Security Notes

Built-in protections

• Login protection — Apache mod_auth_form login page protects the entire Web UI. The activity-timer cookie is HttpOnly + SameSite=Lax (set by session-guard.php). Note: the Apache session cookie itself can't be marked HttpOnly on Ubuntu 20.04's Apache 2.4.41 (that needs Apache 2.4.43+) — so keep the UI behind HTTPS and log out when you're done.
• No directory listings — Apache Options -Indexes in config/000-default.conf, so NfSen's plugin/config files under /var/nfsen/www can't be browsed.
• Least privilege — the container runs with no extra Linux capabilities (no NET_ADMIN/NET_RAW): nfcapd collects NetFlow over plain UDP sockets and needs nothing special.
• Session crypto — the login session is encrypted with a random passphrase generated on first start.
• Smaller attack surface — the image no longer installs docs-only tools (doxygen, graphviz) or legacy net-tools.

VPS hardening checklist

Run these steps once on the VPS that hosts the NetLens container:

1. Change the default login password

docker exec netlens htpasswd -b /var/nfsen/etc/.htpasswd admin <YourStrongPassword>

2. Firewall the NetFlow UDP ports

Allow only your routers' IPs to send NetFlow data to the published UDP ports:

sudo ufw allow from <ROUTER1_IP> to any port 2055 proto udp
sudo ufw allow from <ROUTER2_IP> to any port 2056 proto udp
sudo ufw allow 8070/tcp        # Web UI (keep this one open)
sudo ufw enable

3. Enable HTTPS for the Web UI

The Web UI currently uses plain HTTP. For production, put a reverse proxy (Caddy / Nginx / Let's Encrypt) in front of port 8070. Also consider brute-force protection on the login page via fail2ban.

NFS sharing security

When sharing data with LibreNMS, follow these rules:

• Export only the two data folders — nfsen-data/ and nfsen-stat/. Never export nfsen-etc/ (contains .htpasswd password hashes) or nfsen-var/ (logs, runtime state).
• Use read-only exports (ro) — the LibreNMS server only needs to read. A read-only export cannot corrupt the live data.
• Restrict exports to the LibreNMS IP — use the/32 subnet mask in /etc/exports.
• Never run two NfSen instances writing to the same live folder. NfSen uses SysV semaphores that exist per-host — two instances cannot coordinate and will corrupt each other's 5-minute files.

Data protection

• Back up regularly — all four data folders survive container rebuilds and restarts. Only rm -rf of the folders themselves deletes your data.
• Log out — browser sessions auto-expire after 1 hour of inactivity. Log out explicitly when you're done.
• Monitor disk usage — set data retention (expire + max size) to prevent the disk from filling up and causing a denial of service.