Docs

Password Protection

The entire web UI is protected by a styled HTML login page (Apache mod_auth_form). Nobody can view the graphs, the raw flow data, or any NfSen page without signing in.

First login

Open http://<YOUR_IP>:8070/ — you'll be asked to sign in:

Field	Value
Username	`admin`
Password	`change-me-now`

Change the password immediately

One command, takes effect instantly, no restart needed:

set new password

docker exec netlens htpasswd -b /var/nfsen/etc/.htpasswd admin YourNewPass123

Log out

Visit http://<YOUR_IP>:8070/logout.

Customize the default credentials (first boot only)

Set these in docker-compose.yml — they only apply while .htpasswd doesn't exist yet:

docker-compose.yml

environment:
  - NFSEN_ADMIN_USER=admin
  - NFSEN_ADMIN_PASSWORD=change-me-now

How sessions work

Login sessions end when you close the browser. The login cookie is a browser-session cookie (no expiry), so closing the browser and reopening the site shows the login page again.
Sessions auto-expire after 1 hour of inactivity. Enforced by session-guard.php, which runs before every NfSen page (auto_prepend_file). Staying on the login page never logs you out. To change the limit, edit NFSEN_LOGIN_MAX_AGE at the top of session-guard.php (value in seconds) and rebuild.
The activity-timer cookie is HttpOnly + SameSite=Lax (set by session-guard.php). Note: the Apache session cookie itself can't be marked HttpOnly on Ubuntu 20.04's Apache 2.4.41 (that needs Apache 2.4.43+) — so keep the UI behind HTTPS and log out when you're done.

What is NOT protected

Only the Web UI is protected. The NetFlow UDP collection ports (2055, 2056, …) are unaffected. Firewall those ports to only your routers' IPs (see the security notes).

Remove the login page (optional)

Need the login page removed again? Delete the auth block from config/000-default.conf and rebuild.