LibreNMS

su -
apt update && apt upgrade -y && apt dist-upgrade -y
apt install curl gnupg2 ca-certificates lsb-release debian-archive-keyring apt-transport-https \
 software-properties-common git sudo gnupg -y

usermod -aG sudo,adm boscolopez

shutdown -r now

wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
sh -c 'echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'

grep avx /proc/cpuinfo

boscolopez@librenms ~ $ grep avx /proc/cpuinfo
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm rep_good nopl cpuid extd_apicid tsc_known_freq pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c hypervisor lahf_lm cmp_legacy svm cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw xop fma4 tbm perfctr_core ssbd vmmcall tsc_adjust bmi1 virt_ssbd arat npt nrip_save arch_capabilities
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm rep_good nopl cpuid extd_apicid tsc_known_freq pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c hypervisor lahf_lm cmp_legacy svm cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw xop fma4 tbm perfctr_core ssbd vmmcall tsc_adjust bmi1 virt_ssbd arat npt nrip_save arch_capabilities
boscolopez@librenms ~ $

boscolopez@isengard ~ $ grep avx /proc/cpuinfo
boscolopez@isengard ~ $

curl -fsSL https://pgp.mongodb.com/server-6.0.asc | \
   sudo gpg -o /usr/share/keyrings/mongodb-server-6.0.gpg \
   --dearmor

echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-6.0.gpg] http://repo.mongodb.org/apt/debian bullseye/mongodb-org/6.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

sudo apt update && sudo apt install nginx-full -y

sudo apt install php-cli php-curl php-fpm php-gd php-gmp php-json \
 php-mbstring php-mysql php-snmp php-xml php-zip php-rrd -y

php -v

boscolopez@librenms ~ $ php -v
PHP 8.2.6 (cli) (built: May 12 2023 07:48:41) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.6, Copyright (c) Zend Technologies
    with Zend OPcache v8.2.6, Copyright (c), by Zend Technologies

sudo useradd librenms -d /opt/librenms -M -r -s "$(which bash)"

sudo timedatectl set-timezone Europe/Madrid

sudo timedatectl show

boscolopez@librenms ~ $ sudo timedatectl show
Timezone=Europe/Madrid
LocalRTC=no
CanNTP=yes
NTP=yes
NTPSynchronized=yes
TimeUSec=Sun 2023-05-28 10:37:00 CEST
RTCTimeUSec=Sun 2023-05-28 10:37:01 CEST

sudo nano /etc/php/8.2/cli/php.ini

[Date]
; Defines the default timezone used by the date functions
; https://php.net/date.timezone
;date.timezone =

sudo nano /etc/php/8.2/fpm/php.ini

sudo cp /etc/php/8.2/fpm/pool.d/www.conf /etc/php/8.2/fpm/pool.d/librenms.conf

sudo nano /etc/php/8.2/fpm/pool.d/librenms.conf

; Start a new pool named 'www'.
; the variable $pool can be used in any directive and will be replaced by the
; pool name ('www' here)
[www]

; Per pool prefix
; It only applies on the following directives:
; - 'access.log'
; - 'slowlog'
; - 'listen' (unixsocket)
; - 'chroot'
; - 'chdir'
; - 'php_values'
; - 'php_admin_values'
; When not set, the global prefix (or /usr) applies instead.
; Note: This directive can also be relative to the global prefix.
; Default Value: none
;prefix = /path/to/pools/$pool

; Unix user/group of the child processes. This can be used only if the master
; process running user is root. It is set after the child process is created.
; The user and group can be specified either by their name or by their numeric
; IDs.
; Note: If the user is root, the executable needs to be started with
;       --allow-to-run-as-root option to work.
; Default Values: The user is set to master process running user by default.
;                 If the group is not set, the user's group is used.
user = www-data
group = www-data

; The address on which to accept FastCGI requests.
; Valid syntaxes are:
;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
;                            a specific port;
;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
;                            a specific port;
;   'port'                 - to listen on a TCP socket to all addresses
;                            (IPv6 and IPv4-mapped) on a specific port;
;   '/path/to/unix/socket' - to listen on a unix socket.
; Note: This value is mandatory.
listen = /run/php/php8.2-fpm.sock

; Start a new pool named 'www'.
; the variable $pool can be used in any directive and will be replaced by the
; pool name ('www' here)
[librenms]

