pucherot / pi.alert Goto Github PK

Hello,

I'm receiving a "403 Forbidden" error when hitting the pi alert page.

I'm running pihole on a VM. I installed pi.alert using the one step install below

curl -sSL https://github.com/pucherot/Pi.Alert/raw/main/install/pialert_install.sh | bash

I added an entry for pi.alert into the hosts file on the server for DNS resolution and virtual host match up in lighttpd

The main pihole v5.2.4 web interface is loading fine using http://pi.hole

Here are the various permissions on the directories:
drwxr-xr-x 2 root root 4096 Dec 18 15:32 pihole
lrwxrwxrwx 1 root root 19 Jan 27 13:23 pialert -> /root/pialert/front
drwxrwxrwx 9 root root 4096 Jan 25 21:41 pialert

Here is the log from lighttpd:

1611757158|192.168.0.195|GET /admin/api.php?summaryRaw&getQuerySources&topClientsBlocked HTTP/1.1|200|1397
1611757171|pi.alert|GET / HTTP/1.1|403|341
1611757171|pi.alert|GET /favicon.ico HTTP/1.1|403|341

Thanks

My network has about 50 items and it would be nice to be able to change details of groups of similar devices all at once as opposed to one at a time.

Since this is a user-modified file, it it needs to be preserved. When it is, the correct version is not displayed on the site.

(I've never used github so idk if I leave suggestion in here, sorry if wrong place, but some mod on discourse locked your thread and I'd suggestion to add).

Me as newb to raspberry pi, easily followed the guide and got your pi.alert installed, and I like it!

What I'd like and use, would be if the alerts could be sent to Telegram. Perhaps to also add those alert options in the GUI.
Now the info in mail is a lot and then perhaps make it customizable (kind of what I can with RemoteBot app for telegram), such as adding variable where I can have text be: [Device-Type] has [Event-Type] at [Time] or so, simply personally I'd just need the name of device which I've edited in pi.alert to be said if it has connected or disconnected and perhaps at which time (if there would be some delay(?).
Would be perfect to me.
Same if it's able to do on newly connected devices.

(was kind of able do this before, on TP-Link router I have and IFTTT, but they disconnected their service together)

Looks like there is still an issue in the database.
attempt to write a readonly database

Originally posted by @ncmoud in #2 (comment)

Hey! Followed the installation steps (except pihole, which I have running in a docker container for only certain devices), and everything worked perfectly. However when I try to reach http://pi.alert/ I get nothing. If I try to log into the pi running it all directly, I get a 403 Forbidden error, how can I fix this issue? I'm guessing there is a specific port that I should provide to connect directly to it with the IP adress, what would that be?

Thanks again for the great work, the service looks super cool, great job! :)

Hi,
i am getting this error.

tobias@raspberrypi:~ $ python ~/pialert/back/pialert.py 1 

Pi.Alert 2.52 (2021-01-11)
---------------------------------------------------------
Scan Devices
    ScanCycle: 1
    Timestamp: 2021-01-12 16:20:00

Scanning...
    arp-scan Method...
    Pi-hole Method...
    DHCP Leases Method...

Procesising scan results...
Traceback (most recent call last):
  File "/home/tobias/pialert/back/pialert.py", line 1313, in <module>
    sys.exit(main())       
  File "/home/tobias/pialert/back/pialert.py", line 72, in main
    res = scan_network()
  File "/home/tobias/pialert/back/pialert.py", line 360, in scan_network
    save_scanned_devices (arpscan_devices, cycle_interval)
  File "/home/tobias/pialert/back/pialert.py", line 520, in save_scanned_devices
    p_arpscan_devices) 
sqlite3.IntegrityError: UNIQUE constraint failed: CurrentScan.cur_ScanCycle, CurrentScan.cur_MAC

When i try to rename a device i get this error:

Error updating device

UPDATE Devices SET
dev_Name = "TP Link",
dev_Owner = "(unknown)",
dev_DeviceType = "Router",
dev_Vendor = "TP-LINK TECHNOLOGIES CO.,LTD.",
dev_Favorite = "0",
dev_Group = "(unknown)",
dev_Comments = "",
dev_StaticIP = "0",
dev_ScanCycle = "1",
dev_AlertEvents = "1",
dev_AlertDeviceDown = "0",
dev_SkipRepeated = "0"
WHERE dev_MAC="a4:2b:b0:d9:09:a9"\n\nunable to open database file

DHCP server is on an ASUS router
Pihole and Pi Alert is on a PRi 3b+

Sorry if this report is too soon after the last one, but this happens in v2.51.

