Contents PDF

Secure Configuration Reference

Every security-relevant control in one place - what it defaults to, where to change it, and what it protects. Written for security reviews, audits, and hardening checklists.

NetCrunch Security Features explains what each protection does and why it exists. Hardening the NetCrunch Server covers how to deploy the server so there is less to reach. This page is the reference neither of those is: a single list of controls, defaults and locations, arranged in the order a security reviewer will ask for them.

surface

What You Do Not Have to Configure

Most hardening guides for monitoring platforms spend their length on components NetCrunch does not ship. It is worth starting with those, because the shortest way to secure a component is not to have it.

NetCrunch runs its own web server built on node.js, and stores data in an embedded PostgreSQL instance. There is no IIS, no separate application server, and no external SQL Server.

That removes a category of work from the deployment rather than making it easier:

No web server banner headers, handler mappings or default sites to strip
No application pool recycling policy to tune
No separate database server to isolate, patch, license or place on its own subnet
No database service account to provision and rotate
No message broker configuration file that a configuration wizard overwrites

The controls that remain are the ones below.

authentication

Authentication and Access

Multi-Factor Authentication

A second factor can be required in addition to the account password, in both the Web Console and the Desktop Console. It applies to every connection type - the encrypted TCP connection, HTTPS, and connections relayed through the NetCrunch Connection Cloud. There is no route into a console that skips it.

The factor is a time-based code from an authenticator app. There is no SMS or email option.

User profileRequires Multi Factor Authentication

It is a property of the user profile rather than a global switch, so it can be required of the accounts that can change monitoring configuration or read stored credentials without being imposed on everyone. Enrolment is forced at next sign-in and cannot be skipped.

See NetCrunch Security Features for enrolment and for resetting a lost second factor.

Account Sources

Local accounts: Authenticate with credentials defined in NetCrunch.
Active Directory accounts: NetCrunch checks group membership at sign-in. Access profiles are assigned to AD groups, and access is revoked when a user loses membership. See Managing NetCrunch Access Profiles.

Where a domain is available, prefer Active Directory accounts. It keeps password policy, expiry and deprovisioning under the directory that already governs them, rather than duplicating that lifecycle inside NetCrunch.

Access Profiles

Access profiles are reusable role-based permission sets covering program features, atlas views, and individual nodes. Each user has one, assigned directly or inherited through an AD group.

Rights are Deny, Access or Manage, evaluated from longest path to shortest, so specific rules override broader defaults.

Deny by default is the recommended model: start with no access and add only what a role requires. The alternative - grant everything, then deny the sensitive parts - is quicker to set up and less defensible afterward.

Two rights deserve particular restraint, because both are effectively administrative:

The right to edit user profiles, which includes removing the multi-factor requirement from any account, including one's own
The right to read stored credentials

See Managing NetCrunch Access Profiles for the full model.

Shared Views

A shared view is a link to a read-only graphical view, served by a dedicated sharing user that cannot sign in to either console and can only see the views assigned to it. There is no navigation beyond those views and no configuration surface, which makes it the right way to give someone a dashboard without giving them an account.

Three controls are set when the share is created:

Password protection: Optional. Worth setting for anything beyond a public status page. Send the password through a different channel than the link.
Expiration date: Optional. Set one for anything temporary.
Embedding restriction: Defaults to *, meaning any origin may embed the view in an iframe. Enter a specific hostname to restrict it.

Shared view settings cannot be edited after creation. Changing a password, an expiration or an embedding rule means removing the sharing user and creating it again.

Administrators can see every shared user, who created it, whether it is password-protected, and how many views it exposes, under Users & Access Rights ManagerSharing. That panel is for visibility and audit - changes are still made from the individual views.

transit

Encryption in Transit

Connection	Transport	Properties
Desktop Console and Probe to Server	Direct TCP, port 12009	X25519 key exchange, AES-256-GCM encryption, mutual PSK authentication. No certificates required.
Web Console to Server	HTTPS	The built-in web server supports TLS 1.3 natively.
Console or Probe through the Connection Cloud	Outbound HTTPS, port 443	TLS with certificate validation and single-tenant isolation. No inbound connectivity required.
Notification email	SMTP with TLS	Enabled with the Encrypted connection (TLS) option.

For which of these run inside a validated cryptographic module and which do not, see the FIPS compatibility section of NetCrunch Security Features. The answer differs by component, because NetCrunch is not built on a single cryptographic stack.

Web Server Certificate

SettingsNetCrunch SystemConnections

Install a certificate even for internal-only use. HTTPS is not only about confidentiality here: several console features are only available on a secure page, including the SSH Terminal and embedded or shared views, because browsers restrict them on plain HTTP.

A self-signed certificate is acceptable for internal use and produces browser warnings. A certificate from a trusted authority removes the warnings and is required for secure WebSocket connections.

Plain HTTP is discouraged and may be deprecated in a future version. Treat an HTTP deployment as temporary.

A certificate can also be generated from the command line:

nccli generate-web-certificate

Trusting Additional Certificate Authorities

NetCrunch uses node.js for outbound SSL/TLS and HTTPS connections, and some certificate authorities are not included in its default trust store. Additional root certificates go in the external\Root Certificates folder of the NetCrunch Server data directory, in PEM format.

at-rest

Stored Credentials and Data at Rest

NetCrunch holds credentials on your behalf - monitoring credentials, SNMP profiles, integration profiles, user profiles. All of it is stored encrypted, anchored to a master encryption key. Every installation has one; what differs is what protects it.

