Install and configure ntopng for comprehensive network monitoring with traffic analysis and real-time dashboards

#!/usr/bin/env bash

set -euo pipefail

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Default values
NTOPNG_PORT="${1:-3000}"
ADMIN_PASS="${2:-admin123}"

# Usage message
usage() {
    echo "Usage: $0 [port] [admin_password]"
    echo "  port: Web interface port (default: 3000)"
    echo "  admin_password: Admin password (default: admin123)"
    exit 1
}

# Logging functions
log() { echo -e "${GREEN}[INFO]${NC} $1"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
error() { echo -e "${RED}[ERROR]${NC} $1" >&2; }

# Cleanup on failure
cleanup() {
    error "Installation failed. Cleaning up..."
    systemctl stop ntopng 2>/dev/null || true
    systemctl stop redis 2>/dev/null || true
    exit 1
}
trap cleanup ERR

# Check prerequisites
if [[ $EUID -ne 0 ]]; then
    error "This script must be run as root"
    exit 1
fi

# Validate port
if [[ ! "$NTOPNG_PORT" =~ ^[0-9]+$ ]] || [ "$NTOPNG_PORT" -lt 1024 ] || [ "$NTOPNG_PORT" -gt 65535 ]; then
    error "Invalid port number. Use 1024-65535"
    usage
fi

# Detect distribution
if [ ! -f /etc/os-release ]; then
    error "/etc/os-release not found. Cannot detect distribution."
    exit 1
fi

. /etc/os-release
case "$ID" in
    ubuntu|debian)
        PKG_MGR="apt"
        PKG_INSTALL="apt install -y"
        PKG_UPDATE="apt update && apt upgrade -y"
        FIREWALL_CMD="ufw"
        PACKAGES="ntopng redis-server libpcap0.8 net-tools"
        ;;
    almalinux|rocky|centos|rhel|ol)
        PKG_MGR="dnf"
        PKG_INSTALL="dnf install -y"
        PKG_UPDATE="dnf update -y"
        FIREWALL_CMD="firewall-cmd"
        PACKAGES="ntopng redis libpcap net-tools"
        ;;
    fedora)
        PKG_MGR="dnf"
        PKG_INSTALL="dnf install -y"
        PKG_UPDATE="dnf update -y"
        FIREWALL_CMD="firewall-cmd"
        PACKAGES="ntopng redis libpcap net-tools"
        ;;
    amzn)
        PKG_MGR="yum"
        PKG_INSTALL="yum install -y"
        PKG_UPDATE="yum update -y"
        FIREWALL_CMD="firewall-cmd"
        PACKAGES="ntopng redis libpcap net-tools"
        ;;
    *)
        error "Unsupported distribution: $ID"
        exit 1
        ;;
esac

log "Installing ntopng on $PRETTY_NAME"

# Step 1: Update system
echo "[1/10] Updating system packages..."
$PKG_UPDATE

# Step 2: Install EPEL if RHEL-based
if [[ "$PKG_MGR" == "dnf" || "$PKG_MGR" == "yum" ]]; then
    echo "[2/10] Installing EPEL repository..."
    $PKG_INSTALL epel-release
else
    echo "[2/10] Skipping EPEL (Debian-based system)..."
fi

# Step 3: Install ntopng and dependencies
echo "[3/10] Installing ntopng and dependencies..."
$PKG_INSTALL $PACKAGES

# Step 4: Enable and start Redis
echo "[4/10] Configuring Redis..."
systemctl enable redis || systemctl enable redis-server
systemctl start redis 2>/dev/null || systemctl start redis-server
sleep 2

# Step 5: Create ntopng data directory
echo "[5/10] Creating ntopng data directory..."
mkdir -p /var/lib/ntopng
if id "ntopng" &>/dev/null; then
    chown ntopng:ntopng /var/lib/ntopng
else
    warn "ntopng user not found, using root ownership"
fi
chmod 755 /var/lib/ntopng

# Step 6: Detect network interfaces
echo "[6/10] Detecting network interfaces..."
INTERFACES=$(ip link show | awk '/^[0-9]+:/ && !/lo:/ {gsub(/:/, "", $2); print $2}' | head -2 | tr '\n' ',' | sed 's/,$//')
if [[ -z "$INTERFACES" ]]; then
    warn "No network interfaces detected, using default eth0"
    INTERFACES="eth0"
fi
log "Using interfaces: $INTERFACES"

# Step 7: Configure ntopng
echo "[7/10] Configuring ntopng..."
mkdir -p /etc/ntopng
cat > /etc/ntopng/ntopng.conf << EOF
# Network interfaces to monitor
-i=$INTERFACES

# Web interface settings
-P=/var/lib/ntopng/ntopng.pid
-d=/var/lib/ntopng
-w=$NTOPNG_PORT

# Redis connection
-r=127.0.0.1:6379

# Local networks
-m=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12

# Enable historical data
--dump-timeline=1
--dump-flows=1

# User authentication
-u=admin:$ADMIN_PASS

# Logging
-v=3
--syslog=daemon
EOF

chmod 644 /etc/ntopng/ntopng.conf

# Step 8: Configure systemd service
echo "[8/10] Configuring systemd service..."
mkdir -p /etc/systemd/system/ntopng.service.d
cat > /etc/systemd/system/ntopng.service.d/override.conf << EOF
[Service]
ExecStart=
ExecStart=/usr/bin/ntopng /etc/ntopng/ntopng.conf
Restart=always
RestartSec=10

[Unit]
After=redis.service
Requires=redis.service
EOF

# Step 9: Configure firewall
echo "[9/10] Configuring firewall..."
if [[ "$FIREWALL_CMD" == "ufw" ]]; then
    if command -v ufw >/dev/null; then
        ufw --force enable
        ufw allow $NTOPNG_PORT/tcp comment 'ntopng web interface'
        ufw reload
    fi
else
    if command -v firewall-cmd >/dev/null && systemctl is-active firewalld >/dev/null 2>&1; then
        firewall-cmd --add-port=$NTOPNG_PORT/tcp --permanent
        firewall-cmd --reload
    fi
fi

# Step 10: Start services and configure log rotation
echo "[10/10] Starting services and finalizing configuration..."
systemctl daemon-reload
systemctl enable ntopng
systemctl start ntopng

# Configure log rotation
cat > /etc/logrotate.d/ntopng << EOF
/var/log/ntopng/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 644 ntopng ntopng
    postrotate
        /bin/systemctl reload ntopng > /dev/null 2>&1 || true
    endscript
}
EOF

# Verification
echo
log "Verifying installation..."
sleep 5

if systemctl is-active ntopng >/dev/null; then
    log "✓ ntopng service is running"
else
    error "✗ ntopng service is not running"
    exit 1
fi

if systemctl is-active redis >/dev/null 2>&1 || systemctl is-active redis-server >/dev/null 2>&1; then
    log "✓ Redis service is running"
else
    error "✗ Redis service is not running"
    exit 1
fi

if ss -tuln | grep :$NTOPNG_PORT >/dev/null; then
    log "✓ ntopng web interface is listening on port $NTOPNG_PORT"
else
    error "✗ ntopng web interface is not listening"
    exit 1
fi

# Final message
echo
log "ntopng installation completed successfully!"
log "Access the web interface at: http://$(hostname -I | awk '{print $1}'):$NTOPNG_PORT"
log "Username: admin"
log "Password: $ADMIN_PASS"
warn "Change the default password after first login!"