Traceback (most recent call last):
  File "/home/pi/pialert/back/pialert.py", line 1311, in <module>
    sys.exit(main())
  File "/home/pi/pialert/back/pialert.py", line 72, in main
    res = scan_network()
  File "/home/pi/pialert/back/pialert.py", line 375, in scan_network
    create_new_devices ()
  File "/home/pi/pialert/back/pialert.py", line 657, in create_new_devices
    (startTime, ) )
sqlite3.IntegrityError: NOT NULL constraint failed: Events.eve_IP

It also looks like the Devices database is read-only.

This may sound silly or I did something wrong with my install. Is there a way to have the name for the device auto-populate with the DNS name?

Reddit request:

Hello,

unfortunately it doesn't work with DietPi, it is possible to make it compatible?

https://github.com/MichaIng/DietPi

I have 1 device which is an Ethernet device and in order to connect it to my network, I have a portable Zyxel Wifi client bridging Wifi to Ethernet for it.

This causes an interesting problem since it (the Zyxel Wifi client) is proxy arping for Ethernet-only device it is bridging for.

The result is that you see the Zyxel's MAC address regularly flip between its own IP address (used for web management) and that of the Ethernet-only device.

Not too sure how to solve this. Maybe a way to indicate that a particular MAC address belong to WiFi client proxy arping?

I have a RPi connected to my network with both ethernet and Wi-Fi:

In Pi.Alert the system was only showing as 2 separate "(unknown)" entries:

I checked them and found they have different MAC addresses. The first one is actually the ETH0 connection and the second is the WLAN0. The ETH0 uses a static IP that is much higher than the dynamic IP that the system picks up on WLAN0.

Pi.Alert is incorrectly saying the ETH0 connection is using the dynamic IP that the WLAN connection uses and is totally ignoring the static IP for some reason.

(Edit to correct the Pi.Alert screenshot fragment)

option in the conf file to selecct the arp-scan interface to use.

Pi.Alert 2.60 (2021-01-20).

Client names are not resolving, instead shows (unknown) for all clients except Router.

No PiHole setup on the VM which runs Pi.Alert (PiHole on it's own Pi), this may be something to do with it as my previous installation was on same Pi as PiHole with PIHOLE_ACTIVE = True in /pialert/config/pialert.conf and names resolved as expected. Can post more install info if needed.

Clients names resolve on other devices/apps on network (Fing mobile app on iOS, Angry IP scanner on Windows, etc), Pi.Alert seems to be the only one which doesn't resolve.

It would add to overall security if this webinterface would have something like a login or at least a password protection like pihole does.

I've set up email alert. I've marked two devices as "notify when down". I did this last night and went to bed. This morning I have 30+ emails from pi.alert, mentioning every change in the network. This is both too much as unrequested information.

Is there a way to turn this off? Or maybe get one excerpt every day? I've disabled the email alerts for now..

My Config:

SMTP_SERVER     = 'smtp.gmail.com'
SMTP_PORT       = 587
SMTP_USER       = '[email protected]'
SMTP_PASS       = 'XXX'

REPORT_MAIL     = True
REPORT_FROM     = 'Pi.Alert <' + SMTP_USER +'>'
REPORT_TO       = '[email protected]'

The Error:

[...]
Reporting...
    Formating report...
    Sending report by email...
Traceback (most recent call last):
  File "/home/pi/pialert/back/pialert.py", line 1336, in <module>
    sys.exit(main())
  File "/home/pi/pialert/back/pialert.py", line 84, in main
    email_reporting()
  File "/home/pi/pialert/back/pialert.py", line 1172, in email_reporting
    send_email (mail_text, mail_html)
  File "/home/pi/pialert/back/pialert.py", line 1262, in send_email
    smtp_connection = smtplib.SMTP (SMTP_SERVER, SMTP_PORT)
  File "/usr/lib/python2.7/smtplib.py", line 256, in __init__
    (code, msg) = self.connect(host, port)
  File "/usr/lib/python2.7/smtplib.py", line 317, in connect
    self.sock = self._get_socket(host, port, self.timeout)
  File "/usr/lib/python2.7/smtplib.py", line 292, in _get_socket
    return socket.create_connection((host, port), timeout)
  File "/usr/lib/python2.7/socket.py", line 575, in create_connection
    raise err
socket.error: [Errno 99] Cannot assign requested address

python --version
Python 2.7.16

I now have ALL IPs from all Networks in my localnet showing up. Including a lot of docker 172.16.0.0/16 networks. It would be great if we could limit the processing of ips to a specific network/subnet only, to not have a list of hundreds of IPs (even 169.254..).

