Hacker News Reader

Comment by feylikurds | Hacker News Reader

Ewwww, that renewCerts.sh is pretty crappy. Who the hell is going to check the /var/log/letsencrypt/renew.log everyday to see if renewing failed?

Could not they do something nicer with systemd and email?

View on HN

The default behaviour of cron is to email the user if a job finishes with a non-zero exit code, which seems to apply here in case of renewal failure.

But is not the default account that it would email root? I run Debian and almost never log in as root. Would all admin sudoers receive the email?

http://www.cyberciti.biz/faq/linux-unix-crontab-change-mailt...

So the default behavior is to only email root unless crontab is edited, therefore most people would never receive an email (in case of renew failure), if they only followed the instructions given.

Otherwise mail is sent to the owner of the crontab.

If your server isn't set up to forward root's cron E-Mail to you you have bigger problems than your let's encrypt certs not renewing.

cron error reporting via email is an established solution. Why reinvent the wheel?

I'd agree that a hint regarding MAILTO= in the crontab file would be neat.

A properly administered Linux system would be emailing root mail to a real email address unless monitored by another system. I've never worked in a professional environment where root mail was left unread at any point. Root aliases (excluding environments with other monitoring) are on the checklist for any basic image(server) deployment. It's a standard, well-adopted practice.

Without judgment intended, as a Linux sysadmin you should absolutely be monitoring mail to root. That is the standard place to deliver error output from unattended processes. You can easily /etc/alias it to something else if that's more convenient.

Sysadmin/Devops here. I send all root mail to Graylog.

Graylog looks fantastic, thanks for the mention.

You'll love it. I'm pushing tens of thousands of messages per second into a cluster, and it works like a champ.

That does look nice. Thanks for Graylog reference.

Getting off-topic here, but whenever I do a new Debian build one of the items on my checklist is to edit /etc/aliases to add either my actual login user or a real email address (depending on the server setup) as an alias for root.

You are doing your Debian installs with debconf set way too high. I always set debconf to "low" but I am 99% positive this is a default question during installation.

Interesting. I'll try that next time. Thanks!

This sounds like a job for Dead Man's Snitch.

https://deadmanssnitch.com/

Reply on news.ycombinator.com