; Per pool prefix
; It only applies on the following directives:
; - 'access.log'
; - 'slowlog'
; - 'listen' (unixsocket)
; - 'chroot'
; - 'chdir'
; - 'php_values'
; - 'php_admin_values'
; When not set, the global prefix (or /usr) applies instead.
; Note: This directive can also be relative to the global prefix.
; Default Value: none
;prefix = /path/to/pools/$pool

; Unix user/group of the child processes. This can be used only if the master
; process running user is root. It is set after the child process is created.
; The user and group can be specified either by their name or by their numeric
; IDs.
; Note: If the user is root, the executable needs to be started with
;       --allow-to-run-as-root option to work.
; Default Values: The user is set to master process running user by default.
;                 If the group is not set, the user's group is used.
user = librenms
group = librenms

; The address on which to accept FastCGI requests.
; Valid syntaxes are:
;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
;                            a specific port;
;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
;                            a specific port;
;   'port'                 - to listen on a TCP socket to all addresses
;                            (IPv6 and IPv4-mapped) on a specific port;
;   '/path/to/unix/socket' - to listen on a unix socket.
; Note: This value is mandatory.
listen = /run/php/php-fpm-librenms.sock

sudo touch /etc/nginx/sites-available/librenms_boscolopez_cloud.conf

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d librenms.boscolopez.cloud

sudo nano /etc/nginx/sites-available/librenms_boscolopez_cloud.conf

server {
        listen      80;
        server_name librenms.boscolopez.cloud;

        if ($host = librenms.boscolopez.cloud) {
            return 301 https://$host$request_uri;
        }

}

server {
    listen 443 ssl http2;
    server_name librenms.boscolopez.cloud;
    ssl_certificate /etc/letsencrypt/live/librenms.boscolopez.cloud/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/librenms.boscolopez.cloud/privkey.pem;
    ssl_session_cache shared:SSL:50m;
    add_header Strict-Transport-Security "max-age=63072000" always;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/librenms.boscolopez.cloud/chain.pem;
    resolver 172.16.10.1;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    root        /opt/librenms/html;
    index       index.php;
    charset utf-8;
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    location ~ [^/]\.php(/|$) {
        fastcgi_pass unix:/run/php/php-fpm-librenms.sock;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        include fastcgi.conf;
    }
    location ~ /\.(?!well-known).* {
        deny all;
    }
}

sudo apt install mariadb-client mariadb-server -y

sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf

#
# These groups are read by MariaDB server.
# Use it for options that only the server (but not clients) should see

# this is read by the standalone daemon and embedded servers
[server]

# this is only for the mysqld standalone daemon
[mysqld]

#
# * Basic Settings
#

user                    = mysql
pid-file                = /run/mysqld/mysqld.pid
basedir                 = /usr
datadir                 = /var/lib/mysql
tmpdir                  = /tmp
lc-messages-dir         = /usr/share/mysql
lc-messages             = en_US
skip-external-locking

# Broken reverse DNS slows down connections considerably and name resolve is
# safe to skip if there are no "host by domain name" access grants
#skip-name-resolve

# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
bind-address            = 127.0.0.1

#
# * Fine Tuning
#

#key_buffer_size        = 128M
#max_allowed_packet     = 1G
#thread_stack           = 192K
#thread_cache_size      = 8
# This replaces the startup script and checks MyISAM tables if needed
# the first time they are touched
#myisam_recover_options = BACKUP
#max_connections        = 100
#table_cache            = 64

#
# * Logging and Replication
#

# Both location gets rotated by the cronjob.
# Be aware that this log type is a performance killer.
# Recommend only changing this at runtime for short testing periods if needed!
#general_log_file       = /var/log/mysql/mysql.log
#general_log            = 1

# When running under systemd, error logging goes via stdout/stderr to journald
# and when running legacy init error logging goes to syslog due to
# /etc/mysql/conf.d/mariadb.conf.d/50-mysqld_safe.cnf
# Enable this if you want to have error logging into a separate file
#log_error = /var/log/mysql/error.log
# Enable the slow query log to see queries with especially long duration
#slow_query_log_file    = /var/log/mysql/mariadb-slow.log
#long_query_time        = 10
#log_slow_verbosity     = query_plan,explain
#log-queries-not-using-indexes
#min_examined_row_limit = 1000

# The following can be used as easy to replay backup logs or for replication.
# note: if you are setting up a replication slave, see README.Debian about
#       other settings you may need to change.
#server-id              = 1
#log_bin                = /var/log/mysql/mysql-bin.log
expire_logs_days        = 10
#max_binlog_size        = 100M

