phpipam/phpipam

phpipam development repository

{php}IPAM

Website: https://phpipam.net/

Description

phpIPAM is an open-source web IP address management application. Its goal is to provide light and simple IP address management application. It is ajax-based using jQuery libraries, it uses php scripts and javascript and some HTML5/CSS3 features, so some modern browser is preferred to be able to display javascript quickly and correctly.

Links

• Features & Tools
• Requirements & Installation
• API guide
• Update
• Demo page (Login: Admin / ipamadmin)

Branches

• MASTER: Current development release
• 1.6: Productional branch for 1.6.x release
• 1.5: Productional branch for 1.5.x release (obsolete)
• 1.4: Productional branch for 1.4.x release (obsolete)
• 1.3: Productional branch for 1.3.x release (obsolete)
• 1.2: Productional branch for 1.2.x release (obsolete)
• Other branches: Feature testing

Supported PHP versions

phpIPAM has been developed and tested on the following PHP versions.
The use of untested PHP versions is unsupported and may result in compatibility issues.

• MASTER: PHP versions 7.2 to 8.3
• 1.6.x: PHP versions 7.2 to 8.3
• 1.5.x: PHP versions 5.4 to 7.4
• 1.4.x: PHP versions 5.4 to 7.4
• 1.3.x: PHP versions 5.4 to 7.1

Supported MySQL / MariaDB versions

As of v1.6.0 support for utf8mb4 is mandatory: MySQL 5.5.3+
For best performance, Common Table Expressions (CTE) query support: MySQL 8.0+ / MariaDB 10.2.1+

I forgot my Admin password!?

Just run php functions/scripts/reset-admin-password.php in the cli and enter your new password

What are the credentials for a fresh install?

The Default credentials for a new instance of phpIPAM are the same as the credentials for the demo page: Admin / ipamadmin

Docker

Community maintained docker images are available at https://hub.docker.com/u/phpipam

Changelog

See misc/CHANGELOG

Roadmap

See misc/Roadmap

Security

See SECURITY.md

Contact

[email protected]

Special thanks are going also to the Hosterdam team (http://www.hosterdam.com) for the VPS server that is used for development of phpIPAM and for demo site.

And also to all users that filed a bug report / feature report and helped with feature testing!

License

phpIPAM is released under the GPL v3 license, see misc/gpl-3.0.txt.

phpipam's Issues

Missing PowerDNS checkbox on settings

Missing PowerDNS checkbox on settings page.

how to automatic scan subnet for new host ?

Hi sir,
when i acceess a subnet ip address details at http://ipaddress/phpipam/?page=subnets&section=1&subnetId=15
i have a question that how to automatic scan subnet for new host and add into the "IP addresses in subnet" ?
thanks.

Search box and search tool handels slashes differently

Hi,
slashes are handled different by the search function via the search box in the header and the search tool itself.
E.g. If I search for an interface called "ethernet1/3" via the search box in the header I will get a result which shows results for "3".
If I do the same search request via the search formula in the tools section I will receive the correct search results for "ethernet1/3".
I guess its because of a different handling to avoid some kind of path traversal or remote file inclusion. But I'm not really sure about that.

Error while using API to Update an IP address

So here is my test (with the development version):

rest.method = "PATCH";
rest.urlTemplate = "/api/marvin/addresses/1234/?hostname=" + servidor;
reqcriaIP = rest.createRequest(null,null);
reqcriaIP.setHeader("phpipam-token",token);
respip = reqcriaIP.execute();
System.warn(respip.contentAsString);

And the response: {"code":404,"success":false,"message":"Address does not exist"}

But this IP exists on the Server (this is his ID, I've seen on the MySQL db). When I try to add an IP (with POST method) this happens with no problem!

I'm using the 'master' version ;)

Feature Request: DNS Update to Active Directory DNS

I know you are working on DNS integration, but I was wondering if you would consider including the ability to update Microsoft DNS. Here is the procedure. The user would need to have read/write access to the zone in qustion or that the user account is in the DNSAdmins security group in Active Directory.