Default: The master key is protected with a built-in system password. Data is encrypted and the installation is portable - a backup restores on another machine and the credentials come with it. That portability is also the exposure: whoever obtains the backup obtains the credentials inside it.
Advanced Data Security: The master key is protected with a master password of your own, and all backups are encrypted with AES-256 using that password.

SettingsNetCrunch SystemServerAdvanced Data Security

The master password must be at least 12 characters and include a lowercase letter, an uppercase letter, a number, and a special character. It can be changed later.

Advanced Data Security is available in the Enterprise Edition only.

Record the master password somewhere safe and separate from the backups it protects. It cannot be recovered, and NetCrunch has no bypass - that is the point of the feature.

Data Folder Permissions

The data folder holds the master encryption key and the credential database, so the whole tree carries an explicit access control list rather than inheriting from ProgramData.

Full control is granted to SYSTEM, BUILTIN\Administrators, and the service account where the service does not run as LocalSystem. BUILTIN\Users is granted nothing.

The installer applies this during setup, and the server normalizes the rest of the tree in the background after starting - which is what brings an upgraded installation into line. Deliberately customized permissions on the data root are left alone.

api

Programmatic Access

REST API and MCP Server share one API key mechanism, one user binding, one set of access rights, and one rate limiter. A key created for REST works for MCP.

User ProfilesAPI Keys

An API key inherits the access rights of the NetCrunch user it is bound to, so key scope is governed by the same access profiles as console access.

Available restrictions:

Read-only mode: The key can read but not change configuration.
Source address restriction: The key is only accepted from given addresses.
Expiration date: The key stops working on a set date.
Rate limiting: Requests are limited per key by a token bucket, shared between REST and MCP.

Recommended practice:

Use a dedicated NetCrunch user account for automation rather than a personal administrator account - it makes usage auditable and prevents an integration from breaking when a person leaves
Use a separate key per script or integration
Start read-only and grant write access only where a script must change configuration
Restrict by source address wherever the caller has a stable address
Pass the key in the x-api-key header rather than the URL, since URLs appear in logs and browser history

Treat API keys as passwords. Do not commit them to source control or leave them in shared script folders.

Do not connect an unrestricted administrator key to an experimental AI assistant or external automation tool.

See Getting Started for key creation and MCP and AI-Compatible Automation for the MCP-specific model.

monitoring-credentials

Credentials Used for Monitoring

The credentials NetCrunch uses to reach monitored systems are worth the same scrutiny as the ones used to reach NetCrunch.

SNMP: Prefer SNMPv3. v1 and v2c community strings cross the network unprotected. NetCrunch supports SNMPv3 with DES, 3DES, AES 128, AES 192 and AES 256 privacy. Receiving v3 traps requires a separate SNMPv3 notification profile - without one, encrypted traps cannot be decoded. See Receiving SNMPv3 Notifications.
Windows: Use a dedicated monitoring account rather than a domain administrator, and narrow the remote administration firewall rules to the NetCrunch Server address. See Windows Monitoring Setup.
Cloud and API targets: Where the platform offers a read-only role or a scoped token, use it. Proxmox monitoring needs only PVEAuditor; Azure needs only Monitoring Reader.

auditing

Auditing

NetCrunch Audit monitoring pack: Tracks user access to the console, including logins, logouts and failed login attempts, for both the Desktop and Web Console. Enable it to have sign-in activity raise events like any other monitored condition.
Activity Log: ApplicationsServer records sharing operations - when a view was shared and by whom, login and logout events for shared-view users, and the IP addresses accessing shared links.
API usage events: When an API key executes a request, the event log records it, making it possible to identify which integration, script or MCP client performed an action.
Security Audit monitoring pack: Watches account events, logins and password problems on monitored Windows machines - the estate rather than NetCrunch itself, but worth enabling on the NetCrunch server too.

deployment

Deployment

The controls above protect the installation. How the server is deployed determines how much there is to protect in the first place:

Run NetCrunch and nothing else on the server
Monitor from a probe on a separate machine; the server probe should monitor NetCrunch itself and nothing else
Do not run script sensors or program-executing alert actions from the server probe - they run with the server's privileges, next to the credential database
The startup script is a fixed file in the installation directory, so defining what runs at server startup requires local administrator rights on that machine and cannot be set remotely

Hardening the NetCrunch Server covers each of these, including what applies when there is only one machine available.

summary

Settings Summary

Control	Default	Where
Multi-factor authentication	Off; set per profile	User profile -> Requires Multi Factor Authentication
Access model	Deny by default	Access profile -> Atlas Defaults
Advanced Data Security (master password, AES-256 backups)	Off; built-in system password	Settings -> NetCrunch System -> Server -> Advanced Data Security
Web server certificate	Self-signed	Settings -> NetCrunch System -> Connections
Data folder ACL	Applied by installer	Filesystem; normalized by the server at startup
API key read-only mode	Off	User Profiles -> API Keys
API key source restriction	None	User Profiles -> API Keys
API key expiration	None	User Profiles -> API Keys
API rate limiting	On	Per key, not configurable
Console sign-in auditing	Off	NetCrunch Audit monitoring pack
SNMP version	Per credential profile	Settings -> Monitoring -> SNMP Communities and Passwords
FIPS mode	Off	Windows Local Security Policy, not NetCrunch

access profilesapi keyattack surfaceauditcertificatechecklistcompliancecontrolsdata at restdefaultsencryptionfipsfips modehardeningmaster passwordmfarate limitingsecure configurationsecuritysnmpv3tls