#
# * SSL/TLS
#

# For documentation, please read
# https://mariadb.com/kb/en/securing-connections-for-client-and-server/
#ssl-ca = /etc/mysql/cacert.pem
#ssl-cert = /etc/mysql/server-cert.pem
#ssl-key = /etc/mysql/server-key.pem
#require-secure-transport = on

#
# * Character sets
#

# MySQL/MariaDB default is Latin1, but in Debian we rather default to the full
# utf8 4-byte character set. See also client.cnf
character-set-server  = utf8mb4
collation-server      = utf8mb4_general_ci

#
# * InnoDB
#

# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
# Read the manual for more InnoDB related options. There are many!
# Most important is to give InnoDB 80 % of the system RAM for buffer use:
# https://mariadb.com/kb/en/innodb-system-variables/#innodb_buffer_pool_size
#innodb_buffer_pool_size = 8G

# this is only for embedded server
[embedded]

# This group is only read by MariaDB servers, not by MySQL.
# If you use the same .cnf file for MySQL and MariaDB,
# you can put MariaDB-only options here
[mariadb]

# This group is only read by MariaDB-10.5 servers.
# If you use the same .cnf file for MariaDB of different versions,
# use this group for options that older servers don't understand
[mariadb-10.5]

#
# These groups are read by MariaDB server.
# Use it for options that only the server (but not clients) should see

# this is read by the standalone daemon and embedded servers
[server]

# this is only for the mysqld standalone daemon
[mysqld]

#
# * Basic Settings
#

user                    = mysql
pid-file                = /run/mysqld/mysqld.pid
basedir                 = /usr
datadir                 = /var/lib/mysql
tmpdir                  = /tmp
lc-messages-dir         = /usr/share/mysql
lc-messages             = en_US
skip-external-locking

# Broken reverse DNS slows down connections considerably and name resolve is
# safe to skip if there are no "host by domain name" access grants


# DESCOMENTAMOS PARA QUE NO REALICE RESOLUCIÓN INVERSA DE LAS CONEXIONES
skip-name-resolve

# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
bind-address            = 0.0.0.0


# VALORES AGREGADOS LIBRENMS
innodb_file_per_table = 1
lower_case_table_names = 0
innodb_flush_log_at_trx_commit = 0

#
# * Fine Tuning
#

#key_buffer_size        = 2800M
#max_allowed_packet     = 1G
#thread_stack           = 192K
#thread_cache_size      = 8
# This replaces the startup script and checks MyISAM tables if needed
# the first time they are touched
#myisam_recover_options = BACKUP
max_connections        = 200
#table_cache            = 64

#
# * Logging and Replication
#

# Both location gets rotated by the cronjob.
# Be aware that this log type is a performance killer.
# Recommend only changing this at runtime for short testing periods if needed!
#general_log_file       = /var/log/mysql/mysql.log
#general_log            = 1

# When running under systemd, error logging goes via stdout/stderr to journald
# and when running legacy init error logging goes to syslog due to
# /etc/mysql/conf.d/mariadb.conf.d/50-mysqld_safe.cnf
# Enable this if you want to have error logging into a separate file
#log_error = /var/log/mysql/error.log
# Enable the slow query log to see queries with especially long duration
#slow_query_log_file    = /var/log/mysql/mariadb-slow.log
#long_query_time        = 10
#log_slow_verbosity     = query_plan,explain
#log-queries-not-using-indexes
#min_examined_row_limit = 1000

# The following can be used as easy to replay backup logs or for replication.
# note: if you are setting up a replication slave, see README.Debian about
#       other settings you may need to change.
#server-id              = 1
#log_bin                = /var/log/mysql/mysql-bin.log
expire_logs_days        = 10
#max_binlog_size        = 100M

#
# * SSL/TLS
#

# For documentation, please read
# https://mariadb.com/kb/en/securing-connections-for-client-and-server/
#ssl-ca = /etc/mysql/cacert.pem
#ssl-cert = /etc/mysql/server-cert.pem
#ssl-key = /etc/mysql/server-key.pem
#require-secure-transport = on

#
# * Character sets
#

# MySQL/MariaDB default is Latin1, but in Debian we rather default to the full
# utf8 4-byte character set. See also client.cnf
character-set-server  = utf8mb4
collation-server      = utf8mb4_general_ci

