Bug 490284 - Rkhunter and ssmtp no log
Rkhunter and ssmtp no log
Status: CLOSED WORKSFORME
Product: Fedora
Classification: Fedora
Component: rkhunter (Show other bugs)
rawhide
i586 Linux
low Severity medium
: ---
: ---
Assigned To: Kevin Fenzi
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-03-14 15:27 EDT by Frank Murphy
Modified: 2009-04-06 22:49 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-04-06 22:49:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Frank Murphy 2009-03-14 15:27:55 EDT
Description of problem: Rkhunter doesn't forward log, when used with ssmtp


Version-Release number of selected component (if applicable):
rkhunter-1.3.4-5.fc11.noarch
ssmtp-2.61-11.9.fc11.i586



How reproducible: Always


Steps to Reproduce:
1. yum erase sendmail exim posetfix
2. yum install ssmtp
3.
  
Actual results: No log in mailbox


Expected results: log forwarded


Additional info: Not too sure who is the exaxt culprit, but as both logwatch and cron stuff, is forwarded by ssmtp, figured maybe rkh. (XFCE 4.6 rawhide)
Comment 1 Kevin Fenzi 2009-03-14 18:49:10 EDT
rkhunter doesn't do anything strange here, it just calls /bin/mail and sends to 'root@localhost' perhaps the localhost is confusing it? Can you look in any ssmtp logs?

Can you try manually sending to root@localhost?
Comment 2 Kevin Fenzi 2009-03-20 20:11:30 EDT
Any news here?
Comment 3 Frank Murphy 2009-03-22 04:34:52 EDT
(In reply to comment #2)
> Any news here?  

Apologies, out of town (zero internet access, rural Ireland)

Ok, sinceo leaving\coming-back Rawhide box has stopped sending logs period.

On Fedora 10, updated to the Rkhunter, 
the most recent rkhunter-1.3.4-5.fc11.noarch.

No logs,comint through for it. rkhunter.log is still being generated.
No specific mention of rkhunter in maillog
No specific ssmtp.log, which appears to be normal.
No avc denials on F10\Rawhide re. anything.
This may be a bit beyond me, I might put it out to the test-list,
to see can anyone (more knowledgeable) can re-create.
Comment 4 Kevin Fenzi 2009-03-22 14:36:58 EDT
> Apologies, out of town (zero internet access, rural Ireland)

No worries at all. ;) 

> Ok, sinceo leaving\coming-back Rawhide box has stopped sending logs period.

So you get no emails at all from ssmtp?
Try mailing 'root@localhost'? does that go through?

> On Fedora 10, updated to the Rkhunter, 
> the most recent rkhunter-1.3.4-5.fc11.noarch.

> No logs,comint through for it. rkhunter.log is still being generated.

Are there any warnings being generated by rkhunter? If there are no warnings, it does not send any email, only if it has a warning or error. 

> No specific mention of rkhunter in maillog

Well, it would just be a mail to 'root@localhost' at the time the daily cron jobs run. 
It would be going to whatever email address you have ssmtp setup to send to. 

> No specific ssmtp.log, which appears to be normal.
>No avc denials on F10\Rawhide re. anything.
>This may be a bit beyond me, I might put it out to the test-list,
>to see can anyone (more knowledgeable) can re-create.  

ok. I can try install ssmtp here as well...
Comment 5 Frank Murphy 2009-03-22 16:07:34 EDT
This a snip from the F10 Box today:

10:27:42] The system checks took: 14 minutes and 11 seconds
[10:27:42]
[10:27:42] Info: End date is Sun Mar 22 10:27:42 GMT 2009

--------------------- Start Rootkit Hunter Update ---------------------
[ Rootkit Hunter version 1.3.4 ]

Checking rkhunter data files...
  Checking file mirrors.dat                                  [ No update ]
  Checking file programs_bad.dat                             [ No update ]
  Checking file backdoorports.dat                            [ No update ]
  Checking file suspscan.dat                                 [ No update ]
  Checking file i18n/cn                                      [ No update ]
  Checking file i18n/de                                      [ No update ]
  Checking file i18n/en                                      [ No update ]
  Checking file i18n/zh                                      [ No update ]
  Checking file i18n/zh.utf8                                 [ No update ]

---------------------- Start Rootkit Hunter Scan ----------------------
Warning: The file '/usr/sbin/xinetd' exists on the system, but it is not present in the rkhunter.dat file.

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter/rkhunter.log)

----------------------- End Rootkit Hunter Scan -----------------------

Warning, I will let you know tomorrow, if it comes through. Hasn't as yet. at 20.07 Irish Time
Comment 6 Kevin Fenzi 2009-03-23 14:06:40 EDT
Can you attach your /etc/ssmtp/ssmtp.conf file?
I just tested it here and it works fine for me. 

There is also a: 
Debug=YES
at the end of the ssmtp.conf file, can you comment that in and try it?
Comment 7 Frank Murphy 2009-03-24 04:04:43 EDT
Moved Debug=YES to top of ssmtp.conf 
Looking back over your comments #1 did the following:

--------------
rkhunter.conf


MAIL-ON-WARNING="root"
--------------

F10 box
I now got a warning mail  as per Comment #5.

Rawhide
No Joy as yet.
Comment 8 Frank Murphy 2009-03-30 12:47:59 EDT
Wiped the rawhide box, reinstalled from:
http://ftp.heanet.ie/pub/fedora/linux/development/i386/os/images/boot.iso  27-Mar-2009 10:10  167M

Got this in from isp:
The following message to <root@localhost> was undeliverable.
The reason for the problem:
5.1.1 - Bad destination email address 'invalid domain "localhost": no dot found'

Reporting-MTA: dns; mail2.u.tv

Final-Recipient: rfc822;root@localhost
Action: failed
Status: 5.0.0 (permanent failure)
Diagnostic-Code: smtp; 5.1.1 - Bad destination email address 'invalid domain "localhost": no dot found' (delivery attempts: 0)

After changing rkhunter.conf report to "root", all systems go.

PS: Like the new XFCE style
Comment 9 Kevin Fenzi 2009-04-01 23:31:11 EDT
ok, Whats does: 

grep root /etc/ssmtp/ssmtp.conf 

Show? 

That should be your email address that you want it to send all root email to. 

This looks like a smtp config issue more than a rkhunter one. 
I guess I could change rkhunter to mail to 'root', but that could give an unexpected result in some cases where people are expecting it to go to localhost.
Comment 10 Frank Murphy 2009-04-04 04:00:14 EDT
(In reply to comment #9)
> ok, Whats does: 
> 
> grep root /etc/ssmtp/ssmtp.conf 
> 

root=logs@myispemail.com (my central logging addy)

> Show? 
> 
> That should be your email address that you want it to send all root email to. 
> 
> This looks like a smtp config issue more than a rkhunter one. 
> I guess I could change rkhunter to mail to 'root', but that could give an
> unexpected result in some cases where people are expecting it to go to
> localhost.  

At this stage would agree.
But if other come across this problem it, there's at least a rough hack.
Maybe close it?
Comment 11 Kevin Fenzi 2009-04-06 22:49:30 EDT
I'm happy to close this if you are satisfied that it's working now. ;) 

Feel free to re-open it or file a new one if you spot anything else.

Note You need to log in before you can comment on or make changes to this bug.