1. Get a Kerberos Ticket Granting Ticket
2. Use nsupdate to use GSSTSIG to make an authenticated update the Microsoft DNS.

cat << EOF > ./phpipam_krb.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log    

[libdefaults]
 dns_lookup_realm = true
 dns_lookup_kdc = true
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
EOF    

# KRB5_CONFIG is the env var that kinit uses.
export KRB5_CONFIG=./phpipam_krb5.conf    

export KRB_USER=username
export KRB_PASS=P4ssW0rd
export KRB_REALM=ACME.ORG    

# Get Kerberos Ticket Granting Ticket
echo $KRB_PASS | kinit $KRB_USER@$KRB_REALM    

# List current kerberos tickets.
klist


cat << EOF > nsupdate_commands
server domain_controller.acme.org
zone acme.org
update delete test1.acme.org A
update add test1.acme.org 3500 A 10.0.0.1
show
send
EOF    

# When nsupdate is run, you will get a TSIG error "; TSIG error with server: tsig verify failure".  This error appears to be a bug in nsupdate and can be ignored.  The update will succeed despite getting this error.
nsupdate -g -v nsupdate_commands

fetch_subsections is limited

Please change line 320 in file class.Sections.php from

try { $section = $this->Database->getObjectQuery("SELECT * FROM `sections` where `$method` = ? limit 1;", array($id)); }

to

try { $section = $this->Database->getObjectQuery("SELECT * FROM `sections` where `$method` = ?;", array($id)); }

The change is that i removed the limit on that line so all subsections are now displayed, which was limited to only the first that was being returned by the database.

Device type section

Hello,

could you insert device type information from(/administration/device-types/)
on the IP addresses dashboard.

Right now we use device type via devices. (/administration/devices/)

Thank you

HTTP Redirects invalid on alternative ports

Most clients send the port number as part of the host HTTP request, when you are using a non-standard port the installer or any other pages that use redirects fail to load because a second port number is appended to the URL.

Connecting to 10.0.1.1:81... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://10.0.1.1:81:81/?page=login&section=timeout [following]
http://10.0.1.1:81:81/?page=login&section=timeout: Bad port number.

Please update the createURL function to use the SERVER_NAME variable instead or remove the port check altogether as the port is already included.

discovery scan

Hi,

I would like to report the following error when there are multiple subnets to scan.
{"status":1,"error":"Didn't find any address to scan!"}

Thanks,

Ipam username with space

Hi Miha,

in which case the space is an invalid character for username?
In my case i have the ldap username with space: "name surname" and i need to bypass the "invalid characters check".

Thanks

Remove row on nameserver list

Is possible to add the remove button on single row of nameserver list?

Initial scan

Hi,

I would like to report issue for the initial scan. During the initial scan for either first or last bit of subnet (ex, 172.1.0.0/24 and 172.1.255.0/24). It will shows all the ip are live and add the record as "-- autodiscovered --"

Thanks,

[request] Duo Security 2FA

Hi,

A nice security feature would be support for Duo Security 2FA. They have a PHP class: https://github.com/duosecurity/duo_php and documents at https://www.duosecurity.com/docs/duoweb

Best wishes,
Rodehoed

Errors in widgets + changelog

Hi Miha,

A couple of small issues:

At some point between september 12th and now, the changelog has stopped showing changes ( /?page=tools&section=changelog ). Entries are shown under /?page=tools&section=logs so overall logging is working.

"Last 5 warning / error logs" widget on front page: Actual username missing in column 'username'

A couple of things regarding 'replace fields'

Replace fields ( /?page=administration&section=replace-fields ) only lets you replace some basic fields.
The list should also include all defined custom fields the administrator has created.

On a side note: Is 'switch' even used anymore? I think it can be deleted (listed under /?page=administration&section=filter-fields but is not shown under either subnets or ip addresses).

Request Development Outside of Master

I can see that the project is very active and that's great! Thank you for your time and work. But with all those changes stuff will happen. I would like to know that I could run from the Master branch without worrying about breaking my install. Could I request that separate branches are used for development so that master could always be expected to be "unbroken". Master may not be considered stable, but at least the changes have passed a few checks and user testing before being merged into master.

