---
type: Setup Guide
title: "How to Configure SNMPv3 (Authentication & Encryption)"
description: "Create a secure authPriv SNMPv3 user on net-snmp with SHA and AES, authorize it with rouser, and test with snmpwalk -v3."
resource: "https://snmp-monitoring.info/setup/snmpv3/"
tags: [setup]
timestamp: 2026-07-11T00:00:00Z
---

# How to Configure SNMPv3 (Authentication & Encryption)

Create a secure authPriv SNMPv3 user on net-snmp with SHA and AES, authorize it with rouser, and test with snmpwalk -v3.

## Related concepts

- Up: [SNMP Setup & Configuration: Install, Secure & Test](/setup/index.md)

## Frequently asked questions

### How do I create an SNMPv3 user?

Stop snmpd, then run net-snmp-create-v3-user -ro -A "<authpass>" -a SHA -X "<privpass>" -x AES <username> and start snmpd again — that creates a read-only user with SHA auth and AES privacy. Alternatively add createUser <name> SHA "<authpass>" AES "<privpass>" plus rouser <name> priv to snmpd.conf.

### What is authPriv?

authPriv is the SNMPv3 security level that provides both authentication (the request is verified with a hash) and privacy (the payload is encrypted). It's the secure level to use — the other two, noAuthNoPriv and authNoPriv, either skip authentication entirely or leave your metrics in cleartext.

### SHA vs MD5, AES vs DES — which should I use?

Use SHA (or SHA-2) for authentication and AES for privacy. MD5 is cryptographically broken and DES has a 56-bit key that's trivially crackable, so both survive only for interoperability with legacy equipment. For anything new, SHA + AES is the correct choice.

### Why does my v3 user stop working after cloning a VM?

Because SNMPv3 users are tied to the agent's engine ID, and cloning a VM duplicates the engine ID material from the source image. The cloned host's users can then fail to authenticate. Recreate the v3 users (or reset the engine ID) on each clone so every host has its own identity.

## Source

Concept generated from https://snmp-monitoring.info/setup/snmpv3/ — the SNMP Monitoring vendor-neutral knowledge base. Content is limited to what that page states (no external claims added here).