Pi.alert 2.52 (2021-01-11)

On the device info page (/pialert/deviceDetails.php?mac=<MAC>) where you can update the name etc of a device, if you enter a quote " you get an error on save. See example below where name includes a single "

I noticed several individuals stating this is supposed to work along side of Pi-Hole. Is this a separate Web Panel / port being used or does this directly integrate with the Pi-Hole interface?

Hi I noticed some things while using the webui that may be addressed in future updates.

• The Show x Entries menu is not saved when the page is refreshed or when changed back to the devices overview.
• Same goes for sorting.
• Add an All option to the Show x Entries menu
• Option to filter for a time range like in pihole.
• When opening a device it would be nice if the default page was Details instead of Presence. Maybe include a user custom setting in a future settings page?
• Adding an Ok button to the Details page that closes the page and goes back to the Devices overview.
• No message box that says "Device updated successfully" please. Please only report errors that way.
• Report if there are unsaved changes when trying to leave the configuration page.
• Option to delete unwanted entries and other things like groups from the database via webui.
• Option to only show favorites in any tab like the presence tab or overview to declutter.
• Option to blacklist, hide or delete host entries.
• Import / Export / Backup Function for database entries.
• Option to trigger a scan 1 manually from the wui.
• Add Device Type Singleboard Computer (SBC) / Raspberry Pi (RPI)
• Add Location field (Door, Basement, etc.)
• Customizable Devices Overview columns. (Like adding Scan cycle, configured alerts, comments, etc)
• Button to mark new devices as "known" i.e. not new anymore

Query repeatedly IP4 with http://ipv4.icanhazip.com is very slow

First: Amazing Work, I love the Project!

I have Unifi Ctrl and Pihole installed. I cant reach the http://pi.alert url. I guess it is a port Problem with Unifi. Where can i change the Port exactly? I tried on /etc/lighttpd/lighttpd.conf and /etc/lighttpd/external.conf but both wont work.

Sorry if its a dumb question, im slowly getting into lighttpd...

Thanks

My router (Unifi Dream Machine Base) has more advanced DHCP capabilities than what the PiHole offers that I take advantage of, I was just wondering if I can I run this without DHCP enabled? My PiHole is able to get the list of devices using it because I do forward DNS to it. Just wanted to check before going down that rabbit hole.

python pialert.py internet_IP return the following error:

Pi.Alert 2.52 (2021-01-11)

Check Internet IP
Timestamp: 2021-01-16 09:52:00

Retrieving Internet IP...
Traceback (most recent call last):
File "pialert.py", line 1369, in
sys.exit(main())
File "pialert.py", line 76, in main
res = check_internet_IP()
File "pialert.py", line 110, in check_internet_IP
internet_IP = get_internet_IP()
File "pialert.py", line 170, in get_internet_IP
curl_args = ['curl', '-s', QUERY_MYIP_SERVER]
NameError: name 'QUERY_MYIP_SERVER' is not defined

Looks like i just had the firewall blocking port 587. The error message was a bit misleading.
Solved!

Originally posted by @theniwo in #17 (comment)

I use VLAN's for network segregation between IOT and other devices. IOT is 192.168.99.0/24 and "main" network is 192.168.10.0/24 (as well as others). There are firewall rules between the VLAN's to allow access from devices in main (where the Pi lives) to IOT for DNS, SSH, etc.

It would be great if a scan range could be set for PiAlert (eg. 192.168.10.0/24 and 192.168.99.0/24) so that it can monitor both VLAN's.

As mentioned in the title, I would like request that update/upgrade documentation be provided under the README.md or existing INSTALL.md documentation or in its own new document.

I apologize if I should have an existing understanding of how to update these sorts of things when I initially CURL them and set them up, as I am still self-teaching on using things like Linux and Github, but as far as I can see there is no clear documentation for updating Pi.Alert (particularly when running it beside Pi-hole).

I tried updating by starting from step 5.1 in the INSTALL.md and ended up breaking both my pi-hole and pi-alert web interfaces (but that's not the subject of this Issue), so for the sake of other Pi.Alert users and myself I would like to request instructions on what steps are supposed to be followed for updating Pi.Alert.

My preferred view (for this and PiHole) is always "show 100 entries" so I know I'm seeing all entries in the result table below and never see pagination. PiAlert doesn't seem to remember this chosen value when navigating through different PiAlert URL's or on initial load.

Can this value be remembered or a larger default (eg. 100) be used?

I run pi.alert on a Raspberry Pi which has multiple network interfaces.

It would be good to have the ability to run arp-scan on multiple network interfaces so that I can capture responses from all of those networks. pi.alert already displays devices on all of these networks but some of them incorrectly show disconnected since arp-scan is missing them.

