IPS scheduled reports ignore separate recipient settings

Security Intrusion Prevention
1

Core Update: 203

The IPFire WUI provides separate recipient fields for immediate IPS alerts,
daily reports, weekly reports and monthly reports.

The values are correctly stored in /var/ipfire/suricata/settings:

EMAIL_RECIPIENTS=alarm-ips@example.com

EMAIL_RECIPIENTS_REPORT_MONTHLY=report@example.com

However, /usr/bin/suricata-report-cron always uses:

for address in ${CONFIG[EMAIL_RECIPIENTS]}; do

Therefore all scheduled reports are sent to the immediate alert recipients.
The variables EMAIL_RECIPIENTS_REPORT_DAILY,
EMAIL_RECIPIENTS_REPORT_WEEKLY and
EMAIL_RECIPIENTS_REPORT_MONTHLY are not used by the script.

2

If you think this is a bug, it would be best to report it at www.ipfire.org - Bugzilla

3

An update was done to config/suricata/suricata-report-cron in the ipgire-2.x repo with the code to deal with the various email recipients but it was missed to copy that updated file to /usr/bin/ in the lfs file in the build process.

I, or someone else, will submit a patch to correct that.

https://bugzilla.ipfire.org/show_bug.cgi?id=14048