User credentials are sent to every registered administrator on creation

Hi,
I updated my testing environment to the latest dev release last week and I recognized the following issue:
The user's credentials will be sent to every administrator if I create another user.
So every admin will get the plain text password, username, mail address (and so on) of that newly created user via notification mail.
This happens if you check the "send notification" checkbox.
In version 1.1.010 this issue was already there but the admin who want to be able to receive this kind of information had to activate the notification via mail setting in this own profile.

At the moment we are migrating to phpipam and we are mainly using the VLAN management functionality without linking networks to the VLANs. In order to give the users the permission to see and manage the VLANs I had to grant administrator privileges to them.
It would be very nice to have the ability to control the permissions of VLANs or layer two domains for users and groups also.

If you need further information do not hesitate to contact me.

Discovery scan issues

Doesn't seem the subnet is getting passed correctly to the scan function for ping discovery. Tried both ping and fping methods. Getting {"status":1,"error":"Didn't find any address to scan!"}

Class 'database' not found in resolveIPaddresses.php

Running from current master branch.

PHP Fatal error: Class 'database' not found in /var/www/html/phpipam/functions/scripts/resolveIPaddresses.php on line 77

pingCheck and discoveryCheck scripts work fine.

Strange behaviour when Subnet is full

When subnet is full, you're not able to edit or erase any existing IP. It directs you to the first page of one of the sections created.

Enancement proposal

I want to propose the features for next releases and i wanted to understand what you think:

Like NAT module the Balancer mode: balanced service have virtual ip and linked ip.
Lifetime for IP address: the possibility to set lifetime and deleting using automatic status updates agent.
IP request state limitation: the possibility to limit the list of state selectable on ip request form.
Tag modification based on status: the possibility to change the IP tag using automatic status updates agent.
Adding Location for subnet: it would be useful to have the phisical location of network ( ex shop,wharehouse,office...).
Adding ISP data for subnet: it would be useful to associate a subnet to a specific ISP contract.
External plugin module: it would be useful to view extra field( ex from asset management).
Mail template: it would be useful to use a specific template for mail for integrate a ticket system ( ex for ip request).
Customer agent for update and scan: the possibility to add agent for use external inventory.

missing custom fields in layer two domain view

Custom fields are missing and replaced by slashes when viewing layer two domains.

Editing a subnet with a folder as mastersubnetID, hides the subnet from the webinterface

Hi Miha,

If you have a subnet which is a child of a folder and edit this subnet, then the masterSubnetId is reset to NULL even if you don't alter the parent.

The selected value for the folder is the 'greyed out' version which apparantly don't hold the value of the masterSubnetId. If you select the proper folder in the top of the dropdown, then everything works fine.

Br, Jonas

[request] granular filter and search options for standard and custom fields

Hi,
it would be very nice to apply filters for every kind of field on table, detail and search views in order to get granular filtering on the displayed data.
It would also be very nice to have the ability to sort every kind of field on table, detail and search view.

Small issues when having folders as Master subnet

If you have a folder as a master Subnet and look at subnets under a section, the link for the folder is pointed towards /?page=subnets&section=5&subnetId=295 instead of /?page=folder&section=5&subnetId=295

At the same time, if a subnet in a vrf has a folder as master subnet, then the error "Master subnet does not exist!" will show up under /?page=tools&section=vrf for each subnet which has a folder as the master subnet. And the Folder is not presented correctly in the overview on the tools -> vrf page.

Link for specific for tools -> vlan does not work

If you are under tools -> vlans -> show vlans for a specific domain, each created vlan has a link which points to "/?page=tools&section=vlan&subnetId=XXX"- this gives an error with "Invalid ID".

I expect the idea is to point to "/?page=tools&section=vlan&subnetId=X&sPage=XXX" where actual subnets for the specific vlan is shown.

Changelog not working

On an 'Upgraded' environment (from production version to development version), Changelog from IP Addresses stopped working.

All the past changelog is there, but when we do some update on any IP address no record is inserted :)

Sorry about opening so many issues, trying to help with this new release, as the API will bring to us a lot of improvements :)

Example documentation for nginx configuration for pretty urls

It might not be perfect, but the following could be used as documentation of how to run phpipam behind Nginx as an alternative to .htaccess configuration files.

