From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cbXZc1hMnz2ynT for ; Tue, 30 Sep 2025 09:19:52 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cbXZX5mBKz2xP7 for ; Tue, 30 Sep 2025 09:19:48 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cbXZV0YjFz1Gh; Tue, 30 Sep 2025 09:19:45 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1759223987; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mmVHGxlociNJvD+JO5pmVaeksQcEbzxl/QbjFZt7cf0=; b=uQ5obtd97rV2sCMftFy4F6ZrlcTTozWzqlAV+Tvyk4CNyCG5QNPYncQ+v67H70YXizWVKi +wbZJfTMSm2jnPBw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1759223987; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mmVHGxlociNJvD+JO5pmVaeksQcEbzxl/QbjFZt7cf0=; b=J7mI/vmtCBrYrAdiv6hf7F/Tmm9Ao//I79XrsFqMg5txduXp5GxOtryBAz1vzBB2cAhRaI Q1BuOOe6j4D5IQShzWYoENfLezSBfL5OW3u0/u7oIs526GNkNoCC77fTW8rcZRJ/3ohkV6 cN69OcIN4umroZRmlNiN+Ozy8ZBQINFgwN1od5XfPaKttpgWVSQMjvHDsnBnP8f/TWxdy9 XITfsiNgsufV+pR4LD6Bg7x6DLKmhW/LR/o5GXXh0yIARXudBcmWAwkIZOFeSsJCj9rlON dkqg0uxIzTtQHYBDFoTwBgWD9EkwmPnNz+NMcQrleciv78sC7TJC2iSxHK6VBw== Content-Type: text/plain; charset=utf-8 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: Mime-Version: 1.0 Subject: Re: CU198 Testing - first feedback on Suricata alert email sending From: Michael Tremer In-Reply-To: <841e4d71-af73-43be-9c01-609b7205411e@ipfire.org> Date: Tue, 30 Sep 2025 10:19:42 +0100 Cc: "IPFire: Development-List" Content-Transfer-Encoding: quoted-printable Message-Id: References: <40cff986-5ded-4b11-8479-83393662b9f2@ipfire.org> <82147ae8-47c7-4556-885e-f7c18d335f51@ipfire.org> <88bd3c15-9f22-4f07-b129-07913654a927@ipfire.org> <1cd07b64-14d6-43d8-9a8c-8832f4d16e63@ipfire.org> <841e4d71-af73-43be-9c01-609b7205411e@ipfire.org> To: Adolf Belka Hallo Adolf, You can simply remove any files in /var/spool/dma and make sure that = there are no sendmail processes running any more. Regarding why the reporter is not sending any emails, we might need to = dig deeper. If you kill the reporter when it is running as usual, you can start it = again in debug mode where it will stay in foreground and will log to the = console what it is doing. Maybe that will tell us a little bit more. = Launch it again like this: suricata-reporter --config=3D/var/ipfire/suricata/reporter.conf -vvv If you then trigger an alert, you should see some activity there and = hopefully some problem as well if the email cannot be sent. Best, -Michael > On 29 Sep 2025, at 17:50, Adolf Belka wrote: >=20 > Further info on the mailq stuff. >=20 > I went to /var/spool/dma/ and read the contents of some of the files = there. Basically they are related to a problem with arpwatch and nothing = to do with suricata-reporter. >=20 > I will need to separately try and figure out what is happening to = cause those. There are 13 entries in the dma directory, all with the = same date/time and I checked three different entries and they were all = related to arpwatch. >=20 > Regards, >=20 > Adolf. >=20 > On 29/09/2025 18:37, Adolf Belka wrote: >> Without any new alerts being triggered by the IPS the dma logs showed = more of those messages about error creating mbox root. >> I then triggered some more alerts in IPS and no new dma messages were = seen. >> I also checked the mailq output before and after triggering the = alerts and there were no additional entries compared to previously. >> Regards, >> Adolf. >> On 29/09/2025 18:10, Adolf Belka wrote: >>> Hi Michael, >>>=20 >>>=20 >>> On 29/09/2025 17:44, Michael Tremer wrote: >>>> Hello, >>>>=20 >>>> Thanks for testing this. So let=E2=80=99s go through this step by = step=E2=80=A6 >>>>=20 >>>> First of all, is the companion daemon running? It is a process = called suricata-reporter. >>>=20 >>> I couldn't find it. Running ps aux | grep suricata showed = suricata-watcher and suricata but no suricata-reporter. >>>=20 >>>>=20 >>>> If