IBM i and SNMP

We had this issue on a recent security scan:

<snip>
3.1.4. Default or Guessable SNMP community names: public (snmp-read-0001)
Description:
The Simple Network Management Protocol (SNMP) is a commonly used network
service. Its primary function is to provide network administrators with
information about all kinds of network connected devices. SNMP can be used
to get and change system settings on a wide variety of devices, from
network servers, to routers and printers. The drawback to this service is
the authentication is an unencrypted "community string". In addition many
SNMP servers provide very simple default community strings. The community
string "public" is a default on a number of SNMP servers.
This community string can allow attackers to gain a large amount of
information about the SNMP server and the network it monitors.
Attackers may even reconfigure or shut down devices remotely.

Running SNMP serviceSuccessfully authenticated to the SNMP service with
credentials: uid[] pw[public] realm[]
</snip>

Recently I would assume that the GUI "IBM Navigator for i" would have more
options than a comparable 5250 command, (in this example CHGSNMPA). This
doesn't seem to be the case in this example. The only property available
via the GUI is autostart yes/no.
I was trying to compare the lpar mentioned on this security report with
another lpar not on the report. The only difference I found was, while
both lpars have this set to autostart yes, only one was actually running.
I checked for the server jobs but not even their joblogs, nor any qhst
DSPLOG JOB(such and such) information was still hanging around.

So we have these possible action plans:
- Ensure that all lpars are set to autostart no.
- Look at some enhanced snmp capabilities which tighten this up. Perhaps
ALWSNMPV3(*YES) or some such thing.

Funny thing is the lpar with no snmp jobs is AUTOSTART(*YES)
ALWSNMPV3(*YES).
The lpar with snmp jobs is AUTOSTART(*YES) ALWSNMPV3(*NO)
Perhaps there is an issue with SNMPV3?

Should I just AUTOSTART(*NO), and shutdown any active snmp, on all lpars?
I don't "think" we're using this.

If it was something critical I would think it would be hitting our main
production lpar. That's the one where there are no active SNMP server
jobs. It's Mimix partner is the one with the active SNMP server jobs.

Rob Berendt