This supports both the API and UI, and actually 'improves' the API slightly by not mandating a trailing slash on operations (eg /api/MyApp/subnets )

Note: Pretty URL's has to be enabled in the phpipam admin section to work correctly.

server {

  listen :80;
  server_name ipam.example.com;
  access_log  /var/log/nginx/ipam.access.log;
  keepalive_timeout 5;
  index index.php;

  # path for static files
  root /usr/share/phpipam;

  location /login {
    rewrite ^/login/dashboard/$ /dashboard/ redirect;
    rewrite ^/login/?$ /index.php?page=login last;
  }
  location /logout {
    rewrite ^/logout/dashboard/$ /dashboard/ redirect;
    rewrite ^/(.*)/?$ /index.php?page=$1 last;
  }
  location /tools {
    rewrite ^/tools/search/(.*)/(.*)/(.*)/(.*)$ /index.php?page=tools&section=search&addresses=$1&subnets=$2&vlans=$3&ip=$4 last;
    rewrite ^/(.*)/([^/]*)$ /index.php?page=$1&section=$2 last;
    rewrite ^/([^/]*)$ /index.php?page=$1 last;
  }

  location / {
    rewrite ^/(.*)/(.*)/(.*)/(.*)/(.*)/$ /index.php?page=$1&section=$2&subnetId=$3&sPage=$4&ipaddrid=$5 last;
    rewrite ^/(.*)/(.*)/(.*)/(.*)/$ /index.php?page=$1&section=$2&subnetId=$3&sPage=$4 last;
    rewrite ^/(.*)/(.*)/(.*)/$ /index.php?page=$1&section=$2&subnetId=$3 last;
    rewrite ^/(.*)/(.*)/$ /index.php?page=$1&section=$2 last;
    rewrite ^/(.*)/$ /index.php?page=$1 last;
  }

  location /api {
    rewrite ^/api/(.*)/(.*)/cidr/(.*)/(.*)/$ /api/index.php?app_id=$1&controller=$2&id=cidr&id2=$3&id3=$4 last;
    rewrite ^/api/(.*)/(.*)/cidr/(.*)/(.*) /api/index.php?app_id=$1&controller=$2&id=cidr&id2=$3&id3=$4 last;
    rewrite ^/api/(.*)/(.*)/(.*)/(.*)/(.*) /api/index.php?app_id=$1&controller=$2&id=$3&id2=$4&id3=$5 last;
    rewrite ^/api/(.*)/(.*)/(.*)/(.*) /api/index.php?app_id=$1&controller=$2&id=$3&id2=$4 last;
    rewrite ^/api/(.*)/(.*)/(.*) /api/index.php?app_id=$1&controller=$2&id=$3 last;
    rewrite ^/api/(.*)/(.*) /api/index.php?app_id=$1&controller=$2 last;
    rewrite ^/api/(.*) /api/index.php?app_id=$1 last;
  }


  location ~ \.php$ {
    root /usr/share/phpipam;
    try_files $uri =404;
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    include fastcgi_params;

    if ( $fastcgi_script_name ~ \..*\/.*php ) {
      return 403;
    }
  }
}

Do not display DB wizard when all is done in config.php

Hi,

I just cloned ''1.16.003'' and see that when I configure everything in config.php

$db['host'] = "<mysql_ip>";
$db['user'] = "root";
$db['pass'] = "<amazing-pw>";
$db['name'] = "phpipam";
$db['port'] = 3306;

the DB wizard is still displayed (first two steps), and I've to set again the properties.

It could be swapped if the user did it, but displayed if there are blank fields.

mail setting issue

Hi sir,
when i try to do mail setting ,select server type: smtp, and other configuration in this page i have already configured and verfied. click the send test email output the below error:

SMTP ERROR: Failed to connect to server: php_network_getaddresses: getaddrinfo failed: Name or service not known (0)
SMTP connect() failed.
Mailer Error: SMTP connect() failed.

please help,thank you!

subnet-scan-icmp-execute.php Error on ping discovery scan

Tried on two separate environments one migrated and one newly created when attempting a discovery scan on a subnet using ICMP and the default ping option. Within the GUI I receive Invalid JSON response - JSON_ERROR_SYNTAX and when I run the command from the CLI I see <div class='alert alert-danger'>Database error: SQLSTATE[HY000]: General error: 2006 MySQL server has gone away</div> repeated over and over. At the end of the run it does look like data is returned but obviously has issues converting to JSON. If I change the ping method over to fping everything works just fine with no errors from the gui.

