Security overview

For your security team · version 0.9

NocLens holds device credentials and can change network equipment, so it is built to pass a security review. These are the controls in the current version.

Deployment

Runs entirely on your server. No cloud component touches your network data.
One port faces users: HTTPS 443 (port 80 only redirects). Devices send logs to syslog 514 (UDP/TCP) and NetFlow v5 to UDP 2055; those ports only receive data. The application ports are not reachable from outside the server.
The application containers run as a non-root user with a read-only root file system, all Linux capabilities dropped and privilege escalation blocked. The HTTPS proxy runs with every capability dropped except binding ports 80/443.
The installer refuses a download whose checksum is missing or wrong. Updates must also carry our Ed25519 signature, expire after 180 days, and never go back to an older version unless you force it.
No compiler or build tools inside the images.

Web application

HTTPS from the first start (own certificate authority or yours) and HSTS.
Passwords stored with scrypt and a per-user salt; 12-character minimum at setup.
Login throttling before password hashing; the same answer for unknown users and wrong passwords.
Session cookies are HttpOnly, Secure and SameSite=Strict; sessions end on password change or account removal; 12-hour lifetime.
CSRF protection on every state-changing request: a session-bound token plus an Origin check.
Content-Security-Policy, X-Frame-Options DENY, nosniff and a strict referrer policy.
Role-based access (viewer, engineer, admin) checked on every request, and an audit log of logins, scans, changes and user management.
Errors shown in the browser carry no file paths or secrets.
First-run setup requires a one-time code shown on the server console.

Device credentials

Device accounts are kept in two tiers: a read-only account for audits and an admin account used only when you run a remediation.
Stored encrypted (Fernet: AES-128 with HMAC-SHA256). The key file lives outside the data folder and is never part of a backup, so a backup archive or a copy of the data folder holds no readable passwords.
SSH host keys are pinned at first contact; a device that later presents a different key receives no password and the audit says why.

Network safety

Audits only read. Remediation is off by default.
Remediation runs pass backup, drift check, canary, staged rollout and verification, and stop on the first failure.
Hard limits: 4,096 addresses per scan request (configurable up to 65,536) and 2 parallel jobs (up to 4).

Licensing

Licenses are Ed25519-signed by our license service and verified on your server; the signing key never leaves the service. A daily check sends only the license key, a random server ID, the host name and the version. Air-gapped servers use an offline license file.

Testing

More than 1,000 automated tests run before each release, including tests for CSRF, access control, session handling, path traversal, scan limits and license tampering.

Known limits, stated plainly

Someone with root on the NocLens server can read device passwords: the service has to decrypt them to log in unattended. Protect the server like the devices it manages.
SSH keys are trusted the first time NocLens sees a device. Run the first scan from your management network, not across untrusted links.
SNMP v2c community strings are stored readable for the NocLens Wall (SNMP v2c sends them in clear on the network anyway). Use a read-only community.
Syslog and NetFlow have no sender authentication: anyone who can reach those ports can send events. Allow only your devices to reach them (firewall rule on the server or network).
Telnet, where you choose it, sends passwords in clear. Prefer SSH.
Phone alerts go through the ntfy service you configure (public ntfy.sh by default) and carry the alert text. Leave them off, or run your own ntfy server, if that is not acceptable.

Reporting a vulnerability

Write to mindshatter1122@gmail.com. We reply within two business days.