---
type: Setup Guide
title: "How to Configure SNMP Community Strings Securely"
description: "Harden SNMPv2c access — replace the public default with a random read-only community, restrict by source IP, scope OIDs, and prefer SNMPv3."
resource: "https://snmp-monitoring.info/setup/community-string/"
tags: [setup]
timestamp: 2026-07-11T00:00:00Z
---

# How to Configure SNMP Community Strings Securely

Harden SNMPv2c access — replace the public default with a random read-only community, restrict by source IP, scope OIDs, and prefer SNMPv3.

## Related concepts

- Up: [SNMP Setup & Configuration: Install, Secure & Test](/setup/index.md)

## Frequently asked questions

### How do I change the SNMP community string?

Edit /etc/snmp/snmpd.conf, replace any rocommunity public (or rwcommunity private) with a random read-only string plus a source restriction — e.g. rocommunity <random> 10.0.0.5 — then restart snmpd. Verify with snmpwalk using the new string and confirm the old public no longer responds.

### Is a community string encrypted?

No. In SNMPv1 and v2c the community string travels in cleartext on every request, so anyone who can capture a packet can read it. A source-IP restriction limits where it can be used but does not encrypt it. Only SNMPv3 encrypts the credential and payload.

### How do I restrict who can use the community string?

Add a source argument to the rocommunity line — rocommunity <string> <IP-or-CIDR> — so the string is accepted only from your manager's address or subnet. For finer control use the com2sec/group/access chain. Combine it with an OID allowlist to also cap what the string can read.

### Should I use a read-write community?

Avoid it. rwcommunity allows SetRequests that can change device configuration, which is a far bigger risk than read-only monitoring — and it travels in the same cleartext. Most monitoring needs only reads. If you truly need writes, use SNMPv3 with tightly scoped write access instead of a v2c read-write community.

## Source

Concept generated from https://snmp-monitoring.info/setup/community-string/ — the SNMP Monitoring vendor-neutral knowledge base. Content is limited to what that page states (no external claims added here).