Project

General

Profile

Actions

Bug #11366

closed

Arpwatch Cron Notification every 15 minutes

Added by Abdul Khaliq almost 4 years ago. Updated almost 3 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Viktor Gurov
Category:
arpwatch
Target version:
-
Start date:
02/03/2021
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Affected Version:
2.4.5-p1
Affected Plus Version:
Affected Architecture:
amd64

Description

Every 15 mins or so I receive an email containing :

Subject Arpwatch Notification : Cron <root@firewall> /etc/rc.filter_configure_sync

X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>

0 addresses deleted.

In arpwatch settings everything is ticked

arpwatch 0.2.0_4

Once I remove the package I stop receiving the emails.

Actions #1

Updated by Viktor Gurov almost 4 years ago

  • Status changed from New to Rejected

You need to check "Disable Cron emails" option
see #10771

Actions #2

Updated by Abdul Khaliq almost 4 years ago

Viktor Gurov wrote:

You need to check "Disable Cron emails" option
see #10771

Option is already checked, I've also tried unchecking it but still same problem.

Actions #3

Updated by Adam French almost 4 years ago

Abdul Khaliq wrote:

Viktor Gurov wrote:

You need to check "Disable Cron emails" option
see #10771

Option is already checked, I've also tried unchecking it but still same problem.

I also have this same issue. Started happening a few days ago after I changed some firewall rules and hit apply.
I'm also on the same version too.
I have 2 pfSense machines in a HA cluster and I also started getting the emails from the secondary pfSense machine at hte same time too.
So this clearly had something to do with adding the extra firewall rules.

I ended up removing arpwatch off the secondary firewall and that stopped the emails I was getting.
The only thing I haven't done is try rebooting to see if that clears this issue.
I did try disabling arpwatch and re-enabling it again. That didn;t solve the problem.
And i've also tried reinstalling arpwatch too, and that also didn;t make a difference.

Actions #4

Updated by Abdul Khaliq almost 4 years ago

Adam French wrote:

Abdul Khaliq wrote:

Viktor Gurov wrote:

You need to check "Disable Cron emails" option
see #10771

Option is already checked, I've also tried unchecking it but still same problem.

I also have this same issue. Started happening a few days ago after I changed some firewall rules and hit apply.
I'm also on the same version too.
I have 2 pfSense machines in a HA cluster and I also started getting the emails from the secondary pfSense machine at hte same time too.
So this clearly had something to do with adding the extra firewall rules.

I ended up removing arpwatch off the secondary firewall and that stopped the emails I was getting.
The only thing I haven't done is try rebooting to see if that clears this issue.

I rebooted my system, then installed and rebooted again but that didn't help. I also have 2.5.0RC installed and it does it on that as well.

Actions #5

Updated by Edward Thomas over 3 years ago

I found the bug in arpwatch.

The bug is in the file: /usr/local/arpwatch/sendmail_proxy.php

In the statement:
...
if ((false !== $message) && ((false === strpos($message, ': Cron ')) ||
($config['installedpackages']['arpwatch']['config'][0]['cron_disable'] != 'on'))) {
...

The key at 'cron_disable' is incorrect. The correct value should be, 'disable_cron'

The global_config shows 'disable_cron' as the correct key name.

I've tested it and I no longer get a useless email every time my Suricata cron script runs daily.

Actions #6

Updated by Abdul Khaliq over 3 years ago

Thanks, your fix seems to have done the job, I haven't received any useless emails so far.

Edward Thomas wrote:

I found the bug in arpwatch.

The bug is in the file: /usr/local/arpwatch/sendmail_proxy.php

In the statement:
...
if ((false !== $message) && ((false === strpos($message, ': Cron ')) ||
($config['installedpackages']['arpwatch']['config'][0]['cron_disable'] != 'on'))) {
...

The key at 'cron_disable' is incorrect. The correct value should be, 'disable_cron'

The global_config shows 'disable_cron' as the correct key name.

I've tested it and I no longer get a useless email every time my Suricata cron script runs daily.

Actions #7

Updated by Jim Pingle over 3 years ago

  • Status changed from Rejected to New
Actions #9

Updated by Jim Pingle over 3 years ago

  • Status changed from New to Pull Request Review
Actions #10

Updated by Edward Thomas over 3 years ago

Just checking on the status of this. I updated to the latest version of pfSense, 2.5.1-RELEASE (amd64), and it reverted to the incorrect 'sendmail_proxy.php' file. I had to re-apply the fix.

Will this fix eventually make it to production?

Thank you.

Actions #11

Updated by Renato Botelho over 3 years ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Viktor Gurov

PR has been merged. Thanks!

Actions #12

Updated by aleksei prokofiev almost 3 years ago

I've checked on 2.5.2 and I see correct value 'disable cron' in /usr/local/arpwatch/sendmail_proxy.php

if ((false !== $message) && ((false === strpos($message, ': Cron ')) ||
($config['installedpackages']['arpwatch']['config'][0]['disable_cron'] != 'on')))

Actions #13

Updated by Jim Pingle almost 3 years ago

  • Status changed from Feedback to Resolved
Actions

Also available in: Atom PDF