15 ms·

Ewwww, that renewCerts.sh is pretty crappy. Who the hell is going to check the /var/log/letsencrypt/renew.log everyday to see if renewing failed? Could not the

Ewwww, that renewCerts.sh is pretty crappy. Who the hell is going to check the /var/log/letsencrypt/renew.log everyday to see if renewing failed? Could not they do something nicer with systemd and email?

pfg 11y ago
The default behaviour of cron is to email the user if a job finishes with a non-zero exit code, which seems to apply here in case of renewal failure.
- feylikurds 11y ago
  But is not the default account that it would email root? I run Debian and almost never log in as root. Would all admin sudoers receive the email?
  - gshulegaard 11y ago
    http://www.cyberciti.biz/faq/linux-unix-crontab-change-mailto-settings/ http://www.cyberciti.biz/faq/linux-unix-crontab-change-mailt...
    - feylikurds 11y ago
      So the default behavior is to only email root unless crontab is edited, therefore most people would never receive an email (in case of renew failure), if they only followed the instructions given. Otherwise mail is sent to the owner of the crontab.
      - avar 11y ago
        If your server isn't set up to forward root's cron E-Mail to you you have bigger problems than your let's encrypt certs not renewing.
      - pfg 11y ago
        cron error reporting via email is an established solution. Why reinvent the wheel? I'd agree that a hint regarding MAILTO= in the crontab file would be neat.
      - NovaS1X 11y ago
        A properly administered Linux system would be emailing root mail to a real email address unless monitored by another system. I've never worked in a professional environment where root mail was left unread at any point. Root aliases (excluding environments with other monitoring) are on the checklist for any basic image(server) deployment. It's a standard, well-adopted practice.
  - jcrawfordor 11y ago
    Without judgment intended, as a Linux sysadmin you should absolutely be monitoring mail to root. That is the standard place to deliver error output from unattended processes. You can easily /etc/alias it to something else if that's more convenient.
    - toomuchtodo 11y ago
      Sysadmin/Devops here. I send all root mail to Graylog.
      - StavrosK 11y ago
        Graylog looks fantastic, thanks for the mention.
        toomuchtodo 10y ago
        You'll love it. I'm pushing tens of thousands of messages per second into a cluster, and it works like a champ.
      - nickpsecurity 10y ago
        That does look nice. Thanks for Graylog reference.
  - cdubzzz 11y ago
    Getting off-topic here, but whenever I do a new Debian build one of the items on my checklist is to edit /etc/aliases to add either my actual login user or a real email address (depending on the server setup) as an alias for root.
    - dfc 11y ago
      You are doing your Debian installs with debconf set way too high. I always set debconf to "low" but I am 99% positive this is a default question during installation.
      - cdubzzz 10y ago
        Interesting. I'll try that next time. Thanks!
a-priori 11y ago
This sounds like a job for Dead Man's Snitch. https://deadmanssnitch.com/ https://deadmanssnitch.com/

pfg 11y ago

The default behaviour of cron is to email the user if a job finishes with a non-zero exit code, which seems to apply here in case of renewal failure.

feylikurds 11y ago
But is not the default account that it would email root? I run Debian and almost never log in as root. Would all admin sudoers receive the email?
- gshulegaard 11y ago
  http://www.cyberciti.biz/faq/linux-unix-crontab-change-mailto-settings/ http://www.cyberciti.biz/faq/linux-unix-crontab-change-mailt...
  - feylikurds 11y ago
    So the default behavior is to only email root unless crontab is edited, therefore most people would never receive an email (in case of renew failure), if they only followed the instructions given. Otherwise mail is sent to the owner of the crontab.
    - avar 11y ago
      If your server isn't set up to forward root's cron E-Mail to you you have bigger problems than your let's encrypt certs not renewing.
    - pfg 11y ago
      cron error reporting via email is an established solution. Why reinvent the wheel? I'd agree that a hint regarding MAILTO= in the crontab file would be neat.
    - NovaS1X 11y ago
      A properly administered Linux system would be emailing root mail to a real email address unless monitored by another system. I've never worked in a professional environment where root mail was left unread at any point. Root aliases (excluding environments with other monitoring) are on the checklist for any basic image(server) deployment. It's a standard, well-adopted practice.
- jcrawfordor 11y ago
  Without judgment intended, as a Linux sysadmin you should absolutely be monitoring mail to root. That is the standard place to deliver error output from unattended processes. You can easily /etc/alias it to something else if that's more convenient.
  - toomuchtodo 11y ago
    Sysadmin/Devops here. I send all root mail to Graylog.
    - StavrosK 11y ago
      Graylog looks fantastic, thanks for the mention.
      - toomuchtodo 10y ago
        You'll love it. I'm pushing tens of thousands of messages per second into a cluster, and it works like a champ.
    - nickpsecurity 10y ago
      That does look nice. Thanks for Graylog reference.
- cdubzzz 11y ago
  Getting off-topic here, but whenever I do a new Debian build one of the items on my checklist is to edit /etc/aliases to add either my actual login user or a real email address (depending on the server setup) as an alias for root.
  - dfc 11y ago
    You are doing your Debian installs with debconf set way too high. I always set debconf to "low" but I am 99% positive this is a default question during installation.
    - cdubzzz 10y ago
      Interesting. I'll try that next time. Thanks!

a-priori 11y ago

This sounds like a job for Dead Man's Snitch. https://deadmanssnitch.com/ https://deadmanssnitch.com/