#
# * InnoDB
#

# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
# Read the manual for more InnoDB related options. There are many!
# Most important is to give InnoDB 80 % of the system RAM for buffer use:
# https://mariadb.com/kb/en/innodb-system-variables/#innodb_buffer_pool_size
#innodb_buffer_pool_size = 8G

# this is only for embedded server
[embedded]

# This group is only read by MariaDB servers, not by MySQL.
# If you use the same .cnf file for MySQL and MariaDB,
# you can put MariaDB-only options here
[mariadb]

# This group is only read by MariaDB-10.5 servers.
# If you use the same .cnf file for MariaDB of different versions,
# use this group for options that older servers don't understand
[mariadb-10.5]

sudo systemctl enable mariadb
sudo systemctl restart mariabd

su -
mysql -uroot

boscolopez@librenms ~ $ su -
Contraseña:
root@librenms ~ # mysql -uroot
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 31
Server version: 10.5.19-MariaDB-0+deb11u2 Debian 11

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

sudo mariadb-secure-installation

boscolopez@librenms ~ $ sudo mariadb-secure-installation
[sudo] password for boscolopez:

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] Y
Enabled successfully!
Reloading privilege tables..
 ... Success!


You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] Y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

mysql -uroot -p

CREATE DATABASE librenms CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

CREATE USER 'usrlibrenms'@'localhost' IDENTIFIED BY 'UnaP4$$w0rd_h1p3rSegura#';

GRANT ALL PRIVILEGES ON librenms.* TO 'usrlibrenms'@'localhost';
exit

boscolopez@librenms ~ $ mysql -uroot -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 42
Server version: 10.5.19-MariaDB-0+deb11u2 Debian 11

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> CREATE DATABASE librenms CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
Query OK, 1 row affected (0,000 sec)

MariaDB [(none)]> CREATE USER 'usrlibrenms'@'localhost' IDENTIFIED BY 'UnaP4$$w0rd_h1p3rSegura#';
Query OK, 0 rows affected (0,003 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON librenms.* TO 'usrlibrenms'@'localhost';
Query OK, 0 rows affected (0,003 sec)

MariaDB [(none)]> exit
Bye
boscolopez@librenms ~ $

mysql -uusrlibrenms -p

SHOW databases;

boscolopez@librenms ~ $ mysql -uusrlibrenms -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 44
Server version: 10.5.19-MariaDB-0+deb11u2 Debian 11

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> SHOW databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| librenms           |
+--------------------+
2 rows in set (0,000 sec)

MariaDB [(none)]>

sudo nano /etc/default/rrdcached

# /etc/default file for RRD cache daemon

# Full path to daemon
DAEMON=/usr/bin/rrdcached

# Optional override flush interval, in seconds.
WRITE_TIMEOUT=1800

# Optional override maximum write delay, in seconds.
WRITE_JITTER=1800

# Optional override number of write_threads
WRITE_THREADS=4

# Where database files are placed.  If left unset, the default /tmp will
# be used.  NB: The daemon will reject a directory that has symlinks as
# components.  NB: You may want to have -B in BASE_OPTS.
BASE_PATH=/opt/librenms/rrd

# Where journal files are placed.  If left unset, journaling will
# be disabled.
JOURNAL_PATH=/var/lib/rrdcached/journal/

# FHS standard placement for process ID file.
PIDFILE=/var/run/rrdcached.pid

# FHS standard placement for local control socket.
SOCKFILE=/run/rrdcached.sock

# Optional override group that should own/access the local control
# socket
SOCKGROUP=librenms

# Optional override access mode of local control socket.
#SOCKMODE=0660

# Optional unprivileged group to run under when daemon.  If unset
# retains invocation group privileges.
DAEMON_GROUP=librenms

# Optional unprivileged user to run under when daemon.  If unset
# retains invocation user privileges.
DAEMON_USER=librenms

# Network socket address requests.  Use in conjunction with SOCKFILE to
# also listen on INET domain sockets.  The option is a lower-case ell
# ASCII 108 = 0x6c, and should be repeated for each address.  The
# parameter is an optional IP address, followed by an optional port with
# a colon separating it from the address.  The empty string is
# interpreted as "open sockets on the default port on all available
# interfaces", but generally does not pass through init script functions
# so use -L with no parameters for that configuration.
#NETWORK_OPTIONS="-L"

