jails How do you deal with periodic summaries in jails?

DaLynX

DaLynX

Hello,

I am running two freebsd servers. One shared with friends, one personal. On each I have half a dozen of jails running for different services.

Until now, I never paid attention to periodic scripts and their emails. (I am still new and discovering freebsd.) I have set aliases on my most critical jail and see the daily emails. That's ok. But definitely not scalable. Setting the aliases and mail configs correctly everywhere would flood me with 20-30 emails per day...

How do you deal with this kind of numerical explosion of summary / periodic emails when using jails?
 
Edit /etc/periodic.conf & put in the right stuff.
I don't do security so i have in this file:
Code: 
daily_queuerun_enable="NO"                # Run mail queue
daily_status_include_submit_mailq="NO"            # Also submit queue
daily_status_security_enable="NO"            # Security check
daily_submit_queuerun="NO"                # Also submit queue
monthly_status_security_enable="NO"            # Security check
security_status_logincheck_enable="NO"
weekly_status_security_enable="NO"            # Security check
 
Alain De Vos said:
Edit /etc/periodic.conf & put in the right stuff.
I don't do security so i have in this file:
Code: 
daily_queuerun_enable="NO"                # Run mail queue
daily_status_include_submit_mailq="NO"            # Also submit queue
daily_status_security_enable="NO"            # Security check
daily_submit_queuerun="NO"                # Also submit queue
monthly_status_security_enable="NO"            # Security check
security_status_logincheck_enable="NO"
weekly_status_security_enable="NO"            # Security check
Click to expand...
I will check what I feel like I can remove to make it lighter. Thank you. Maybe I don't need a daily security email anyway. Monthly is likely enough.

Emrion said:
I have disabled periodic scripts in /etc/crontab for all my jails.
Click to expand...
That's quite extreme but sure.

Isn't there a way to make the host report on its jails, on an aggregated way? Having one message telling me package X on jail A and package Y on jail B are vulnerable would be more practical that having to go through every jail's report to check if something's wrong.
 
DaLynX said:
Isn't there a way to make the host report on its jails, on an aggregated way? Having one message telling me package X on jail A and package Y on jail B are vulnerable would be more practical that having to go through every jail's report to check if something's wrong.
Click to expand...
The host reports in its security daily periodic mail if one or more packages in all running jails have a security problem. I don't know if the jails userlands are checked.
 
Thanks I actually realized I only have jail emails set up. I just set them up on the host and will look at the output tomorrow to see if it's redundant and I can disable the jail ones.
 
DaLynX said:
Sorry but I don't see how that applies to my question.
Also, aren't those sendmail lines already in defaults nowadays?
Click to expand...
No, because many FreeBSD users treat their jails like a pet instead of cattle, so it is not desirable. In any case, it is not difficult to customize those things as I do with my jails.
 
If you can't (or won't) use mail, you can have periodic(8) write to log files instead.

Code: 
daily_output="/var/log/daily.log"
weekly_output="/var/log/weekly.log"
monthly_output="/var/log/monthly.log"

Code: 
# These options are used by periodic(8) itself to determine what to do
# with the output of the sub-programs that are run, and where to send
# that output.  $daily_output might be set to /var/log/daily.log if you
# wish to log the daily output and have the files rotated by newsyslog(8)
 
DaLynX said:
Thanks I actually realized I only have jail emails set up. I just set them up on the host and will look at the output tomorrow to see if it's redundant and I can disable the jail ones.
Click to expand...
Ok so I looked at the reports from the host. Unfortunately it does not "recurse into" the jails. So I guess it's either the 30 daily e-mails, or having them write to files, or just disabling them.

Thanks for the idea of writing to files and centralising them on the host with nullfs. Maybe I could just make a script that then merges these files into a single e-mail.
 
DaLynX said:
Ok so I looked at the reports from the host. Unfortunately it does not "recurse into" the jails. So I guess it's either the 30 daily e-mails, or having them write to files, or just disabling them.
Click to expand...
Strange. I took a long time to find where and how my jails are audited. I recall this appears after an update or an upgrade, but can't tell which, maybe in the 13.x era of my server.

The scripts are located in /usr/local/etc/periodic/security:
- 405.pkg-base-audit
Code: 
: ${security_status_baseaudit_enable:=YES}
: ${security_status_baseaudit_period:=daily}
: ${security_status_baseaudit_quiet:=NO}
: ${security_status_baseaudit_chroots=$pkg_chroots}
: ${security_status_baseaudit_jails=$pkg_jails}
: ${security_status_baseaudit_jails_ignore+=""}
: ${security_status_baseaudit_expiry:=2}


- 410.pkg-audit
Code: 
: ${security_status_pkgaudit_enable:=YES}
: ${security_status_pkgaudit_period:=daily}
: ${security_status_pkgaudit_quiet:=YES}
: ${security_status_pkgaudit_chroots=$pkg_chroots}
: ${security_status_pkgaudit_jails=$pkg_jails}
: ${security_status_pkgaudit_jails_ignore+=""}
: ${security_status_pkgaudit_expiry:=2}
: ${security_status_pkgaudit_expiration:=YES}
: ${security_status_pkgaudit_deprecation:=YES}

- 460.pkg-checksum
Code: 
: ${security_status_pkg_checksum_enable:=YES}
: ${security_status_pkg_checksum_period:=daily}
: ${security_status_pkg_checksum_chroots=$pkg_chroots}
: ${security_status_pkg_checksum_jails=$pkg_jails}

Maybe some of these vars are defined to NO on your machine, check it. Or $pkg_jails is empty for some reasons...
 
Oh yes, it was also in my periodic.conf. I put so many things inside that it escaped me:
Code: 
security_status_pkgaudit_enable="YES"
security_status_pkgaudit_jails="*"
So, it's probably not an update, but I who put, at some point, these lines.
 
Okay thanks for the confirmation.

I created the file and put pkg_jails="*" inside.

I'll see what that brings tomorrow morning! :)

Thanks a lot!
 
You must log in or register to reply here.
Back
Top