From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cb5kn22J6z30GB for ; Mon, 29 Sep 2025 16:10:25 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cb5kj6WZpz2xPP for ; Mon, 29 Sep 2025 16:10:21 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cb5kh3w99zct; Mon, 29 Sep 2025 16:10:20 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1759162220; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ejohQygpzH1CAIUJdW4RjEAqAM41LVEFRFzfyLrkuKs=; b=djM5PYNgj+tQUJhsWCPBkiHLssvfOd40fBexAb5YxSKFD1gxvc42B29Quxjb8k6sGEg7t5 Kxv1my+DAdVKQKDw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1759162220; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ejohQygpzH1CAIUJdW4RjEAqAM41LVEFRFzfyLrkuKs=; b=ksxydmYUO07Y2llJWfCWG8vEWLKf8ic3/2/uajB3fGWST1xDvvP+Dsfy0Gi2zCbcFg9p+0 cstKX2AqNRXJhmWbL/fSautg6VFrjlLLCgLk899Z9Lw/cCImnqNzAruN7HbzKYBbPzGy84 4PJkH5ZUDx0HF6gspo+NMtzVUKLNuqM3xqbgfOCj2I8+ihfSvKeWJezR68ns6woiTWlbeL Cpi41vXvmsD0jIb8A7XcgbNwp3NCB+KbgEJU/7n2QO5q5GhMqAXUarcKAHdJREwLu3j/hq eHQUep2KYku86efQwv+EVgJ8j4ldNME0hKGa1NntZptdbAhZqZWue3dRUFov/A== Message-ID: <88bd3c15-9f22-4f07-b129-07913654a927@ipfire.org> Date: Mon, 29 Sep 2025 18:10:17 +0200 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Subject: Re: CU198 Testing - first feedback on Suricata alert email sending To: Michael Tremer Cc: "IPFire: Development-List" References: <40cff986-5ded-4b11-8479-83393662b9f2@ipfire.org> <82147ae8-47c7-4556-885e-f7c18d335f51@ipfire.org> Content-Language: en-GB From: Adolf Belka In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi Michael, On 29/09/2025 17:44, Michael Tremer wrote: > Hello, > > Thanks for testing this. So let’s go through this step by step… > > First of all, is the companion daemon running? It is a process called suricata-reporter. I couldn't find it. Running ps aux | grep suricata showed suricata-watcher and suricata but no suricata-reporter. > > If so, can you check if the configuration file has emails enabled? It is in /var/ipfire/suricata/reporter.conf. Yes there is enabled = true in the [email] section. > > And finally, can you run “mailq” to see if the emails have been sent and maybe have bounced? Ran that command and got a load of stuff but I don't understand it all all. Here are just a few that were shown as examples ID : 1a0794.335a3b40 From : To : root -- ID : 1a078b.335a3b40 From : To : root -- ID : 1a078a.335a3b40 From : To : root -- ID : 1a0789.335a3b40 From : To : root -- ID : 1a0788.335a3b40 From : To : root -- I am also seeing the following in the dma logs 17:15:00 dma[1a0792.335a3b40]: local delivery deferred: can not create `/var/mail/root' 17:15:00 dma[1a0792.335a3b40]: error creating mbox `root' 17:15:00 dma[1a078c.335a3b40]: local delivery deferred: can not create `/var/mail/root' 17:15:00 dma[1a078c.335a3b40]: error creating mbox `root' 17:15:00 dma[1a078a.335a3b40]: local delivery deferred: can not create `/var/mail/root' 17:15:00 dma[1a078a.335a3b40]: error creating mbox `root' 17:15:00 dma[1a078e.335a3b40]: local delivery deferred: can not create `/var/mail/root' 17:15:00 dma[1a078e.335a3b40]: error creating mbox `root' 17:15:00 dma[1a078a.335a3b40]: cannot execute /usr/lib/dma-mbox-create: No such file or directory 17:15:00 dma[1a0788.335a3b40]: local delivery deferred: can not create `/var/mail/root' 17:15:00 dma[1a0788.335a3b40]: error creating mbox `root' 17:15:00 dma[1a0790.335a3b40]: local delivery deferred: can not create `/var/mail/root' 17:15:00 dma[1a0790.335a3b40]: error creating mbox `root' 17:15:00 dma[1a0792.335a3b40]: cannot execute /usr/lib/dma-mbox-create: No such file or directory 17:15:00 dma[1a078c.335a3b40]: cannot execute /usr/lib/dma-mbox-create: No such file or directory 17:15:00 dma[1a0792.335a3b40]: trying delivery 17:15:00 dma[1a078c.335a3b40]: trying delivery Regards, Adolf. > > -Michael > >> On 29 Sep 2025, at 13:58, Adolf Belka wrote: >> >> Forgot to mention, I pressed the test button on the Mail Service WUI page and immediately received the test mail message. >> >> I use a mail server I have running on my local network. >> >> Regards, >> >> Adolf. >> >> >> On 29/09/2025 14:52, Adolf Belka wrote: >>> Hi All, >>> I just ran the update for CU198 Testing on my vm systems. >>> The update itself went fine without any error messages or hiccups. >>> I then went to test the IPS emailing of alerts. >>> I used the same sender and recipient email addresses as I have specified on the Mail Service WUI page. >>> I set the alert severity to All, Including Informational Alerts. >>> I then followed the suricata testing process as defined in >>> https://docs.suricata.io/en/suricata-8.0.1/quickstart.html#alerting >>> and I ended up with alerts in the IPS-Logs but no email message received. >>> I checked the System logs for the mail system and there was no message trying to be sent. I ran the test 7 times, so ended up with 7 messages in the IPS-Logs. >>> I then checked the IPS system Logs and there was no mention of detecting the alerts and trying to send an email. >>> I ran the command tail -f /var/log/messages so I could see any additional log entries when I triggered the IPS alerts but again nothing was shown when I triggered the alerts, although the messages did end up in the IPS Logs section. >>> Regards, >>> Adolf. >> >> >