# Any other options not specifically supported by the script (-P, -f,
# -F, -B).
BASE_OPTIONS="-B -F -R"

sudo chown librenms:librenms /var/lib/rrdcached/journal/

sudo systemctl enable rrdcached.service
sudo systemctl start rrdcached.service

sudo apt install acl curl fping git graphviz imagemagick mtr-tiny python3-dotenv python3-pymysql python3-redis python3-setuptools python3-systemd python3-pip rrdtool snmp snmpd whois -y

su -
cd /opt
git clone https://github.com/librenms/librenms.git

chown -R librenms:librenms /opt/librenms
chmod 771 /opt/librenms
chmod -R g+rwx /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/
find /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/ -type d -exec chmod g+rwx {} \;

su - librenms
./scripts/composer_wrapper.php install --no-dev
exit

sudo systemctl enable nginx
sudo systemctl enable php8.2-fpm
sudo systemctl reload nginx
sudo systemct restart php8.2-fpm

sudo cp /opt/librenms/dist/librenms-scheduler.service /opt/librenms/dist/librenms-scheduler.timer /etc/systemd/system/
sudo cp /opt/librenms/dist/librenms.cron /etc/cron.d/librenms
sudo cp /opt/librenms/misc/librenms.logrotate /etc/logrotate.d/librenms
sudo cp /opt/librenms/misc/lnms-completion.bash /etc/bash_completion.d/
sudo ln -s /opt/librenms/lnms /usr/local/bin/lnms
sudo systemctl enable librenms-scheduler.timer
sudo systemctl start librenms-scheduler.timer

sudo cp /opt/librenms/snmpd.conf.example /etc/snmp/snmpd.conf
sudo curl -o /usr/bin/distro https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
sudo chmod +x /usr/bin/distro

sudo nano /etc/snmp/snmpd.conf

# Change RANDOMSTRINGGOESHERE to your preferred SNMP community string
com2sec readonly  default         RANDOMSTRINGGOESHERE

group MyROGroup v2c        readonly
view all    included  .1                               80
access MyROGroup ""      any       noauth    exact  all    none   none

syslocation Rack, Room, Building, City, Country [Lat, Lon]
syscontact Your Name <your@email.address>

#OS Distribution Detection
extend distro /usr/bin/distro

#Hardware Detection
# (uncomment for x86 platforms)
#extend manufacturer '/bin/cat /sys/devices/virtual/dmi/id/sys_vendor'
#extend hardware '/bin/cat /sys/devices/virtual/dmi/id/product_name'
#extend serial '/bin/cat /sys/devices/virtual/dmi/id/product_serial'

# (uncomment for ARM platforms)
#extend hardware '/bin/cat /sys/firmware/devicetree/base/model'
#extend serial '/bin/cat /sys/firmware/devicetree/base/serial-number'

# Change RANDOMSTRINGGOESHERE to your preferred SNMP community string
com2sec readonly  default         monitorizando

group MyROGroup v2c        readonly
view all    included  .1                               80
access MyROGroup ""      any       noauth    exact  all    none   none

syslocation A Coruña, Spain [43.37410178129225, -8.434399038449621]
syscontact Bosco Lopez <tu@email.com>

#OS Distribution Detection
extend distro /usr/bin/distro

#Hardware Detection
# (uncomment for x86 platforms)
#extend manufacturer '/bin/cat /sys/devices/virtual/dmi/id/sys_vendor'
#extend hardware '/bin/cat /sys/devices/virtual/dmi/id/product_name'
#extend serial '/bin/cat /sys/devices/virtual/dmi/id/product_serial'

# (uncomment for ARM platforms)
#extend hardware '/bin/cat /sys/firmware/devicetree/base/model'
#extend serial '/bin/cat /sys/firmware/devicetree/base/serial-number'

extend manufacturer '/bin/cat /sys/devices/virtual/dmi/id/sys_vendor'
extend hardware '/bin/cat /sys/devices/virtual/dmi/id/product_name'
extend serial '/bin/cat /sys/devices/virtual/dmi/id/product_serial'

sudo systemctl enable snmpd
sudo systemctl restart snmpd

/snmp/set enabled=yes

/snmp/set contact="Bosco Lopez <tu@email.com>"

/snmp/set location="A Coruna,Spain [43.36920,-8.41978]"

/snmp/community/add name=monitorizando read-access=yes write-access=no addresses=172.16.10.151/32

