Skip to content

🧭 Responsibility Disclaimer

NetAlertX provides powerful tools for network scanning, presence detection, and automation. However, it is up to you—the deployer—to ensure that your instance is properly secured.

This includes (but is not limited to): - Controlling who has access to the UI and API - Following network and container security best practices - Running NetAlertX only on networks where you have legal authorization - Keeping your deployment up to date with the latest patches

NetAlertX is not responsible for misuse, misconfiguration, or unsecure deployments. Always test and secure your setup before exposing it to the outside world.

🔐 Securing Your NetAlertX Instance

NetAlertX is a powerful network scanning and automation framework. With that power comes responsibility. It is your responsibility to secure your deployment, especially if you're running it outside a trusted local environment.

⚠️ TL;DR – Key Security Recommendations

  • ✅ NEVER expose NetAlertX directly to the internet without protection
  • ✅ Use a VPN or Tailscale to access remotely
  • ✅ Enable password protection for the web UI
  • ✅ Harden your container environment (e.g., no unnecessary privileges)
  • ✅ Use firewalls and IP whitelisting
  • ✅ Keep the software updated
  • ✅ Limit the scope of plugins and API keys

🔗 Access Control with VPN (or Tailscale)

NetAlertX is designed to be run on private LANs, not the open internet.

Recommended: Use a VPN to access NetAlertX from remote locations.

✅ Tailscale (Easy VPN Alternative)

Tailscale sets up a private mesh network between your devices. It's fast to configure and ideal for NetAlertX.
👉 Get started with Tailscale

🔑 Web UI Password Protection

By default, NetAlertX does not require login. Before exposing the UI in any way:

  1. Enable password protection: ini SETPWD_enable_password=true SETPWD_password=your_secure_password

  2. Passwords are stored as SHA256 hashes

  3. Default password (if not changed): 123456 — change it ASAP!

To disable authenticated login, set SETPWD_enable_password=false in app.conf

🔥 Additional Security Measures

  • Firewall / Network Rules
    Restrict UI/API access to trusted IPs only.

  • Limit Docker Capabilities
    Avoid --privileged. Use --cap-add=NET_RAW and others only if required by your scan method.

  • Keep NetAlertX Updated
    Regular updates contain bug fixes and security patches.

  • Plugin Permissions
    Disable unused plugins. Only install from trusted sources.

  • Use Read-Only API Keys
    When integrating NetAlertX with other tools, scope keys tightly.

🧱 Docker Hardening Tips

  • Use read-only mount options where possible (:ro)
  • Avoid running as root unless absolutely necessary
  • Consider using docker scan or other container image vulnerability scanners
  • Run with --network host only on trusted networks and only if needed for ARP-based scans

📣 Responsible Disclosure

If you discover a vulnerability or security concern, please report it privately to:

📧 jokob@duck.com

We take security seriously and will work to patch confirmed issues promptly. Your help in responsible disclosure is appreciated!

By following these recommendations, you can ensure your NetAlertX deployment is both powerful and secure.