthash** \[*hostname*\] The engineID's format identifier is set to 129 and the first 27 bytes of the sha256 hash of the *hostname* are used in the format. This option is only valid for *enterprise* **openbsd**. If used for the local engineID, then *hostname* defaults to the value of [hostname(1)](/hostname/1.md). This format is the default. - *number* *octetstring* The engineID's format identifier is set to *number* and the *octetstring* in hexadecimal is used in the format. This format is only available if *enterprise* is not **openbsd**. - **agentid** *octetstring* RFC1910 legacy format. *octetstring* must be 8 bytes (or 16 characters in hexadecimal format). - **mib** **directory** *path* Specify which directories to recursively search for MIB files. Multiple directories can be specified. If no directory is specified it defaults to */usr/share/snmp/mibs*. - **read-only** **community** *string* Specify the name of the read-only community. There is no default value. - **read-write** **community** *string* Specify the name of the read-write community. There is no default value. - **seclevel** (**none** \| **auth** \| **enc**) Specify the lowest security level that [snmpd(8)](/snmpd/8.md) accepts on SNMPv3: - **none** Both authentication and encryption of messages is optional. - **auth** Authentication of messages is mandatory. [snmpd(8)](/snmpd/8.md) will discard any messages that don't have a valid digest. Encryption of messages is optional. - **enc** Messages must be encrypted and must have a valid digest for authentication. Otherwise they will be discarded. This is the default value. - **system** **contact** *string* Specify the name or description of the system contact, typically a name or an email address. The default value is *root@hostname* using the hostname of the local machine. - **system** **description** *string* Specify a description of the local system. The default value is the operating system identification as printed by the [uname(1)](/uname/1.md) command using the **-a** flag: ``` OpenBSD myhost.example.com 4.2 GENERIC#595 i386 ``` - **system** **location** *string* Specify the string describing the location of the local system, typically a physical location. The default value is an empty string. - **system** **name** *string* Specify the name of the local system, typically a fully-qualified domain name. The default value is the hostname of the local system. - **system** **oid** *oid-string* Specify the authoritative identification of the local system. The default value is *1.3.6.1.4.1.30155.23.1* (iso.org.dod.internet.private.enterprises.openbsd.23.1) identifying a common OpenBSD system. - **system** **services** *number* Specify a magic value which indicates the set of services that the local system may provide. Refer to the *sysServices* description in the SNMP MIB for details. The value is given in decimal. - **trap** **community** *string* Specify the name of the trap community. There is no default value. - **trap** **handle** *oid* "*command*" Execute **command** upon receipt of an SNMP trap that begins with a prefix of **oid**. Alternately, the string "**default**" may be used, in which case the prefix used is **1.3**. The invoked *command* will receive the following information about the trap on standard input, one per line, in this order: the resolved hostname of the host sending the trap, the IP address of the host sending the trap, and any variable bindings contained in the trap (the OID followed by the value, separated by a single space). This option requires at least one **listen** **on** statement with a **notify** flag set. Traps over SNMPv3 are currently unsupported. - **trap** **receiver** *address* \[**oid** *oid-string*\] **snmpv2c** \[**community** *string*\] \[**source-address** *address*\] Specify the *address* or FQDN of a remote trap receiver for outgoing traps sent by [snmpd(8)](/snmpd/8.md). This option may be specified multiple times. The daemon will send outgoing traps in **snmpv2c** format. The default community is specified by the global **trap** **community** option. The IPv4 or IPv6 source address of the traps can be enforced using - **trap** **receiver** *address* \[**oid** *oid-string*\] \[**snmpv3**\] **user** *name* \[**seclevel** *level*\] \[**source-address** *address*\] Specify the *address* or FQDN of a remote trap receiver for outgoing traps sent by [snmpd(8)](/snmpd/8.md). This option may be specified multiple times. The daemon will send outgoing traps in **snmpv3** format. **user** must point to an existing global **user**. If **seclevel** is not defined, it defaults to the global **seclevel** option. The IPv4 or IPv6 source address of the traps can be enforced using **source-address**. ### User configuration Users for the SNMP User-based Security Model (USM, RFC 3414) must be defined in the configuration file: - **user** *name* \[**authkey** *key* **auth** *hmac*\] \[**enckey** *key* **enc** *cipher*\] Defines a known user. The **authkey** keyword is required to specify the digest key used to authenticate messages. If this keyword is omitted then authentication is disabled for this user account. Optionally the HMAC algorithm used for authentication can be specified. *hmac* must be either **hmac-md5**, **hmac-sha1**, **hmac-sha224**, **hmac-sha256**, **hmac-sha384**, or **hmac-sha512**. If omitted, the default is **hmac-sha1**. With **enckey** the encryption key used to encrypt and decrypt messages for privacy is defined. Without an **enckey** specification the user account will neither accept encrypted incoming messages nor will it encrypt outgoing messages. The *enc* algorithm can be either **des** or **aes** and defaults to **aes**. Any user account that has encryption enabled requires authentication to be enabled too. ### OID configuration It is possible to specify user-defined OIDs in the configuration file: - **oid** *oid-string* **name** *name* \[**read-only** \| **read-write**\] \[*type*\] *value* Return the specified value to the client for this OID. The **read-write** option may allow the client to override it, and the type is either **string** or **integer**. ## FILES - */etc/snmpd.conf* Default location of the configuration file. - */etc/examples/snmpd.conf* Example configuration file. ## EXAMPLES The following example will tell [snmpd(8)](/snmpd/8.md) to listen on localhost for SNMPv2c messages only with the community “8LHQtm1QLGzk”, override the default system OID, set the magic services value, and provide some custom OID values: ``` listen on 127.0.0.1 snmpv2c read-only community 8LHQtm1QLGzk system oid 1.3.6.1.4.1.30155.23.2 system services 74 oid 1.3.6.1.4.1.30155.42.1 name myName read-only string "humppa" oid 1.3.6.1.4.1.30155.42.2 name myStatus read-only integer 1 ``` The next example will enforce SNMPv3 with authenticated and encrypted communication and the user-based security model. The configuration defines several users using varying encryption and authentication algorithms. ``` seclevel enc user "mgmt" auth hmac-sha256 authkey "password123" enc aes enckey "321drowssap" user "hans" auth hmac-sha1 authkey "password456" enc aes enckey "654drowssap" user "sophie" auth hmac-md5 authkey "password789" enc des enckey "987drowssap" ``` ## SEE ALSO [snmp(1)](/snmp/1.md), [snmpd(8)](/snmpd/8.md) ## HISTORY The **snmpd.conf** file format first appeared in OpenBSD 4.3. ## AUTHORS The [snmpd(8)](/snmpd/8.md) program was written by Reyk Floeter ⟨*reyk@openbsd.org*⟩.