/snmp/community/print

[admin@r01] > /snmp/community/add name=monitorizando read-access=yes write-access=no addresses=172.16.10.151/32 comment=LibreNMS
[admin@r01] > /snmp/community/print
Flags: * - DEFAULT; X - DISABLED
Columns: NAME, ADDRESSES, SECURITY, READ-ACCESS, WRITE-ACCESS
#    NAME           ADDRESSES         SECURITY  READ-ACCESS  WRITE-ACCESS
0 *X public         ::/0              none      yes          no
;;; LibreNMS
1    monitorizando  172.16.10.151/32  none      yes          no
[admin@r01] >

snmp-server community monitorizando ro
snmp-server contact "Bosco Lopez <tu@email.com>"
snmp-server location "A Coruna,Spain [43.36920,-8.41978]"

snmp-sever community monitorizando ro
snmp-server contact "Bosco Lopez <tu@email.com>"
snmp-server location "A Coruna,Spain [43.36920,-8.41978]"

<?php

## Have a look in misc/config_definitions.json for examples of settings you can set here. DO NOT EDIT misc/config_definitions.json!

// This is the user LibreNMS will run as
//Please ensure this user is created and has the correct permissions to your install
#$config['user'] = 'librenms';

### This should *only* be set if you want to *force* a particular hostname/port
### It will prevent the web interface being usable form any other hostname
#$config['base_url']        = "/";

### Enable this to use rrdcached. Be sure rrd_dir is within the rrdcached dir
### and that your web server has permission to talk to rrdcached.
#$config['rrdcached']    = "unix:/var/run/rrdcached.sock";

### Default community
#$config['snmp']['community'] = array('public');

### Authentication Model
#$config['auth_mechanism'] = "mysql"; # default, other options: ldap, http-auth
#$config['http_auth_guest'] = "guest"; # remember to configure this user if you use http-auth

### List of RFC1918 networks to allow scanning-based discovery
#$config['nets'][] = "10.0.0.0/8";
#$config['nets'][] = "172.16.0.0/12";
#$config['nets'][] = "192.168.0.0/16";

# Uncomment the next line to disable daily updates
#$config['update'] = 0;

# Number in days of how long to keep old rrd files. 0 disables this feature
#$config['rrd_purge'] = 0;

# Uncomment to submit callback stats via proxy
#$config['callback_proxy'] = "hostname:port";

# Set default port association mode for new devices (default: ifIndex)
#$config['default_port_association_mode'] = 'ifIndex';

# Enable the in-built billing extension
#$config['enable_billing'] = 1;

# Enable the in-built services support (Nagios plugins)
#$config['show_services'] = 1;

<?php

## Have a look in misc/config_definitions.json for examples of settings you can set here. DO NOT EDIT misc/config_definitions.json!

// This is the user LibreNMS will run as
//Please ensure this user is created and has the correct permissions to your install
#$config['user'] = 'librenms';

### This should *only* be set if you want to *force* a particular hostname/port
### It will prevent the web interface being usable form any other hostname
#$config['base_url']        = "/";

### Enable this to use rrdcached. Be sure rrd_dir is within the rrdcached dir
### and that your web server has permission to talk to rrdcached.
#$config['rrdcached']    = "unix:/var/run/rrdcached.sock";

### Default community
$config['snmp']['community'] = array('monitorizando');

### Authentication Model
#$config['auth_mechanism'] = "mysql"; # default, other options: ldap, http-auth
#$config['http_auth_guest'] = "guest"; # remember to configure this user if you use http-auth

### List of RFC1918 networks to allow scanning-based discovery
$config['nets'][] = "172.16.10.0/24";
#$config['nets'][] = "172.16.0.0/12";
#$config['nets'][] = "192.168.0.0/16";

# Uncomment the next line to disable daily updates
#$config['update'] = 0;

# Number in days of how long to keep old rrd files. 0 disables this feature
#$config['rrd_purge'] = 0;

# Uncomment to submit callback stats via proxy
#$config['callback_proxy'] = "hostname:port";

# Set default port association mode for new devices (default: ifIndex)
#$config['default_port_association_mode'] = 'ifIndex';

# Enable the in-built billing extension
#$config['enable_billing'] = 1;

# Enable the in-built services support (Nagios plugins)
#$config['show_services'] = 1;

$config['discovery_by_ip'] = true;

./snmp-scan.py

librenms@librenms:~$ ./snmp-scan.py
Scanning IPs:
***++++............................+........................................................-..............................---*...............................................................................................-.......--...............****.***..-..-.......................*..............--..................................................-.................................*........-...-...-..............................................................................-....--.........*..*..*.*..***................--.................*........--...................................................-................................--...*...-...........................................................................--.....-........................----

