How to Install & Configure snmpd on CentOS / RHEL

By the SNMP Monitoring team · Reviewed July 2026

This covers the whole RHEL family — RHEL 8/9, Rocky, AlmaLinux, and legacy CentOS 7 — to a secure, tested read-only agent. Two things differ from the Debian world and both bite people: the package manager (dnf on modern releases, yum on CentOS 7) and two extra gatekeepers, firewalld and SELinux, that will silently block a working agent if you forget them. We'll handle both in order.

Parent: setup. Siblings: Ubuntu/Debian, Windows Server. Deep config: snmpd.conf.

Prerequisites

Before starting:

• sudo/root on the host.
• Enabled base repositories (net-snmp is in the standard repos).
• Reachability from your poller to the host on UDP 161.
• A random read-only community, or the plan to use SNMPv3.

Step 1: Install net-snmp

Install the agent and client utilities:

sudo dnf install net-snmp net-snmp-utils

On CentOS 7 / older RHEL, use yum instead:

sudo yum install net-snmp net-snmp-utils

The packages:

1. net-snmp — the agent (snmpd).
2. net-snmp-utils — the client tools (snmpwalk, snmpget) for testing.

Note the naming difference from Debian: here the agent package is net-snmp, not snmpd.

A word on the state of this family, since it changed a lot recently. Classic CentOS (the free RHEL rebuild) reached end of life, and its role has been taken over by Rocky Linux and AlmaLinux, which are binary-compatible with RHEL — so a command that works on RHEL 9 works unchanged on Rocky 9 and Alma 9. CentOS 7 still exists on plenty of older servers but is itself past end of maintenance, and because its repositories moved, a plain yum install there can fail until you point it at the vault mirrors. The upshot for SNMP is simple: on anything modern in this family, dnf install net-snmp net-snmp-utils is the command, the config path and service name are identical across all of them, and only genuinely old CentOS 7 boxes need the yum treatment and repo care.

Step 2: Configure snmpd.conf

Edit /etc/snmp/snmpd.conf. A minimal secure start:

agentAddress udp:161
rocommunity S3cr3tR0str1ng 10.0.0.5
sysLocation Rack 7, DC-West
sysContact netops@example.com

That binds UDP 161, allows read-only access with a random community only from your poller, and sets identity. For encrypted access, define an SNMPv3 user (createUser + rouser … priv) instead — see snmpd.conf and SNMPv3. The RHEL family's default config is often more locked-down than Debian's, so expect to add your access line explicitly.

Step 3: Secure access

Harden before exposing:

• Bind to the management IP via agentAddress, not all interfaces.
• Use a random community or SNMPv3 — never public.
• Add an OID allowlist (VACM view) to cap what's readable.
• Keep the source-IP restriction on the community line.

The same rule as everywhere: any one control is thin, the combination is defensible on a trusted segment. Cross untrusted networks with SNMPv3. The reason v2c demands this care is that its community string is sent in cleartext on every poll — capture one packet and you have the credential — so on the RHEL family, where firewalld and SELinux already give you strong perimeter controls, it's tempting but wrong to lean on them alone and leave the SNMP layer soft. Defence in depth means securing the agent itself, not just the network around it.

Step 4: Enable & start

Start the service and make it persist:

sudo systemctl enable --now snmpd

--now starts it immediately and enables it on boot in one command. Confirm:

systemctl status snmpd

Step 5: firewalld for port 161

The RHEL family runs firewalld by default, which will block UDP 161 until you allow it:

sudo firewall-cmd --add-port=161/udp --permanent
sudo firewall-cmd --reload

--permanent persists the rule; --reload applies it. For tighter control, scope it to your poller's source with a rich rule rather than opening 161 broadly. More at firewall setup and the port reference.

Step 6: SELinux note

This is the RHEL-specific gotcha. SELinux runs enforcing by default and can block snmpd from binding a non-standard port or running a custom extend/pass script — the agent starts, but the feature silently fails. If something that should work doesn't, check the audit log:

sudo ausearch -m avc -ts recent | grep snmpd

An AVC denial there confirms SELinux is the culprit; you then add the right policy (for example, allowing the port or the script context) rather than disabling SELinux wholesale. A stock agent on 161 usually runs fine; it's custom ports and scripts that trip it.

Step 7: Test

Prove it from the manager:

snmpwalk -v2c -c <RO_string> <host> system

SNMPv2-MIB::sysDescr.0 = STRING: Linux app01 4.18.0-513.el8.x86_64
SNMPv2-MIB::sysUpTime.0 = Timeticks: (98765432) 11 days, 10:20:54.32
SNMPv2-MIB::sysContact.0 = STRING: netops@example.com
SNMPv2-MIB::sysLocation.0 = STRING: Rack 7, DC-West

Data back means agent, firewalld, SELinux, community, and route are all correct. <RO_string> is a placeholder; keep live communities out of committed scripts. Flag reference: snmpwalk.

Frequently asked questions

How do I install snmpd on CentOS or RHEL?

Run sudo dnf install net-snmp net-snmp-utils on RHEL 8/9, Rocky, or AlmaLinux (use yum on CentOS 7). net-snmp is the agent, net-snmp-utils the client tools. Then edit /etc/snmp/snmpd.conf, enable the service with systemctl enable --now snmpd, open firewalld, and test.

yum or dnf — which do I use?

Use dnf on RHEL 8/9 and the modern rebuilds (Rocky, AlmaLinux); use yum on CentOS 7 and older RHEL. On modern releases yum is a compatibility alias for dnf, so it often still works, but dnf is the correct current tool. The package names (net-snmp, net-snmp-utils) are the same either way.

How do I open port 161 on firewalld?

Run sudo firewall-cmd --add-port=161/udp --permanent then sudo firewall-cmd --reload. The --permanent flag persists the rule across reboots and --reload applies it. For a tighter posture, use a rich rule scoped to your poller's source IP instead of opening 161 to everything.

Why does my extend script fail on RHEL?

Almost always SELinux. It runs enforcing by default and blocks snmpd from executing a custom extend/pass script or binding a non-standard port, so the agent runs but the feature silently fails. Check sudo ausearch -m avc -ts recent | grep snmpd for an AVC denial, then add the appropriate policy rather than disabling SELinux.

Key takeaways

• Install with dnf install net-snmp net-snmp-utils (yum on CentOS 7); config is /etc/snmp/snmpd.conf.
• Agent package is net-snmp, not snmpd (Debian naming differs).
• Start + persist in one step: systemctl enable --now snmpd.
• firewalld blocks 161 by default — allow it with firewall-cmd, scoped to your poller.
• SELinux silently blocks custom ports/scripts — check ausearch for AVC denials.
• Verify with snmpwalk … system; back it with an off-box external check via external monitoring.