DAW/lazy-admin-tools

Fork 0

debian-health.sh: ufw check fails under cron PATH (false ERROR) #3

New issue

Closed

opened 2026-08-13 06:34:21 +02:00 by michael · 1 comment

michael commented

2026-08-13 06:34:21 +02:00

Owner

Goal

Harden the ufw status check in debian-health.sh so it works
regardless of cron's minimal PATH.

Reason

The cron run on typhon (2026-08-13 06:00) produced a direct cron
error mail:

line 63: ufw: command not found

and correspondingly a false alert in the actual health report:

[ERROR] ufw not active

Cause: cron sets a minimal PATH=/usr/bin:/bin (see X-Cron-Env in
the cron mail header). ufw typically lives under /usr/sbin/ufw
and was therefore not found by the cron job - even though ufw was
actually running (verified interactively via doas/sudo, see
DAW/lazy-admin-tools#1). The script produced a false ERROR alert
under cron as a result.

Scope

Switch the ufw call in the script to its full path
(/usr/sbin/ufw), or explicitly extend PATH at the top of the
script to include the sbin directories
Check whether the same risk applies to other commands used in the
script (ss, systemctl, apt), and harden them if needed
Verify via a real cron run (not just an interactive test with a
full PATH)

Cross-repository context

Affects health/debian-health.sh in DAW/lazy-admin-tools#1, surfaced
through production cron operation on typhon (DAW/infrastruktur).

Acceptance criteria

The ufw check works under cron's minimal PATH
No more false ERROR alerts when ufw is actually active
Verified via a real cron run (not just a manual test)

## Goal Harden the ufw status check in `debian-health.sh` so it works regardless of cron's minimal PATH. ## Reason The cron run on typhon (2026-08-13 06:00) produced a direct cron error mail: ``` line 63: ufw: command not found ``` and correspondingly a false alert in the actual health report: ``` [ERROR] ufw not active ``` Cause: cron sets a minimal `PATH=/usr/bin:/bin` (see `X-Cron-Env` in the cron mail header). `ufw` typically lives under `/usr/sbin/ufw` and was therefore not found by the cron job - even though ufw was actually running (verified interactively via `doas`/`sudo`, see DAW/lazy-admin-tools#1). The script produced a false ERROR alert under cron as a result. ## Scope - Switch the `ufw` call in the script to its full path (`/usr/sbin/ufw`), or explicitly extend `PATH` at the top of the script to include the sbin directories - Check whether the same risk applies to other commands used in the script (`ss`, `systemctl`, `apt`), and harden them if needed - Verify via a real cron run (not just an interactive test with a full PATH) ## Cross-repository context Affects `health/debian-health.sh` in DAW/lazy-admin-tools#1, surfaced through production cron operation on typhon (DAW/infrastruktur). ## Acceptance criteria - [ ] The `ufw` check works under cron's minimal PATH - [ ] No more false ERROR alerts when ufw is actually active - [ ] Verified via a real cron run (not just a manual test)

michael added the

labels

2026-08-13 06:34:21 +02:00

michael changed title from ~~debian-health.sh: ufw-Check schlaegt unter Cron-PATH fehl (false ERROR)~~ to debian-health.sh: ufw check fails under cron PATH (false ERROR)

2026-08-13 14:58:16 +02:00

michael commented

2026-08-13 14:59:29 +02:00

Author

Owner

Session 2026-08-13

[OK] Fix applied: explicit PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
set right after --- End configuration ---, so ufw (and other
sbin tools) are found even under cron's minimal PATH
[OK] Verified with env -i PATH=/usr/bin:/bin ... (simulated cron
PATH) on terrador
[OK] Verified via real cron runs on terrador and typhon - no more
'command not found', no more false [ERROR] ufw not active

## Session 2026-08-13 - [OK] Fix applied: explicit PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin set right after --- End configuration ---, so ufw (and other sbin tools) are found even under cron's minimal PATH - [OK] Verified with env -i PATH=/usr/bin:/bin ... (simulated cron PATH) on terrador - [OK] Verified via real cron runs on terrador and typhon - no more 'command not found', no more false [ERROR] ufw not active

michael

2026-08-13 14:59:30 +02:00

closed this issue
added
status
done
and removed
status
to-go
labels

michael referenced this issue from a commit

2026-08-13 15:01:48 +02:00

fix: harden ufw check against cron's minimal PATH

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

DAW/lazy-admin-tools#3

No description provided.

Rows
Columns