Scanned 762 IPs: 22 known devices, added 8 devices, failed to add 33 devices
Runtime: 119.17 seconds

lnms config:set rrdcached "unix:/run/rrdcached.sock"
lnms config:set snmp.timeout 1                         # timeout in seconds
lnms config:set snmp.retries 5                         # how many times to retry the query
lnms config:set snmp.transports '["udp", "udp6", "tcp", "tcp6"]'    # Transports to use
lnms config:set snmp.version '["v2c", "v3", "v1"]'       # Default versions to use
lnms config:set snmp.port 161                          # Default port
lnms config:set snmp.exec_timeout 1200                 # execution time limit in seconds

lnms config:set mydomain boscolopez.cloud

lnms config:set autodiscovery.nets-exclude.+ '192.168.20.0/24'

sudo apt  install ruby ruby-dev libsqlite3-dev libssl-dev pkg-config cmake libssh2-1-dev libicu-dev zlib1g-dev g++ -y

gem install oxidized
gem install oxidized-script
gem install su oxidized-web
gem install psych -v 3.3.2

useradd oxidized -s /bin/bash -d /home/oxidized/ -m

passwd oxidized
usermod -aG sudo oxidized

su - oxidized

oxidized@librenms:~$ pwd
/home/oxidized/

sudo chown -R oxidized:oxidized /home/oxidized

oxidized@librenms:~$ oxidized
edit ~/.config/oxidized/config
oxidized@librenms:~$

nano /home/oxidized/.config/oxidized/config

---
username: username
password: password
model: junos
resolve_dns: true
interval: 3600
use_syslog: false
debug: false
threads: 30
timeout: 20
retries: 3
prompt: !ruby/regexp /^([\w.@-]+[#>]\s?)$/
rest: 127.0.0.1:8888
next_adds_job: false
vars: {}
groups: {}
models: {}
pid: "/home/oxidized/.config/oxidized/pid"
crash:
  directory: "/home/oxidized/.config/oxidized/crashes"
  hostnames: false
stats:
  history_size: 10
input:
  default: ssh, telnet
  debug: false
  ssh:
    secure: false
  ftp:
    passive: true
  utf8_encoded: true
output:
  default: file
source:
  default: csv
model_map:
  juniper: junos
  cisco: ios

---
username: oxidized
password: ox1diz3d
model: junos
resolve_dns: true
interval: 3600
use_syslog: false
debug: false
threads: 30
timeout: 20
retries: 3
prompt: !ruby/regexp /^([\w.@-]+[#>]\s?)$/
rest: 172.16.10.151:8888
next_adds_job: false
vars: {}
groups:
   defaultgrp:
     username: default
     password: default
   routeros:
     username: usroxidized
     password: pwdusroxi
     vars:
       ssh_port: 22
models: {}
pid: "/home/oxidized/.config/oxidized/pid"
crash:
  directory: "/home/oxidized/.config/oxidized/crashes"
  hostnames: false
stats:
  history_size: 10
input:
  default: ssh, telnet
  debug: false
  ssh:
    secure: false
  ftp:
    passive: true
  utf8_encoded: true
output:
  default: file
  file:
    directory: "/home/oxidized/.config/oxidized/configs
source:
  default: http
  debug: false
  http:
    url: https://librenms.boscolopez.cloud/api/v0/oxidized
    file: "/hom/oxidized/.config/oxidized/router.db"
    delimiter: !ruby/regexp /:/
    map:
      name: hostname
      model: os
      group: group
    headers:
      X-Auth-Token: "2c65a58755ef24ede5c6e079b247c633"
model_map:
  mikrotik: routeros

mkdir -p ~/.config/oxidized/configs
mkdir -p ~/.config/oxidized/crashes
touch ~/.config/oxidized/router.db

su - librenms

$config['oxidized']['enabled']                  = TRUE;
$config['oxidized']['url']                      = 'http://172.16.10.151:8888';
$config['oxidized']['features']['versioning']   = true;
$config['oxidized']['group_support']            = true;
$config['oxidized']['default_group']            = 'oxidized';
$config['oxidized']['reload_nodes']             = true;
$config['oxidized']['ignore_os'] = array('linux','windows');
$config['oxidized']['ignore_types'] = array('server','power');

