SNMPv3 on Linux with net-snmp: a SHA/AES user with the priv security level, communities retired

Goal

Configure net-snmp's snmpd so monitoring queries use an authenticated, encrypted SNMPv3 user instead of a plaintext SNMPv1/v2c community string, and confirm no community-based access remains.

Prerequisites

Root access to the host running snmpd; the net-snmp (or snmpd) package installed; snmpd currently reachable only from a trusted management network (a firewall rule, not a substitute for authentication).

Steps

1. Back up /etc/snmp/snmpd.conf, then stop snmpd: systemctl stop snmpd. This is required because snmpd rewrites its persistent file (/var/lib/snmp/snmpd.conf on Debian, /var/lib/net-snmp/snmpd.conf on RHEL) on shutdown, which would discard a createUser line added while it runs.
2. Create the SNMPv3 user with net-snmp-create-v3-user, which writes a createUser line into that persistent file: net-snmp-create-v3-user -ro -A <authpassphrase> -a SHA -X <privpassphrase> -x AES monitor. Per the command's own options, -ro makes the user read-only (without it, the script grants read-write access), -A sets the authentication password and -a the authentication algorithm (SHA here; SHA-256/SHA-512 are also listed), while -X sets the encryption (privacy) password and -x the encryption algorithm (AES here). Passphrases must be at least 8 characters.
3. Alternatively, or to add a second user, write the line yourself: createUser monitor SHA "<authpassphrase>" AES "<privpassphrase>", per snmpd.conf(5), which says it belongs in the persistent file, where snmpd replaces it with a localized key on start.
4. Grant that user read access at the priv security level (both authentication and encryption required): rouser monitor priv in /etc/snmp/snmpd.conf. Without the keyword, snmpd.conf(5) defaults to auth, which allows unencrypted requests; so add priv to the rouser/rwuser line the script appended (it prints which file it changed).
5. Remove every rocommunity, rocommunity6, rwcommunity and rwcommunity6 line from snmpd.conf, and also every com2sec/com2sec6 line with the group and access lines that use it: snmpd.conf(5) documents com2sec as a second way to map a community string to access, and RHEL's default configuration uses it for public.
6. Start snmpd and check its startup log (journalctl -u snmpd -n 50) for configuration warnings; snmpd has no config-test mode comparable to rsyslogd -N1.
7. Test the v3 user from a management host: snmpwalk -v3 -u monitor -l authPriv -a SHA -A <authpassphrase> -x AES -X <privpassphrase> <host> system. snmpcmd(1) documents -l authPriv as the security level and -u, -a/-A, -x/-X as user, auth and privacy settings. Passphrases on the command line land in shell history and the process list; ~/.snmp/snmp.conf (defSecurityName, defAuthPassphrase, ...) avoids that.
8. Confirm the old path is gone: snmpwalk -v2c -c public <host> system must time out or be refused.

Expected result

The v3 walk in step 7 returns the system subtree; the v2c walk in step 8 fails; grep -E "rocommunity|rwcommunity|com2sec" /etc/snmp/snmpd.conf returns nothing.

Limits and test basis

Based on snmpd.conf(5), net-snmp-create-v3-user(1) and snmpwalk(1). To undo, restore the backed-up snmpd.conf and restart snmpd. Passphrases embedded in snmpd.conf are stored in cleartext there unless localized keys are used instead — restrict the file's permissions to root.