Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow maild to send through a sendmail-like executable #689

Merged
merged 2 commits into from
Dec 15, 2015
Merged

Allow maild to send through a sendmail-like executable #689

merged 2 commits into from
Dec 15, 2015

Conversation

chewi
Copy link
Contributor

@chewi chewi commented Nov 13, 2015

Users have long called for TLS support when sending mail from OSSEC. This is not trivial to add directly but this commit enables that support by delegating the task to a sendmail-like executable such as SSMTP or Msmtp.

maild detects this mode of operation by checking for a / at the start of the smtp_server setting. It uses popen to launch the executable and passes the raw message to it via stdin. sendmail's -t argument tells
it to parse the headers given in the message so smtp_server will typically be set to something like /usr/sbin/sendmail -t.

In order for this to work, maild needs to be started without chrooting as it traditionally has done. It will therefore no longer chroot if it detects a / at the start of smtp_server.

It is best to view this commit with --ignore-all-space as there are far few changes than the regular diff would imply.

@chewi
Copy link
Contributor Author

chewi commented Nov 13, 2015

Here's a quick link to the second commit without whitespace changes.

@chewi
Copy link
Contributor Author

chewi commented Nov 16, 2015

Rebased with minor simplification.

@chewi
Copy link
Contributor Author

chewi commented Nov 17, 2015

Hold up, spotted an issue. I forgot to delete a symlink I initially placed to work around the chrooting. Small adjustment needed.

@chewi
Copy link
Contributor Author

chewi commented Nov 18, 2015

Fixed! 😄

@aquerubin
Copy link
Contributor

The third and fourth parameters to OS_ConnectTCP() should be dropped.

@chewi
Copy link
Contributor Author

chewi commented Dec 2, 2015

@aquerubin, I haven't added or changed any OS_ConnectTCP() lines so that is a separate concern.

@aquerubin
Copy link
Contributor

aquerubin commented Dec 2, 2015 via email

chewi added 2 commits December 3, 2015 12:17
@chewi
Split chroot and privilege separation log messages
c38d782 
We will want to do one but not the other.
@chewi
Allow maild to send through a sendmail-like executable
cecdbca 
Users have long called for TLS support when sending mail from
OSSEC. This is not trivial to add directly but this commit enables
that support by delegating the task to a sendmail-like executable such
as SSMTP or Msmtp.

maild detects this mode of operation by checking for a / at the start
of the smtp_server setting. It uses popen to launch the executable and
passes the raw message to it via stdin. sendmail's -t argument tells
it to parse the headers given in the message so smtp_server will
typically be set to something like /usr/sbin/sendmail -t.

In order for this to work, maild needs to be started without chrooting
as it traditionally has done. It will therefore no longer chroot if it
detects a / at the start of smtp_server. Privilege separation is still
possible, hence the previous commit.

It is best to view this commit with --ignore-all-space as there are
far few changes than the regular diff would imply.
@chewi
Copy link
Contributor Author

chewi commented Dec 3, 2015

Okay, I see. I've rebased it now then.

ddpbsd added a commit that referenced this pull request Dec 15, 2015
@ddpbsd
Merge pull request #689 from yakara-ltd/sendmail
2684c8c 
Allow maild to send through a sendmail-like executable
@ddpbsd ddpbsd merged commit 2684c8c into ossec:master Dec 15, 2015
@rakesh-eltropy
Copy link

I tried to use msmtp in ossec.conf. If I use msmtp from command line its working fine from me but mail are not being sent from ossec at all.

/usr/bin/msmtp -f "[email protected]" -t

sudo /var/ossec/bin/ossec-control status
ossec-monitord is running...
ossec-logcollector is running...
ossec-syscheckd is running...
ossec-analysisd is running...
ossec-maild is running...
ossec-execd is running...

ossec is running fine as well. Am I missing anything ?

@chewi
Copy link
Contributor Author

chewi commented Jun 4, 2017

Are you using 2.9.0? It's not in earlier versions. We're still using this with ssmtp but we're still using our custom 2.8.3 build rather than 2.9.0.

Are you setting smtp_server to /usr/bin/msmtp -t? Don't put -f here, you can set that using email_from.

Some distros install these binaries with SGID but some don't, requiring you to be in a particular group so check the permissions.

@rakesh-eltropy
Copy link

rakesh-eltropy commented Jun 4, 2017 •
edited
Loading

I am using 2.9.0 only and trying to run ossec as root user in Ubuntu 16.04 linux server. I tried using /usr/bin/msmtp -t this also but no luck.

@chewi
Copy link
Contributor Author

chewi commented Jun 4, 2017

You may start it as root but it'll drop privileges to other users. I think ossecm is the user for this process.

@rakesh-eltropy
Copy link

rakesh-eltropy commented Jun 4, 2017 •
edited
Loading

Could you please let me know which permission ossecm would require ? I have given SGID permission to /var/ossec folder.

chmod g+x /var/ossec

@chewi
Copy link
Contributor Author

chewi commented Jun 4, 2017

That's not what SGID means. Check with ls -l whether msmtp has the SGID bit set. It may look something like this. The s represents SGID.

-rwx--s--x 1 root mail 39552 May 18  2016 /usr/bin/msmtp

If it is set then you shouldn't need to do anything. If it's not set then you should add the ossecm user to the group, which is mail in the above example.

@rakesh-eltropy
Copy link

Thanks @chewi. It was permission issue only. Its working fine now.

@chewi chewi deleted the sendmail branch July 24, 2017 16:27
@rodrigojilar
Copy link

Hi!
I'm currently using OSSEC v2.9.3 and I am trying to use msmtp too. I placed the path in smtp_server parameter, gave group permissions to ossecm and still can't make it work. Is there a way to debug this issue? Mail.log Is empty.

@chewi
Copy link
Contributor Author

chewi commented Apr 1, 2018

I can't remember where ossecm logs to off the top of my head, if anywhere. Check the syslog and main OSSEC log. Also check that your configuration would cause it to mail anything at all.

@rodrigojilar
Copy link

Here is my ossec.conf fragment:

<email_notification>yes</email_notification>
<email_to>[email protected]</email_to>
<smtp_server>/usr/bin/msmtp -t</smtp_server>
<email_from>[email protected]</email_from>

And it is supposed to send emails of every event.

<log_alert_level>1</log_alert_level>
<email_alert_level>1</email_alert_level>

Groups of ossecm user
ossec mail
Group permissions for msmtp
root:mail
syslog and ossec.log are actually empty about this problem.

Finally, I have msmtp working from the command line, and with other daemons without any problem.

@rodrigojilar
Copy link

Nevermid, I replaced mSMTP with Postfix and everything is working fine now. Thanks for helping me.

@ddpbsd ddpbsd mentioned this pull request Jan 9, 2019
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@chewi @aquerubin @rakesh-eltropy @rodrigojilar @ddpbsd