{"id":49582920,"url":"https://github.com/kinsman4249/morning-email-security","last_synced_at":"2026-05-03T21:01:37.016Z","repository":{"id":355466746,"uuid":"1228198259","full_name":"Kinsman4249/morning-email-security","owner":"Kinsman4249","description":"Daily email alerts for actionable Debian CVEs and package updates. A drop-in cron-driven installer that wires up debsecan + apticron + msmtp on Debian/Ubuntu hosts and emails only what you need to act on.","archived":false,"fork":false,"pushed_at":"2026-05-03T19:52:58.000Z","size":60,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-03T20:24:05.429Z","etag":null,"topics":["apticron","bash","cron","cve","debian","debsecan","email-alerts","msmtp","security","smtp2go","sysadmin","ubuntu","vulnerability-management"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Kinsman4249.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-03T18:12:56.000Z","updated_at":"2026-05-03T19:52:15.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Kinsman4249/morning-email-security","commit_stats":null,"previous_names":["kinsman4249/morning-email-security"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/Kinsman4249/morning-email-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kinsman4249%2Fmorning-email-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kinsman4249%2Fmorning-email-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kinsman4249%2Fmorning-email-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kinsman4249%2Fmorning-email-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Kinsman4249","download_url":"https://codeload.github.com/Kinsman4249/morning-email-security/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kinsman4249%2Fmorning-email-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32584651,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-03T06:36:36.687Z","status":"ssl_error","status_checked_at":"2026-05-03T06:36:09.306Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apticron","bash","cron","cve","debian","debsecan","email-alerts","msmtp","security","smtp2go","sysadmin","ubuntu","vulnerability-management"],"created_at":"2026-05-03T21:01:36.057Z","updated_at":"2026-05-03T21:01:37.008Z","avatar_url":"https://github.com/Kinsman4249.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# debsecan-filtered.sh\n\nActionable CVE alerting for Debian servers — powered by `debsecan`, filtered to cut the noise.\n\n## What It Does\n\nMost Debian hosts carry dozens of CVEs that are low-risk or already triaged as *no-dsa* by the Debian Security Team.  \n**debsecan-filtered.sh** trims that list down to two actionable buckets and emails you only when something needs attention.\n\n| Bucket | Criteria |\n|--------|----------|\n| **A — Patchable** | Fix available in Debian repos **AND** at least one of: remotely exploitable, high/critical urgency, or package has an open listening port |\n| **B — Unpatched (network-exposed)** | No fix available **AND** package has an open listening port (includes source-package expansion). CVEs triaged by Debian as `no-dsa`, `ignored`, `end-of-life`, `not-affected`, or `postponed` are **excluded**. |\n\nAn email is sent only when **either** bucket has results.\n\n## Design Principles\n\n- **Quiet by default** — no email when there's nothing to act on\n- **Deterministic** — same inputs → same output\n- **Cron-safe** — runs unattended, exits cleanly\n- **No external network calls** — trusts Debian's local `debsecan` judgement only\n- **Actionable only** — filters out noise so every alert deserves attention\n\n## Prerequisites\n\n| Requirement | Notes |\n|-------------|-------|\n| Debian-based system | Tested on Debian 11/12 |\n| Root access | Setup installs packages and writes to `/etc` |\n| Working SMTP relay | Default config targets SMTP2GO; any relay works |\n\nThe setup script installs all required packages automatically:  \n`msmtp` · `msmtp-mta` · `mailutils` · `apticron` · `debsecan` · `ca-certificates` · `curl`\n\n## Installation\n\n```bash\ngit clone https://github.com/Kinsman4249/morning-email-security.git\ncd morning-email-security\nsudo bash setup-cve-alerts.sh\n```\n\nThe installer will prompt for:\n\n| Prompt | Default |\n|--------|---------|\n| From address | *(none — required)* |\n| To address | *(none — required)* |\n| SMTP host | `mail.smtp2go.com` |\n| SMTP port | `2525` |\n| SMTP username | *(none — required)* |\n| SMTP password | *(none — required, hidden)* |\n\nYou can prefill any value via environment variables to skip its prompt:\n\n```bash\nsudo FROM_EMAIL=\"alerts@example.com\" TO_EMAIL=\"admin@example.com\" \\\n     SMTP_USER=\"myuser\" SMTP_PASS=\"mypass\" \\\n     bash setup-cve-alerts.sh\n```\n\nOn completion the installer sends **two emails**: a setup summary and a filtered CVE test run.\n\n## Usage Flags\n\nRun the filter script manually at any time:\n\n```bash\nsudo /usr/local/bin/debsecan-filtered.sh          # normal run (email only if actionable)\nsudo /usr/local/bin/debsecan-filtered.sh --test    # always send email (even if 0 CVEs)\nsudo /usr/local/bin/debsecan-filtered.sh --flush-cache   # wipe cache and exit\n```\n\n## File Locations\n\n| Path | Purpose |\n|------|---------|\n| `/usr/local/bin/debsecan-filtered.sh` | Filter script |\n| `/etc/cron.d/debsecan-report` | Cron job (daily 07:00) |\n| `/var/cache/debsecan-filtered/` | Cache directory |\n| `/var/cache/debsecan-filtered/seen-cves.csv` | Tracks `first_seen` / `last_seen` per CVE |\n| `/etc/msmtprc` | SMTP relay config (chmod 600) |\n| `/etc/apticron/apticron.conf` | Apticron config |\n\n## Schedule\n\n| Component | Frequency | Trigger |\n|-----------|-----------|---------|\n| **apticron** | Daily | `/etc/cron.daily/apticron` — emails when package updates are available |\n| **debsecan-filtered.sh** | Daily at 07:00 | `/etc/cron.d/debsecan-report` — emails when actionable CVEs are found |\n\n## Uninstallation\n\n```bash\nsudo bash uninstall.sh\n```\n\nThe uninstall script removes the filter script, cron job, and cache, then interactively asks whether to remove configs and packages.\n\n## License\n\n[Apache-2.0](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkinsman4249%2Fmorning-email-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkinsman4249%2Fmorning-email-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkinsman4249%2Fmorning-email-security/lists"}