Edit-page for subnets should reload if new section is selected

If you select a new section for a subnet, the values for nameservers and master subnets are not reloaded.

Of course you can just change section, hit save and reedit the subnet - but from an user perspective this should be doable in one edit session.

The option "Require user to change password after initial login" doesn't work

When I add a new user and check the option "Require user to change password after initial login", the user login in the system whithout change password.

Mass Import Feature Request

In order to import subnets I have had to create each folder and each subnet and then click on each subnet and import a single subnet at a time. It would be great if there were a mass import tool using CSV where I could specify all subnets and do one large import.

Thanks,

Clay Curtis

Issues regarding changelog

Hi Miha,

a couple of issues regarding the changelog feature;

1. When entries (eg. a subnet or an IP address) is deleted, then the entire changelog for the object is removed as well.The content in the changelog should be kept - otherwise the log is useless for auditing purposes :-)
2. changelog is not done for VLANs, l2-domains, devices or vrf's which are just as crucial as subnets, sections and ip addresses.

In a perfect world, changelog should also be done on nameservers and firewallzones, but the 4 points in 2) are the most important ones.

/Jonas

After LDAP-changes, ordinary users does not work

Hi Miha,

Can't figure this one out myself, but after the changes to LDAP-auth a local user cannot see any data at all after login. If the user is administrator, then everything works as normal.

The errorlogs throws this error so it's something about the User-variable which isn't being provisioned properly when logging in as an normal user.

PHP message: PHP Notice: Undefined variable: User in /opt/phpipam-test/app/dashboard/widgets/top10_hosts_v4.php on line 11" while reading response header from upstream, client: X.X.X.X, server: ipam-test.XX.XXX, request: "POST /app/dashboard/widgets/top10_hosts_v4.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php5-fpm.sock:", host: "ipam-test.XX.XXX", referrer: "http://ipam-test.XX.XXX/"

Resize subnet is broken on subnets not on the larger bit boundary

When you resize a subnet, if the smaller subnet being resized up puts it off the bit boundary, PHPIPAM will accept it, and present a subnet that is impossible to actually have.

An example, 10.0.4.0/22 is a valid subnet, having 10.0.4.0 -> 10.0.7.255

If you want to resize that into a larger range (in this case 10.0.0.0/21) and you attempt to resize 10.0.4.0/22, it creates 10.0.4.0/21 but thinks it has 10.0.4.0 -> 10.0.11.255 rather than automatically becoming 10.0.0.0/21, becoming an illegal subnet that crosses the boundary.

The IP calculator is aware of bit boundary and knows what the network should be if you put the old network and new CIDR mask in and it should be easy enough to put a check to put the new sized subnet through to pull the new network for it, then use that for the subnet. This would however break downsizing back, but i think thats fair enough to ensure strict subnet adherance.

Missing custom fields in table views

When adding custom fields, the custom fields for subnets and ip addresses are not shown on section overview (/?page=subnets&section=1) or subnet overview (/?page=subnets&section=1&subnetId=3) even that they are not marked as filtered.

The values are correctly shown in the detail view.

The table view for the rest (VLANs, devices, VRFs and users) are shown correctly with custom fields.

NetIQ LDAP integration

It makes sense to add integration with NetIQ LDAP Novel?
I need this ldap auth and if you want i make a pull request.

PHP warnings if there is no name server set configured

Hi

I upgraded to 1.18.009 today and recognized that if there is no name server set configured I will receive the following PHP warnings:
Warning: Invalid argument supplied for foreach() in /var/www/html/phpipam_dev/functions/classes/class.Sections.php on line 452
Warning: Invalid argument supplied for foreach() in /var/www/html/phpipam_dev/app/admin/subnets/edit-nameserver-dropdown.php on line 28
Warning: array_filter() expects parameter 1 to be array, null given in /var/www/html/phpipam_dev/app/admin/subnets/edit-nameserver-dropdown.php on line 39

Steps to reproduce:

1. Delete all name server sets.
2. Go to any section, open up a subnet detail popup.

Workaround:

1. Configure a name server set under Administration - Nameserver with the following settings:
   Name: Dummy (or any other name)
   Primary: 127.0.0.1
   Check all sections and save.