so, can you check if the configuration file has emails enabled? = It is in /var/ipfire/suricata/reporter.conf. >>>=20 >>> Yes there is enabled =3D true in the [email] section. >>>=20 >>>>=20 >>>> And finally, can you run =E2=80=9Cmailq=E2=80=9D to see if the = emails have been sent and maybe have bounced? >>>=20 >>> Ran that command and got a load of stuff but I don't understand it = all all. >>>=20 >>> Here are just a few that were shown as examples >>>=20 >>> ID : 1a0794.335a3b40 >>> =46rom : >>> To : root >>> --=20 >>> ID : 1a078b.335a3b40 >>> =46rom : >>> To : root >>> --=20 >>> ID : 1a078a.335a3b40 >>> =46rom : >>> To : root >>> --=20 >>> ID : 1a0789.335a3b40 >>> =46rom : >>> To : root >>> --=20 >>> ID : 1a0788.335a3b40 >>> =46rom : >>> To : root >>> --=20 >>>=20 >>> I am also seeing the following in the dma logs >>>=20 >>> 17:15:00 dma[1a0792.335a3b40]: local delivery deferred: can not = create `/var/mail/root' >>> 17:15:00 dma[1a0792.335a3b40]: error creating mbox `root' >>> 17:15:00 dma[1a078c.335a3b40]: local delivery deferred: can not = create `/var/mail/root' >>> 17:15:00 dma[1a078c.335a3b40]: error creating mbox `root' >>> 17:15:00 dma[1a078a.335a3b40]: local delivery deferred: can not = create `/var/mail/root' >>> 17:15:00 dma[1a078a.335a3b40]: error creating mbox `root' >>> 17:15:00 dma[1a078e.335a3b40]: local delivery deferred: can not = create `/var/mail/root' >>> 17:15:00 dma[1a078e.335a3b40]: error creating mbox `root' >>> 17:15:00 dma[1a078a.335a3b40]: cannot execute = /usr/lib/dma-mbox-create: No such file or directory >>> 17:15:00 dma[1a0788.335a3b40]: local delivery deferred: can not = create `/var/mail/root' >>> 17:15:00 dma[1a0788.335a3b40]: error creating mbox `root' >>> 17:15:00 dma[1a0790.335a3b40]: local delivery deferred: can not = create `/var/mail/root' >>> 17:15:00 dma[1a0790.335a3b40]: error creating mbox `root' >>> 17:15:00 dma[1a0792.335a3b40]: cannot execute = /usr/lib/dma-mbox-create: No such file or directory >>> 17:15:00 dma[1a078c.335a3b40]: cannot execute = /usr/lib/dma-mbox-create: No such file or directory >>> 17:15:00 dma[1a0792.335a3b40]: trying delivery >>> 17:15:00 dma[1a078c.335a3b40]: trying delivery >>>=20 >>> Regards, >>>=20 >>> Adolf. >>>=20 >>>>=20 >>>> -Michael >>>>=20 >>>>> On 29 Sep 2025, at 13:58, Adolf Belka = wrote: >>>>>=20 >>>>> Forgot to mention, I pressed the test button on the Mail Service = WUI page and immediately received the test mail message. >>>>>=20 >>>>> I use a mail server I have running on my local network. >>>>>=20 >>>>> Regards, >>>>>=20 >>>>> Adolf. >>>>>=20 >>>>>=20 >>>>> On 29/09/2025 14:52, Adolf Belka wrote: >>>>>> Hi All, >>>>>> I just ran the update for CU198 Testing on my vm systems. >>>>>> The update itself went fine without any error messages or = hiccups. >>>>>> I then went to test the IPS emailing of alerts. >>>>>> I used the same sender and recipient email addresses as I have = specified on the Mail Service WUI page. >>>>>> I set the alert severity to All, Including Informational Alerts. >>>>>> I then followed the suricata testing process as defined in >>>>>> = https://docs.suricata.io/en/suricata-8.0.1/quickstart.html#alerting >>>>>> and I ended up with alerts in the IPS-Logs but no email message = received. >>>>>> I checked the System logs for the mail system and there was no = message trying to be sent. I ran the test 7 times, so ended up with 7 = messages in the IPS-Logs. >>>>>> I then checked the IPS system Logs and there was no mention of = detecting the alerts and trying to send an email. >>>>>> I ran the command tail -f /var/log/messages so I could see any = additional log entries when I triggered the IPS alerts but again nothing = was shown when I triggered the alerts, although the messages did end up = in the IPS Logs section. >>>>>> Regards, >>>>>> Adolf. >>>>>=20 >>>>>=20 >>>>=20 >>>=20 >=20 >=20