---
resolve_dns: true
interval: 3600
use_syslog: false
debug: false
threads: 30
timeout: 20
retries: 3
prompt: !ruby/regexp /^([\w.@-]+[#>]\s?)$/
rest: 172.16.10.151:8888
next_adds_job: false
vars: {}
groups:
   defaultgrp:
     username: oxidized
     password: ox1diz3d
   oxidized:
     username: usroxidized
     password: unapasswordsegura
     vars:
       ssh_port: 22
models: {}
pid: "/home/oxidized/.config/oxidized/pid"
crash:
  directory: "/home/oxidized/.config/oxidized/crashes"
  hostnames: false
stats:
  history_size: 10
input:
  default: ssh, telnet
  debug: false
  ssh:
    secure: false
  ftp:
    passive: true
  utf8_encoded: true
output:
  default: file
  file:
    directory: "/home/oxidized/.config/oxidized/configs"
source:
  default: http
  debug: false
  http:
    url: https://librenms.boscolopez.cloud/api/v0/oxidized
    file: "/hom/oxidized/.config/oxidized/router.db"
    delimiter: !ruby/regexp /:/
    map:
      name: hostname
      model: os
      group: group
    headers:
      X-Auth-Token: "2c65a58755ef24ede5c6e079b247c633"
model_map:
  mikrotik: routeros

root@librenms ~ # locate oxidized.service
/var/lib/gems/2.7.0/gems/oxidized-0.28.0/extra/oxidized.service

root@librenms ~ # whereis oxidized.service
oxidized: /usr/local/bin/oxidized

cp /var/lib/gems/2.7.0/gems/oxidized-0.28.0/extra/oxidized.service /usr/lib/systemd/system/

systemctl daemon-reload
systemctl enable oxidized

[admin@r01] > user/add name=usroxidized password=unapasswordsegura group=read

systemctl start oxidized.service
systemctl status oxidized.service

server {
        listen      80;
        server_name oxidized.boscolopez.cloud;

        if ($host = oxidized.boscolopez.cloud) {
            return 301 https://$host$request_uri;
        }

}

server {
    listen 443 ssl http2;
    server_name oxidized.boscolopez.cloud;
    ssl_certificate /etc/letsencrypt/live/oxidized.boscolopez.cloud/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/oxidized.boscolopez.cloud/privkey.pem;
    ssl_session_cache shared:SSL:50m;
    add_header Strict-Transport-Security "max-age=63072000" always;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/oxidized.boscolopez.cloud/chain.pem;
    resolver 172.16.10.1;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    location / {
             allow 172.16.10.0/24;
             deny all;
             proxy_pass http://172.16.10.151:8888/;
    }
    access_log /var/log/nginx/access_oxidized.log;
    error_log /var/log/nginx/error_oxidized.log;
}

sudo apt install monitoring-plugins -y

sudo chmod +x /usr/lib/nagios/plugins/*

sudo su - librenms

$config['show_services'] = 1;
$config['discover_services'] = true;
$config['discover_services_templates'] = true;
$config['nagios_plugins'] = "/usr/lib/nagios/plugins";
$config['service_poller_enabled'] = true;
$config['service_poller_workers'] = 16;
$config['service_poller_frequency'] = 300;
$config['service_poller_down_retry'] = 5;
$config['service_discovery_enabled'] = true;
$config['service_discovery_workers'] = 16;
$config['service_discovery_frequency'] = 3600;
$config['service_services_enabled'] = true;
$config['service_services_workers'] = 16;
$config['service_services_frequency'] = 60;

*/5 * * * * librenms /opt/librenms/services-wrapper.py 1

sudo su - librenms

#Fast Ping
$config['ping_rrd_step'] = 60;

lnms config:set ping_rrd_step 60

./scripts/rrdstep.php -h all

#Fast Ping
*    *    * * *   librenms    /opt/librenms/ping.php >> /dev/null 2>&1

sudo apt install -y smokeping

sudo cp /opt/librenms/misc/smokeping-debian.example /etc/cron.hourly/librenms-smokeping
sudo chmod +x /etc/cron.hourly/librenms-smokeping

*** Probes ***

+ FPing

binary = /usr/bin/fping

*** Probes ***

@include /etc/smokeping/config.d/librenms-probes.conf

*** Targets ***

probe = FPing

menu = Top
title = Network Latency Grapher
remark = Welcome to the SmokePing website of xxx Company. \
         Here you will learn all about the latency of our network.

+ Local

menu = Local
title = Local Network
#parents = owner:/Test/James location:/

++ LocalMachine

menu = Local Machine
title = This host
host = localhost
#alerts = someloss