This will fill the variables so the errors won't show up.

Links from graph widgets don't obey "Prettify links" setting

Something I noticed before I had mod_rewrite correctly configured is that the click through from the graph widgets (e.g. "Top 10 IPv4 subnets by number of hosts") uses the pretty links which do not work.

Edit: had a look at this and not a simple thing to fix as these links are generated in JS. Might be better to default to non-pretty links though, for those few people not using them.

Wrong ip in 'manage ip request'

If a user requests a ip, which is not the first free ip in a subnet, the request is stored correctly in the database. But if the admin manages the ip request, the requested ip is the first free ip in the subnet again and not the ip from the database.

Import of data from RIPE DB does not work from edit subnet page

When trying to update subnet data from ripe, the following error appears:

Error: Subnet not present in RIPE DB
Error opening URL http://apps.db.ripe.net/whois/lookup/ripe/inetnum/.xml

(tested with 185.72.140.0/24 which is present in the database: https://apps.db.ripe.net/search/lookup.html?source=ripe&key=185.72.140.0%20-%20185.72.140.255&type=inetnum)

References to old SF project page

Hi Miha,

I just stumpled on the fact that you are still refering to the old SF project page in app/admin/version-check/index.php and app/footer.php. I could edit the footer.php but as you should decide how to handle the version check, I will just mention it here for your follow up.

/Jonas

Update content on phpipam.net and phpipam version 1.2

Hi Miha,

I think it would help new users a lot if the content on phpipam.net was updated to reflect actual status as content on sf.net is rather outdated. I'm willing to help if you would like this.

On a sidenote I would suggest rather soon to begin focusing on a 1.2 release as there has been a lot of changes, feature enhancements and new features since current stable. May I suggest a new branch which we could focus on bugfixing - or are there features which you would like to finish before making it formal release? Personally I would like to help do the proper testing of the release and help with documentation where needed.

Broken link to IP Addressing Guide

this is in v1.1rev010. I didn't see an issue here relating to it, but I'm not sure if it's reflected in your current code.

If (and only if) the browser is sized about 840px across (on my screen), so that the sections are broken out across the navbar, but the icons on the right (wrench, addressing guide) are condensed into a single 'Tools' menu, the link for the 'Show IP addressing guide' button is broken (it includes a trailing '/')

Everything appears to be fine on the http://demo.phpipam.net/ which is using pretty links. Can't test that in my environment at this time, however.

EDIT: I should add that this appears to be the only link that suffers from this.

Invalid id! with subnet greater than /24

Hi Miha,
we have a various /23, /22, and /21 subnet that can be scanned by phpipam via gui successfully but I am unable to add the discovered host, I am getting an invalid id! error.

thanks,

IP request form error

Fatal error: Call to undefined method Tools::fetch_settings() in app/login/request_ip_result.php on line 16

Bugs + comments in relation to import/export subnet

Hi Miha,

A couple of bugs and suggestions regarding import/export subnet. Some have been mentioned on the old SF maillist before but I expect they have gone 'out of sight, out of mind' :-)

Bugs:

• When doing export of subnet, the tag (ip state is not included in the export - "ip state rows are empty)
• When importing addresses in a subnet, the "ip state" value is not honored. Eg. if you write "Used" then the IP is marked "Offline" after the import has been done. The "State" value in the preview shows correctly "Used".
• Import window does not have a close or cancel button. You can on course just click outside the window but UI-wise a button would be nice.
• PTR + PTRignore + Switch values for subnets are not possible to import/export

A couple of suggestions:

• Switch the import/export logos - I see the arrow on the import button as data leaving the phpipam-application.
• Use the same naming for Tag/IP/IP state across WebUI and excel sheets
• Only make it possible to import/export values which are active as defined under Administration -> IP related management -> filter IP fields.

session_start(): Cannot send session cache limiter (index page /)

Under 'favourite subnets' in / (index)

This error shows;

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at htdocs/app/dashboard/widgets/favourite_subnets.php:10) in htdocs/functions/classes/class.User.php on line 110