We have had monthly scans using GVM to find vulnerabilities in our infrastructure. These scans are then sent as emails which are configured to attach a PDF report including the vulnerabilities.
For the first few months this worked perfectly, but all of a sudden the PDF reports have stopped being attached.
If I run a scan on a single target and use the same alert configurations, the PDF is attached, but it has stopped being attached when using a bigger group of targets.
Not sure if anyone has experienced this, but I am stuck and would appreciate any help
Just a note that I have moved this post to the appropriate category since the issue is not related to scanning or scan configuration. Also, please don’t post screenshots of terminal output or code. The Start Here guide is a good place to understand how to format text for the forum. Thanks kindly
I think you will need to enable debug level error output to see if there are any failures during the sendmail command. You will find loggging config files in the /etc/gvm directory. To enable debug, open the gvmd_log.conf file and set the logging levels to 128. I think the [manage] level is the only one you need to escalate for this issue, but if that doesn’t work, raise all evels using the [*] at the very bottom.
You can also check the logs from the mail transfer agent application you have configured.
Hi There, sorry for my incorrect formatting in my previous reply. I increased the logging level to 128 for management but didn’t see any difference in the logs. I am going to try and dig out the logs for the mail transfer agent.
I did however notice that if the report is short enough that it doesn’t get truncated then the PDF is attached, but if it is longer than that then the PDF doesn’t seem to get attached. Is this an expected behaviour or is something going wrong here?
--max-email-attachment-size=NUMBER
Maximum size of alert email attachments, in bytes.
--max-email-include-size=NUMBER
Maximum size of inlined content in alert emails, in bytes.
I thought if these were violated, they would return a warning or error in the gvmd.log. I think this is where the attachment size is actually checked for task alerts, but it doesn’t log when the attachment size is larger than the threshold.
Hey there, I can’t seem to find the gvmd config file (I’m using Kali). I did however try starting GVM with the --max-email-attachment-size=-1, but it didn’t seem to do anything. Is this something that I would be better off asking in the Kali community?
@jaime I don’t think this is a Kali Linux issue, so I don’t think the Kali community will provide support on this issue - you can try their community forum. There is no configuration file for gvmd all the settings must be set in the systemd .service file or via the command line when starting gvmd.
I suggested checking the your MTA logs because the file may be blocked by your email service configuration/policies. This would likely result in a 5XX error code in SMTP that you can find in the MTA logs. I suspect the issue lies with your email service provider or self-hosted email server.
Hi There, I’ll check the MTA log files, but also is gvmd.service the correct file to add the arguement to? And if so, do I just add the --max-email-attachment-size arguement to the end of the ExecStart line?
