Remove alert type in ossec email subject line #3885
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready for review
Description of Changes
Fixes #3882 .
Setting maild.full_subject=1 for ossec >= 3.0.0 will ensure alert does not appear in the email subject line (and thus unencrypted as it is sent to the admin).
Setting it in local_internal_options will ensure that it is not squashed by changes in internal_options that is shipped as part of the ossec-server package.
It appears the logic was inverted in 3.0.0 (via ossec/ossec-hids@f4cf191)
Thanks @zenmonkeykstop for finding the bug and pointing me towards the
maild.full_subject
configuration option!Testing
make build-debs
and install securedrop-ossec-server-3.0.0+0.10.0(~rcX).deb produced by this branch.Observe the emails do not contain the alert type in subject line.
Deployment
Upgrades and new installs will be ensured by securedrop-ossec-server deb package.
Checklist
If you made changes to the system configuration:
If you made non-trivial code changes: