{"id":9766,"date":"2021-07-22T06:11:26","date_gmt":"2021-07-22T03:11:26","guid":{"rendered":"https:\/\/kifarunix.com\/?p=9766"},"modified":"2024-03-18T19:34:01","modified_gmt":"2024-03-18T16:34:01","slug":"install-ntopng-on-rocky-linux-8","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-ntopng-on-rocky-linux-8\/","title":{"rendered":"Install ntopng on Rocky Linux 8"},"content":{"rendered":"\n
This guide will take you through how to install ntopng on Rocky Linux 8. ntopng<\/a> is a high performance web-based network traffic monitoring application. It provides a intuitive, encrypted web user interface for the exploration of realtime and historical traffic information.<\/em><\/p>\n\n\n\n There exists various versions of ntopng. From community versions to Enterprise versions.<\/p>\n\n\n\n We will learn how to install community version of ntopng on Rocky Linux 8.<\/p>\n\n\n\n ntopng is not available on default Rocky Linux 8 repositories.<\/p>\n\n\n\n Thus, you need to install the ntop Packages Repository. <\/p>\n\n\n\n Next, execute the commands below to install ntopng.<\/p>\n\n\n\n In order to run the community version of ntopng, edit the configuration file, That is the only configuration we can make in this demo. The file is highly commented and you can read through it for more configuration options.<\/p>\n\n\n\n Start and enable ntopng to run on system boot;<\/p>\n\n\n\n Check the status;<\/p>\n\n\n\n By default, ntopng listens on port 3000\/tcp.<\/p>\n\n\n\n Hence, open this port on firewalld:<\/p>\n\n\n\n Next, navigate to http:\/\/server-IP:3000<\/p>\n\n\n\n Login using the default credentials: admin:admin<\/strong> and reset the password afterwards.<\/p>\n\n\n\n Some dashboards for ntopng;<\/p>\n\n\n\n Alerts<\/p>\n\n\n\n And that is it. ntopng is now installed and running. You can read further on the documentation page;<\/p>\n\n\n\n ntopng Documentation<\/a><\/p>\n\n\n\n Detecting Malicious Files with Wazuh and VirusTotal<\/a><\/p>\n\n\n\nInstalling ntopng on Rocky Linux 8<\/h2>\n\n\n\n
Install the ntop Packages Repository on Rocky Linux 8<\/h3>\n\n\n\n
wget https:\/\/packages.ntop.org\/centos-stable\/ntop.repo -O \/etc\/yum.repos.d\/ntop.repo<\/code><\/pre>\n\n\n\n
Install and enable other repositories<\/h3>\n\n\n\n
dnf install epel-release<\/code><\/pre>\n\n\n\n
dnf install http:\/\/rpms.remirepo.net\/enterprise\/remi-release-8.rpm<\/code><\/pre>\n\n\n\n
dnf config-manager --set-enabled powertools<\/code><\/pre>\n\n\n\n
Install ntopng<\/h3>\n\n\n\n
dnf erase zeromq3<\/code><\/pre>\n\n\n\n
dnf install pfring-dkms n2disk nprobe ntopng cento pfring-drivers-zc-dkms<\/code><\/pre>\n\n\n\n
Run ntopng community Version<\/h3>\n\n\n\n
\/etc\/ntopng\/ntopng.conf<\/code><\/strong>, by running the command below;<\/p>\n\n\n\n
sed -i 's#-G=\/var\/run\/ntopng.pid#-G=\/var\/run\/ntopng.pid \\\\n--community#' \/etc\/ntopng\/ntopng.conf<\/code><\/pre>\n\n\n\n
Running ntopng Service<\/h3>\n\n\n\n
systemctl enable --now ntopng<\/code><\/pre>\n\n\n\n
systemctl status ntopng<\/code><\/pre>\n\n\n\n
\n\u25cf ntopng.service - ntopng high-speed web-based traffic monitoring and analysis tool\n Loaded: loaded (\/usr\/lib\/systemd\/system\/ntopng.service; disabled; vendor preset: disabled)\n Active: active (running) since Thu 2021-07-22 13:20:13 EAT; 12s ago\n Process: 5087 ExecStopPost=\/bin\/rm -rf \/run\/ntopng.conf \/run\/ntopng.conf.raw \/run\/ntopng.pid (code=exited, status=0\/SUCCESS)\n Process: 5510 ExecStartPre=\/bin\/sh -c \/bin\/sed \"\/^[ ]*-e.*$\\|^[ ]*-G.*\\|^[ ]*--daemon.*\\|[ ]*--pid.*\/s\/^\/#\/\" \/run\/ntopng.conf.raw > \/run\/ntopng.conf (code=exited, status>\n Process: 5507 ExecStartPre=\/bin\/sh -c \/bin\/cat \/etc\/ntopng\/ntopng.conf.d\/*.conf >> \/run\/ntopng.conf.raw 2>\/dev\/null || true (code=exited, status=0\/SUCCESS)\n Process: 5503 ExecStartPre=\/bin\/sh -c \/bin\/cat \/etc\/ntopng\/ntopng.conf > \/run\/ntopng.conf.raw (code=exited, status=0\/SUCCESS)\n Process: 5490 ExecStartPre=\/bin\/sh -c \/usr\/bin\/ntopng-utils-manage-config -a check-restore && \/usr\/bin\/ntopng-utils-manage-config -a restore || true (code=exited, statu>\n Main PID: 5512 (ntopng)\n Tasks: 47 (limit: 23673)\n Memory: 203.7M\n CGroup: \/system.slice\/ntopng.service\n \u2514\u25005512 \/usr\/bin\/ntopng \/run\/ntopng.conf\n\nJul 22 13:20:16 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:16 [Ntop.cpp:882] Adding fe80::301d:abeb:ad8b:6c56\/64 as IPv6 local network for enp0s8\nJul 22 13:20:16 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:16 [PeriodicActivities.cpp:107] Started periodic activities loop...\nJul 22 13:20:17 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:17 [startup.lua:50] Processing startup.lua: please hold on...\nJul 22 13:20:18 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:18 [startup.lua:144] [lists_utils.lua:758] Refreshing category lists...\nJul 22 13:20:18 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:18 [startup.lua:144] [lists_utils.lua:696] Category Lists (695 hosts, 3140 IPs, 99 JA3) loaded in>\nJul 22 13:20:18 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:18 [startup.lua:218] Startup completed: ntopng is now operational\nJul 22 13:20:18 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:18 [PeriodicActivities.cpp:168] Each periodic activity script will use 4 threads\nJul 22 13:20:18 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:18 [NetworkInterface.cpp:2749] Started packet polling on interface lo [id: 1]...\nJul 22 13:20:18 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:18 [NetworkInterface.cpp:2749] Started packet polling on interface enp0s3 [id: 2]...\nJul 22 13:20:18 rocky8.kifarunix-demo.com ntopng[5512]: 22\/Jul\/2021 13:20:18 [NetworkInterface.cpp:2749] Started packet polling on interface enp0s8 [id: 3]...\n<\/code><\/pre>\n\n\n\n
Access ntopng Web Interface<\/h3>\n\n\n\n
ss -altnp | grep 3000<\/code><\/pre>\n\n\n\n
LISTEN 0 128 0.0.0.0:3000 0.0.0.0:* users:((\"ntopng\",pid=5512,fd=45))<\/code><\/pre>\n\n\n\n
firewall-cmd --permanent --add-port=3000\/tcp<\/code><\/pre>\n\n\n\n
firewall-cmd --reload<\/code><\/pre>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
Other tutorials<\/h3>\n\n\n\n