Lab 05 ‐ SNMP - Sleeeee/t301-admin-III GitHub Wiki

In this lab, we will deploy an infrastructure monitoring service, LibreNMS, on our Proxmox infrastructure. We will thoroughly follow the documentation found on their official website. We will start off a fresh Debian 13 VM as setup in the previous labs.

Let's start by installing the required dependencies :

apt update
apt install acl ca-certificates curl fping git graphviz imagemagick lsb-release mariadb-client mariadb-server mtr-tiny nginx-full nmap php-cli php-curl php-fpm php-gd php-gmp php-mbstring php-mysql php-snmp php-xml php-zip python3-command-runner python3-dotenv python3-pip python3-psutil python3-pymysql python3-redis python3-setuptools python3-systemd rrdtool snmp snmpd unzip wget whois

Next step is to create a dedicated user for LibreNMS, and to clone the repository in our /opt directory :

useradd librenms -d /opt/librenms -M -r -s "$(which bash)"
cd /opt
git clone https://github.com/librenms/librenms.git

We also need to grant the librenms user and group full access to the directory, and deny other users R/W privilege :

chown -R librenms:librenms /opt/librenms
chmod 771 /opt/librenms
setfacl -d -m g::rwx /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/
setfacl -R -m g::rwx /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/

We can now download PHP dependencies, by installing the composer package and running the PHP wrapper script. As the librenms user :

wget https://getcomposer.org/composer-stable.phar
mv composer-stable.phar /usr/bin/composer
chmod +x /usr/bin/composer

su - librenms
./scripts/composer_wrapper.php install --no-dev exit

Once we have installed all the dependencies, we can start configuring our system.

Since we are using a Debian 13 machine, there is nothing to configure regarding SELinux and the internal firewall as they're not enabled. We also skipped on the lnms feature which enables autocomplete. Documentation on these can still be found on the LibreNMS website.

We can set the timezone corresponding to our actual location (Belgium). We will modify files /etc/php/8.3/fpm/php.ini and /etc/php/8.3/cli/php.ini to contain Europe/Brussels, and execute the following command to set the system timezone :

timedatectl set-timezone Europe/Brussels

We can now go on to configuring our MariaDB database. We can add the following lines to file /etc/mysql/mariadb.conf.d/50-server.cnf under the [mysqld] section :

innodb_file_per_table=1
lower_case_table_names=0

We can restart the service for the changes to take effect immediately. We also enable it in case it wasn't already done :

systemctl enable mariadb
systemctl restart mariadb

Once this is done, we will create a MariaDB database for LibreNMS, and create a user as shown below. The password has obviously been redacted.

mysql -u root
CREATE DATABASE librenms CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'librenms'@'localhost' IDENTIFIED BY [REDACTED];
GRANT ALL PRIVILEGES ON librenms.* TO 'librenms'@'localhost';
exit

We can now configure our PHP-FPM settings for LibreNMS. We will build upon the file /etc/php/8.3/fpm/pool.d/www.conf, which we can copy to the wanted location before editing it :

cp /etc/php/8.3/fpm/pool.d/www.conf /etc/php/8.3/fpm/pool.d/librenms.conf

Here are the changes that need to be done for the configuration to work :

• Change [www] to librenms:

[librenms]

• Change user and group to librenms:

user = librenms
group = librenms

• Change listen instruction (note we will be using nginx) :

listen = /run/php-fpm-librenms.sock

Here is the full configuration that we will be pasting into /etc/nginx/conf.d/librenms.conf. We omitted the server_name instruction since there is no real hostname linked to that HTTP service.

server {
 listen      80;
 root        /opt/librenms/html;
 index       index.php;

 charset utf-8;
 gzip on;
 gzip_types text/css application/javascript text/javascript application/x-javascript image/svg+xml text/plain text/xsd text/xsl text/xml image/x-icon;
 location / {
  try_files $uri $uri/ /index.php?$query_string;
 }
 location ~ [^/]\.php(/|$) {
  fastcgi_pass unix:/run/php-fpm-librenms.sock;
  fastcgi_split_path_info ^(.+\.php)(/.+)$;
  include fastcgi.conf;
 }
 location ~ /\.(?!well-known).* {
  deny all;
 }
}

Once this is done, all that is left is to remove the default nginx site and to restart the nginx and php-fpm services :

rm /etc/nginx/sites-enabled/default /etc/nginx/sites-available/default
systemctl restart nginx
systemctl restart php8.3-fpm

The only thing that is left is to install snmpd, the SNMP daemon, on both hypervisors for them to be able to be polled by our LibreNMS server. We will copy to our clients (the hypervisors) at /etc/snmp/snmpd.conf, the configuration found in our LibreNMS server at /opt/librenms/snmpd.conf.example. We will also make sure to change RANDOMSTRINGGOESHERE to some value that we will keep secret. Once this is done, we can fetch the distro script from LibreNMS and restart the SNMP service :

curl -o /usr/bin/distro https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
chmod +x /usr/bin/distro
systemctl enable snmpd
systemctl restart snmpd

Once everything is validated, we can register both our hypervisors as devices on LibreNMS. If everything is properly configured, after some time, we see that their status is correctly being monitored :