Any mail from the pfsense appliance has "Arpwatch Notification" in the subject line, even when it is from a completely different package

lightningbit

Hi,

is anyone experiencing the same?

Most mail from the pfsense appliance has "Arpwatch Notification" in the subject line, even when it is from a completely different package, and even when the Arpwatch service itself is disabled.

for example, mails generated from following cron actions :
/usr/local/bin/mail_reports_generate.php
/etc/rc.filter_configure_sync

examples os subject lines :
xxx.local - Arpwatch Notification : Cron root@xxx /usr/local/bin/mail_reports_generate.php
xxx.local - Arpwatch Notification : Cron root@xxx /usr/local/bin/speedtest --csv >> /usr/local/www/speedtestloganyserver.csv
xxx.local - Arpwatch Notification : Cron root@xxx /etc/rc.filter_configure_sync

it happens on a freshly installed box (2.5.x) and and older box (2.4.x)

I assume this is a bug? or is there another way to fix this?

lightningbit

Following the rules, I'm supposed to wait until someone answers here before reporting it as a bug?
But without any answers, ... I can't keep waiting, so I'll report it to the pfsense redmine.

NollipfSense

@lightningbit said in Any mail from the pfsense appliance has "Arpwatch Notification" in the subject line, even when it is from a completely different package:

Following the rules

That would include searching the forum ... there was a recent post with someone else experiencing similar issue.

lightningbit

@nollipfsense
Hi, I did do a search on this forum, the only other posts on similar issues I found when searching for "arpwatch+mail" dated from 2019 or before, without answers.
(and 1 other one from myself about an error in the node-exporter package, also without replies)

NollipfSense

@lightningbit Well, it must be yours that I saw 12days ago ... carry on with your original plan.

Gertjan

@lightningbit

I've installed Arpwatch - and found the issue.

During installation, a XML record is created :

This is the 'off' state.

Or, the code references this check box like :
'cron_disable' instead of 'disable_cron.'

here : line 236 : /usr/local/pkg/arpwatch.inc

   ($config['installedpackages']['arpwatch']['config'][0]['cron_disable'] != 'on'))) {

Change this to

   ($config['installedpackages']['arpwatch']['config'][0]['disable_cron'] != 'on'))) {

edit 2021-06-03 : the next isn't needed. Just the first one (above) and do Save on the aprwatch settings page. The file /usr/local/arpwatch/sendmail_proxy.php will get regenerated.

Change also this file :

/usr/local/arpwatch/sendmail_proxy.php :
Line 12 :

   ($config['installedpackages']['arpwatch']['config'][0]['cron_disable'] != 'on'))) {

into

   ($config['installedpackages']['arpwatch']['config'][0]['disable_cron'] != 'on'))) {

During installation, a small PHP file is created, "/usr/local/arpwatch/sendmail_proxy.php" that is sym linked to /usr/sbin/sendmail .... ( ugly ...) because 'arpwatch' takes an email adress on the commande line :

13720  -  Ss       0:00.06 /usr/local/sbin/arpwatch -N -z -Z -f /usr/local/arpwatch/arp_em1.dat -i em1 -w is.this@used.or.not

The 'arpwatch' process uses the famous '/usr/sbin/sendmail' which is symlinked from our /usr/local/arpwatch/sendmail_proxy.php, crated by the package arpwatch during installation.
This special version should test if the captured output of a PHP-cron task is from the 'arpwatch' process, or some other cron task.
That test fails, everything - all "PHP crons outputs" are captured and send as a mail.

So, this option should be set :

and now the state is reflected in the config :

and the test will exclude PHP cron messages.

I'll have these edits in place right now. I'll test.
Maybe some fiddling with && and || are still needed.
I'll edit if needed.

Btw :
From what I see, this mail address isn't used:

as the mail set up under System > Advanced > Notifications is used.

Gertjan

@lightningbit said in Any mail from the pfsense appliance has "Arpwatch Notification" in the subject line, even when it is from a completely different package:

I assume this is a bug? or is there another way to fix this?

The issue is already known, and a solution is in the pipeline : read https://redmine.pfsense.org/issues/11366