Monitor Your Devices Using LibreNMS on Ubuntu 16.04

LibreNMS is a full-featured open source network monitoring system. It uses SNMP to obtain the data from different devices. A variety of devices are supported in LibreNMS such as Cisco, Linux, FreeBSD, Juniper, Brocade, Foundry, HP and many more. It supports multiple authentication mechanisms and supports two-factor authentication. It has a customizable alerting system which can alert the network admin via email, IRC or slack.

Prerequisites

• A Vultr Ubuntu 16.04 server instance.
• A sudo user.

For this tutorial, we will use nms.example.com as the domain name pointed towards the Vultr instance. Please make sure to replace all occurrences of the example domain name with the actual one.

Update your base system using the guide How to Update Ubuntu 16.04. Once your system has been updated, proceed to install the dependencies.

Install Nginx and PHP

The front end of LibreNMS is written in PHP, thus we will need to install a web server and PHP. In this tutorial, we will install Nginx along with PHP 7.2 to obtain maximum security and performance.

Install Nginx.

sudo apt -y install nginx

Start Nginx and enable it to start at boot automatically.

sudo systemctl start nginx
sudo systemctl enable nginx

Add and enable the Remi repository, as the default apt repository contains an older version of PHP.

sudo add-apt-repository --yes ppa:ondrej/php
sudo apt update

Install PHP version 7.2 along with the modules required by LibreNMS.

sudo apt -y install php7.2 php7.2-cli php7.2-common php7.2-curl php7.2-fpm php7.2-gd php7.2-mysql php7.2-snmp php7.2-mbstring php7.2-xml php7.2-zip zip unzip

Open the loaded configuration file in an editor.

sudo nano /etc/php/7.2/fpm/php.ini

Find the following lines.

;cgi.fix_pathinfo=1
;date.timezone =

Uncomment and use these values instead, replace Asia/Kolkata with your local timezone.

cgi.fix_pathinfo=0
date.timezone = Asia/Kolkata

You will also need to change the system timezone by running the following command.

sudo ln -sf /usr/share/zoneinfo/Asia/Kolkata /etc/localtime

Restart PHP-FPM.

sudo systemctl restart php7.2-fpm

Install MariaDB

MariaDB is an open source fork of MySQL. Add the MariaDB repository into your system, as the default Ubuntu repository contains an older version of MariaDB.

sudo apt-key adv --yes --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 0xF1656F24C74CD1D8
sudo add-apt-repository 'deb [arch=amd64,i386,ppc64el] http://mariadb.biz.net.id/repo/10.2/ubuntu xenial main'
sudo apt update

Install MariaDB. During installation, the installer will ask for the password of the MySQL root user. Provide a strong password.

sudo apt -y install mariadb-server

Before we start using MariaDB, we will need to tweak the configuration a little bit. Open the configuration file.

sudo nano /etc/mysql/conf.d/mariadb.cnf 

Add the following code to the end of the file.

[mysqld]
innodb_file_per_table=1
sql-mode=""
lower_case_table_names=0

Restart MariaDB and enable it to automatically start at boot time.

sudo systemctl restart mariadb.service 
sudo systemctl enable mariadb.service

Before configuring the database, you will need to secure the MariaDB instance.

sudo mysql_secure_installation

You will be asked for the current MariaDB root password, and then be prompted to change the root password. Since we already set a strong password for the root user during installation, skip it by answering "N". For all other questions, answer "Y". The questions asked are self-explanatory.

Log into the MySQL shell as root.

mysql -u root -p

Provide the password for the MariaDB root user to log in. Run the following queries to create a database and a database user for the LibreNMS installation.

CREATE DATABASE librenms CHARACTER SET utf8 COLLATE utf8_general_ci;
CREATE USER 'librenms'@'localhost' IDENTIFIED BY 'StrongPassword';
GRANT ALL PRIVILEGES ON librenms.* TO 'librenms'@'localhost';
FLUSH PRIVILEGES;
EXIT;

You can replace the database name librenms and username librenms according to your choice. Please make sure to change StrongPassword to a very strong password.

Install LibreNMS

Apart from the dependencies above, LibreNMS needs few more dependencies.

sudo apt -y install fping git imagemagick jwhois mtr graphviz nmap python-memcache python-mysqldb rrdtool snmp snmpd whois composer

Add a new unprivileged user for LibreNMS application.

sudo useradd librenms -d /opt/librenms -M -r
sudo usermod -aG www-data librenms

LibreNMS can be installed directly by cloning its Github repository.

cd /opt
sudo git clone https://github.com/librenms/librenms.git librenms

Change the ownership.

sudo chown librenms:librenms -R /opt/librenms

Install the PHP dependencies.

cd /opt/librenms
sudo su librenms -c "composer install"

LibreNMS relies on SNMP for many tasks. Since we have already installed SNMP, copy the example configuration file to its location.

sudo cp /opt/librenms/snmpd.conf.example /etc/snmp/snmpd.conf

Open the configuration file in the editor.

sudo nano /etc/snmp/snmpd.conf

Find this line.

com2sec readonly  default         RANDOMSTRINGGOESHERE

Edit the text RANDOMSTRINGGOESHERE and replace the community string with any string of your choice. For example.

com2sec readonly  default         my-org

Remember the string as it will be required later when we add the first SNMP device.