After installing pialert I get the below error. This is what I have for ssh session.

python ~/pialert/back/pialert.py update_vendors

Pi.Alert 2.52 (2021-01-11)

Update HW Vendors
Timestamp: 2021-01-13 10:53:00

Updating vendors DB (iab & oui)...
############################################################################################################################ 100.0%
############################################################################################################################ 100.0%
############################################################################################################################ 100.0%
############################################################################################################################ 100.0%
############################################################################################################################ 100.0%
############################################################################################################################ 100.0%
############################################################################################################################ 100.0%
############################################################################################################################ 100.0%

Searching devices vendor.
Devices Ignored: 1
Vendors Not Found: 0
Vendors updated: 0

python ~/pialert/back/pialert.py internet_IP

Pi.Alert 2.52 (2021-01-11)

Check Internet IP
Timestamp: 2021-01-13 10:54:00

Retrieving Internet IP...
Error retrieving Internet IP
Exiting...

(using info from #12) I updated line 160 of pialert.py

python ~/pialert/back/pialert.py internet_IP

Pi.Alert 2.52 (2021-01-11)

Check Internet IP
Timestamp: 2021-01-13 10:59:00

Retrieving Internet IP...
75.57.12#.#

Retrieving previous IP...
0.0.0.0
Saving new IP
IP updated

Skipping Dynamic DNS update...

DONE!!!

python ~/pialert/back/pialert.py 1

Pi.Alert 2.52 (2021-01-11)

Scan Devices
ScanCycle: 1
Timestamp: 2021-01-13 11:00:00

Scanning...
arp-scan Method...
Pi-hole Method...
DHCP Leases Method...

Procesising scan results...
Devices Detected.......: 42
arp-scan Method....: 42
Pi-hole Method.....: +0
New Devices........: 42

Devices in this cycle..: 0
    Down Alerts........: 0
    New Down Alerts....: 0
    New Connections....: 0
    Disconnections.....: 0
    IP Changes.........: 0

Updating DB Info...
Sessions Events (connect / discconnect) ...
Creating new devices...
Updating Devices Info...
Traceback (most recent call last):
File "/home/pi/pialert/back/pialert.py", line 1313, in
sys.exit(main())
File "/home/pi/pialert/back/pialert.py", line 72, in main
res = scan_network()
File "/home/pi/pialert/back/pialert.py", line 379, in scan_network
update_devices_data_from_scan ()
File "/home/pi/pialert/back/pialert.py", line 827, in update_devices_data_from_scan
vendor = query_MAC_vendor (device['dev_MAC'])
File "/home/pi/pialert/back/pialert.py", line 296, in query_MAC_vendor
mac = pMAC.replace (':','')
AttributeError: 'int' object has no attribute 'replace'

Did I miss something when installing?

It would add to overall security if this webinterface would have something like a login or at least a password protection like pihole does.

Traceback (most recent call last):
File "/home/pi/pialert/back/pialert.py", line 1304, in
sys.exit(main())
File "/home/pi/pialert/back/pialert.py", line 72, in main
res = scan_network()
File "/home/pi/pialert/back/pialert.py", line 355, in scan_network
read_DHCP_leases ()
File "/home/pi/pialert/back/pialert.py", line 492, in read_DHCP_leases
for col1, col2, col3, col4, col5 in reader]
ValueError: need more than 2 values to unpack

Nope. also, it's http://pi.hole/pialert

Originally posted by @ncmoud in #3 (comment)

If we could send alerts and discovered hosts, etc to mqtt then we could bridge the data into a plethora of other home automation systems.

For example nodered, home assistant, etc

From, at least nodered, we can then setup any sort of alerting mechanism we like.

Hi,

I see there is alot of different templates to choose from, any way you can make it alittle easier on the eyes maybe a dark mode litt pi-hole?

Best regards.

When I rename a device to an empty string, the device becomes unclickable and I can't change any settings anymore

a dark theme, like the pihole midnight dark theme, would be awesome!

When performing the test alert scan, I get the following error.

pi@raspberrypi:~ $ python ~/pialert/back/pialert.py 1

Pi.Alert 2.52 (2021-01-11)
---------------------------------------------------------
Scan Devices
    ScanCycle: 1
    Timestamp: 2021-01-12 15:46:00

Scanning...
    arp-scan Method...
    Pi-hole Method...
    DHCP Leases Method...

