By the SNMP Monitoring team · Reviewed July 2026
By the end of this you'll have a secure, read-only SNMP agent on Ubuntu or Debian, bound to the right interface, firewalled to your poller, and verified with a walk. The install itself is one apt command; the parts worth getting right are the listen address (Debian ships snmpd bound to localhost, which trips up everyone) and the access model. We'll do it in order so you never expose a default community.
Parent: setup. Siblings: CentOS/RHEL, Windows Server. Deep config: snmpd.conf.
Prerequisites
Before you start:
- sudo/root on the target host.
- Network reachability from your manager/poller to the host on UDP 161.
- A plan for which interface the agent should listen on (management, not public).
- A random read-only community string ready, or the intent to use SNMPv3.
Step 1: Install the packages
Install the agent and the client tools:
sudo apt update
sudo apt install snmpd snmp
What each provides:
snmpd— the SNMP agent (the daemon that answers polls).snmp— the client tools (snmpwalk,snmpget, etc.) for testing.snmp-mibs-downloader(optional) — fetches standard MIBs so output shows names, not raw numeric OIDs.
The optional MIB downloader is a convenience for reading output; it isn't required for the agent to work.
| Package | Role | Required? |
|---|---|---|
snmpd | The SNMP agent daemon on the host being monitored | Yes |
snmp | Client tools (snmpwalk, snmpget) for testing | For testing |
snmp-mibs-downloader | Fetches standard MIBs so output shows names not numbers | Optional |
One subtlety worth knowing: on a machine that is purely a monitored target, you only strictly need snmpd — the snmp client tools are for running tests, and in a real deployment those tests are usually run from a separate manager, not the target itself. Installing snmp on the target anyway is convenient for local verification (you can snmpwalk localhost to sanity-check before involving the network), so most people do. By default, Debian and Ubuntu also leave the standard numeric-MIB translation disabled for licensing reasons, which is why fresh output sometimes shows raw OIDs like 1.3.6.1.2.1.1.1.0 instead of sysDescr.0 — the MIB downloader package plus enabling the MIBs fixes that, but it's cosmetic and never affects whether polling works.
Step 2: Configure snmpd.conf
Edit /etc/snmp/snmpd.conf. A minimal, secure read-only start:
agentAddress udp:161
rocommunity S3cr3tR0str1ng 10.0.0.5
sysLocation Rack 12, DC-East
sysContact netops@example.com
That binds UDP 161, grants read-only access with a random community only from your poller (10.0.0.5), and sets the system identity. For authenticated encryption instead, use an SNMPv3 user (createUser + rouser … priv) — see snmpd.conf and SNMPv3. On older releases, the listen address may be governed by /etc/default/snmpd instead of agentAddress; check there if the agent won't bind where you expect.
Step 3: Secure it
Don't stop at "it responds." Lock it down:
- Bind to the management interface, not
0.0.0.0— setagentAddressto the specific IP. - Use a random community (never
public) or, better, SNMPv3. - Add an OID allowlist (VACM view) so a leaked community can't dump the whole tree.
- Keep the source-IP restriction on the
rocommunityline so only your poller can ask.
Any one of these alone is thin; together they make a v2c agent defensible on a trusted segment. If the traffic crosses anything untrusted, go SNMPv3.
Step 4: Restart & enable
Apply the config and make it survive reboots:
sudo systemctl restart snmpd
sudo systemctl enable snmpd
restart loads your new snmpd.conf; enable starts snmpd automatically on boot. Confirm it's running:
systemctl status snmpd
Step 5: Open the firewall
If ufw is active, allow UDP 161 from your poller only:
sudo ufw allow from 10.0.0.5 to any port 161 proto udp
Opening 161 to the whole world alongside a weak community is the classic mistake — scope the rule to the source that actually polls. More on this at firewall setup and the port reference.
Step 6: Test with snmpwalk
Prove it from the manager:
snmpwalk -v2c -c <RO_string> <host> system
SNMPv2-MIB::sysDescr.0 = STRING: Linux web01 5.15.0-88-generic x86_64
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
SNMPv2-MIB::sysUpTime.0 = Timeticks: (12345678) 1 day, 10:17:36.78
SNMPv2-MIB::sysContact.0 = STRING: netops@example.com
SNMPv2-MIB::sysLocation.0 = STRING: Rack 12, DC-East
Data back means every layer — agent, community, listen address, firewall, route — is correct. <RO_string> is a placeholder; keep live communities out of committed scripts. Flag reference: snmpwalk.
Troubleshooting
If the walk times out, the usual suspects in order: the agent is still bound to 127.0.0.1 (fix agentAddress or /etc/default/snmpd), the firewall is blocking (check the ufw rule and any upstream ACL), or the community/source doesn't match. Work through them with troubleshooting; Linux-specific notes are on Linux SNMP. It's worth stating plainly why the v2c setup above needs the source restriction: the community string travels in cleartext on every poll, so anyone who can capture a packet on the path has your credential. That's exactly why the source-IP limit and the OID allowlist matter even on an internal network — and why SNMPv3 is the real answer the moment traffic leaves a segment you fully trust.
Frequently asked questions
How do I install snmpd on Ubuntu?
Run sudo apt update && sudo apt install snmpd snmp. snmpd is the agent, snmp provides the snmpwalk/snmpget client tools. Optionally add snmp-mibs-downloader so output resolves to names. Then edit /etc/snmp/snmpd.conf, restart snmpd, and open the firewall.
Where is snmpd.conf on Debian/Ubuntu?
The main config is /etc/snmp/snmpd.conf. On some releases, daemon options like the listen address are controlled by /etc/default/snmpd instead of the agentAddress directive — if the agent won't listen where you expect, check both files.
Why does snmpd only listen on localhost?
Debian and Ubuntu ship snmpd bound to 127.0.0.1 by default as a safe default. To expose it, set agentAddress udp:161 (or the specific management IP) in /etc/snmp/snmpd.conf, or adjust the listen line in /etc/default/snmpd on older releases, then restart the service.
How do I test that it's working?
From a manager that can reach the host, run snmpwalk -v2c -c <RO_string> <host> system. Getting back sysDescr, sysUpTime and the system group confirms it's up and reachable. A timeout points at the listen address, firewall, or community/source restriction.
Key takeaways
- Install with
sudo apt install snmpd snmp; config is/etc/snmp/snmpd.conf. - Debian/Ubuntu bind to localhost by default — set
agentAddressto the management IP to expose it. - Secure before opening the firewall: random community + source IP + allowlist, or SNMPv3.
- Apply with
systemctl restart snmpd, persist withenable. - Firewall UDP 161 from your poller only (
ufw allow from …). - Verify with
snmpwalk … system; add an off-box external check via external monitoring.