SNMP also needs information about the distribution version. Download and install the script to find the distribution version.

sudo curl -o /usr/bin/distro https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
sudo chmod +x /usr/bin/distro

Start the SNMP daemon service and enable it to automatically start at boot time.

sudo systemctl enable snmpd
sudo systemctl restart snmpd

Now you will need to add some crontab entries to run the scheduled tasks. Create a new cron job file.

sudo cp /opt/librenms/librenms.nonroot.cron /etc/cron.d/librenms

Restart the cron daemon service.

sudo systemctl restart cron

Setup logrotate so that the log files are automatically refreshed over time.

sudo cp /opt/librenms/misc/librenms.logrotate /etc/logrotate.d/librenms

Finally, set the appropriate ownership and permissions.

sudo chown -R librenms:www-data /opt/librenms
sudo chmod g+w -R /opt/librenms
sudo setfacl -d -m g::rwx /opt/librenms/rrd /opt/librenms/logs
sudo setfacl -R -m g::rwx /opt/librenms/rrd /opt/librenms/logs

SSL and Nginx VHost configurations

Logins and other information sent through the web interface of LibreNMS are not secured if the connection is not encrypted with SSL. We will configure Nginx to use the SSL generated with Let's Encrypt free SSL.

Add the Certbot repository.

sudo add-apt-repository --yes ppa:certbot/certbot
sudo apt-get update

Install Certbot, which is the client application for Let's Encrypt CA.

sudo apt -y install certbot

Note: To obtain certificates from Let's Encrypt CA, the domain for which the certificates are to be generated must be pointed towards the server. If not, make the necessary changes to the DNS records of the domain and wait for the DNS to propagate before making the certificate request again. Certbot checks the domain authority before providing the certificates.

Generate the SSL certificates.

sudo certbot certonly --webroot -w /var/www/html -d nms.example.com

The generated certificates are likely to be stored in the /etc/letsencrypt/live/nms.example.com/ directory. The SSL certificate will be stored as fullchain.pem and private key will be stored as privkey.pem.

Let's Encrypt certificates expire in 90 days, hence it is recommended to set up auto-renewal for the certificates using a cron job.

Open the cron job file.

sudo crontab -e

Add the following line at the end of the file.

30 5 * * 1 /usr/bin/certbot renew --quiet

The above cron job will run every Monday at 5:30 AM local time. If the certificate is due for expiry, it will automatically be renewed.

Create a new virtual host.

sudo nano /etc/nginx/sites-available/librenms

Populate the file.

server {
    listen 80;
    server_name nms.example.com;
    return 301 https://$host$request_uri;
}
server {

    listen 443;
    server_name nms.example.com;

    ssl_certificate           /etc/letsencrypt/live/nms.example.com/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/nms.example.com/privkey.pem;

    ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    access_log    /opt/librenms/logs/librenms.nginx.access.log;
    root        /opt/librenms/html;
    index       index.php;

    charset utf-8;
    gzip on;
    gzip_types text/css application/javascript text/javascript application/x-javascript image/svg+xml text/plain text/xsd text/xsl text/xml image/x-icon;
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    location /api/v0 {
        try_files $uri $uri/ /api_v0.php?$query_string;
    }
    location ~ \.php {
        include fastcgi.conf;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php/php7.2-fpm.sock;
    }
    location ~ /\.ht {
        deny all;
    }
 }

Replace nms.example.com with your actual domain in the above configuration.

Activate the newly created configuration.

sudo ln -s /etc/nginx/sites-available/librenms /etc/nginx/sites-enabled/librenms

Restart Nginx.

sudo systemctl restart nginx

Installation using WebUI

To finish the installation, open https://nms.example.com on your favorite browser. You will see the requirements are satisfied. Provide your database details and create a new administrative account. Once installed, you will get a message to validate the installation. Click on the link and log in using the administrator account. You should see that everything except the "Poller" has an "Ok" status.

Now, click on the link to add a device. On the "Add Device" interface, provide the hostname as the localhost and leave everything as it is. Provide your community string in community field. It must be the exact same string which you have provided in snmpd.conf during the configuration of SNMP.

Once the device has been added, you can see the details by going to the "Devices" tab. Similarly, you can add more devices into the LibreNMS application for "around the clock" monitoring.