Procesising scan results...
    Devices Detected.......: 17
        arp-scan Method....: 17
        Pi-hole Method.....: +0
        New Devices........: 0

    Devices in this cycle..: 17
        Down Alerts........: 0
        New Down Alerts....: 0
        New Connections....: 0
        Disconnections.....: 0
        IP Changes.........: 0

Updating DB Info...
    Sessions Events (connect / discconnect) ...
    Creating new devices...
    Updating Devices Info...
Traceback (most recent call last):
  File "/home/pi/pialert/back/pialert.py", line 1313, in <module>
    sys.exit(main())       
  File "/home/pi/pialert/back/pialert.py", line 72, in main
    res = scan_network()
  File "/home/pi/pialert/back/pialert.py", line 379, in scan_network
    update_devices_data_from_scan ()
  File "/home/pi/pialert/back/pialert.py", line 827, in update_devices_data_from_scan
    vendor = query_MAC_vendor (device['dev_MAC'])
  File "/home/pi/pialert/back/pialert.py", line 296, in query_MAC_vendor
    mac = pMAC.replace (':','')
AttributeError: 'long' object has no attribute 'replace'

I'm getting the following error when running a scan:

Pi.Alert 2.54 (2021-01-13)
---------------------------------------------------------
Scan Devices
    ScanCycle: 1
    Timestamp: 2021-01-13 23:27:00

Scanning...
    arp-scan Method...
    Pi-hole Method...
    DHCP Leases Method...

Procesising scan results...
    Devices Detected.......: 22
        arp-scan Method....: 22
        Pi-hole Method.....: +0
        New Devices........: 0

    Devices in this cycle..: 20
        Down Alerts........: 0
        New Down Alerts....: 0
        New Connections....: 0
        Disconnections.....: 37
        IP Changes.........: 0

Updating DB Info...
    Sessions Events (connect / discconnect) ...
    Creating new devices...
Traceback (most recent call last):
  File "/home/pi/pialert/back/pialert.py", line 1339, in <module>
    sys.exit(main())
  File "/home/pi/pialert/back/pialert.py", line 75, in main
    res = scan_network()
  File "/home/pi/pialert/back/pialert.py", line 381, in scan_network
    create_new_devices ()
  File "/home/pi/pialert/back/pialert.py", line 722, in create_new_devices
    (startTime, startTime) )
sqlite3.IntegrityError: UNIQUE constraint failed: Devices.dev_MAC

This is from a fresh install from the main branch. (v 2.54)

When running python ~/pialert/back/pialert.py internet_IP I get the following output:

Pi.Alert 2.52 (2021-01-11)
---------------------------------------------------------
Check Internet IP
    Timestamp: 2021-01-13 05:53:00

Retrieving Internet IP...
    Error retrieving Internet IP
    Exiting...

After examining the code, it appears that Pi.Alert has no way of handling an IPv6 response from opendns. I also couldn't find a way to make opendns respond with my IPv4 address, so to workaround the issue for now, I changed the lookup service to ipv4.icanhazip.com by changing line 160 in pialert.py to read:

curl_args = ['curl', '-s', 'http://ipv4.icanhazip.com']

Will Pi.Alert be updated to check both IPv4 and IPv6 addresses?

A quick modification would permit any subdomains of pi.alert to direct properly in lighttpd.

If you change install/pialert_front.conf to:

# ------------------------------------------------------------------------------
#  Pi.Alert
#  Open Source Network Guard / WIFI & LAN intrusion detector
#
#  index.html - Redirect file to pialert subdirectory
# ------------------------------------------------------------------------------
#  Puche 2021        [email protected]        GNU GPLv3
# ------------------------------------------------------------------------------

$HTTP["host"] =~ "pi\.alert" {
  server.document-root = "/var/www/html/pialert/"
}

Some web browsers like to prepend "www" to domains and this might help.

Removing non-static files from the install TARs would make updating much easier. For those doing initial installs, additional curl or wget commands (or a script containing them) could be used to download them to the correct location.

Useful if there is a more user-friendly installer like the pihole one-step automated install.

I have several SEVERAL devices on my network, and the flipping back to 10 devices in the Devices view can be a bit annoying. Same with the 100 days default, as everything is showing new.

Other than that little preference wish....I LOVE IT. Very well done.

thanks!

On the installation, the process gives a error:

"WARNING: Could not obtain IP address for interface eth0. Using 0.0.0.0 for the source address, which is probably not what you want."

I believe this happens because eth0 is actually bridged to tap0 creating the default interface br0 (not recognized on the installation). Without the correct interface or IP it won't execute the arp-scan method.

I reran the install and it wiped all previous setup and records

Is there a cleaner way to update?

curl -LO https://github.com/pucherot/Pi.Alert/raw/main/install/pialert_latest.tar
tar xvf pialert_latest.tar
rm pialert_latest.tar