Skip to content

Commit 431d8c8

Browse files
atomicturtleatomicturtle
committed
QA fixes for smtp auth support
allow for self signed certificate with smtp_tls_verify=no Signed-off-by: Scott R. Shinn <scott@atomicorp.com>
1 parent 58e5249 commit 431d8c8

11 files changed

Lines changed: 176 additions & 13 deletions

File tree

‎contrib/specs/server/preloaded-vars.conf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,14 @@ USER_ENABLE_EMAIL="n"
9595
# USER_EMAIL_SMTP defines the SMTP server to send the e-mails.
9696
#USER_EMAIL_SMTP="test.ossec.net"
9797

98+
# SMTP authentication and TLS (install.sh enables USE_CURL=yes when these are set)
99+
#USER_SMTP_AUTH="y"
100+
#USER_SMTP_USER="user@example.com"
101+
#USER_SMTP_PASS="secret"
102+
#USER_SMTP_SECURE="n"
103+
#USER_SMTP_PORT="587"
104+
#USER_SMTP_TLS_VERIFY="y"
105+
98106

99107
# USER_ENABLE_SYSLOG enables or disables remote syslog.
100108
USER_ENABLE_SYSLOG="n"

‎etc/preloaded-vars.conf.example‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,14 @@
101101
# USER_EMAIL_SMTP defines the SMTP server to send the e-mails.
102102
#USER_EMAIL_SMTP="test.ossec.net"
103103

104+
# SMTP authentication and TLS (require USE_CURL=yes at build; install.sh sets this automatically)
105+
#USER_SMTP_AUTH="y"
106+
#USER_SMTP_USER="user@example.com"
107+
#USER_SMTP_PASS="secret"
108+
#USER_SMTP_SECURE="n"
109+
#USER_SMTP_PORT="587"
110+
#USER_SMTP_TLS_VERIFY="y"
111+
104112

105113
# USER_ENABLE_SYSLOG enables or disables remote syslog.
106114
#USER_ENABLE_SYSLOG="y"

‎etc/templates/en/messages.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,12 @@ yoursmtp="We found your SMTP server as"
4141
usesmtp="Do you want to use it?"
4242
usingsmtp="Using SMTP server: "
4343
whatsmtp="What's your SMTP server ip/host?"
44+
smtpauth="Do you want to use SMTP authentication?"
45+
smtpuser="What's your SMTP username?"
46+
smtppass="What's your SMTP password?"
47+
smtpsecure="Do you want to use a secure connection (SSL/TLS on connect, smtps)?"
48+
smtpport="What's your SMTP port?"
49+
smtptlsverify="Verify the SMTP server TLS certificate?"
4450

4551
# Part 3.1/agent
4652
serveraddr="What's the IP Address or hostname of the OSSEC HIDS server?"

‎install.sh‎

Lines changed: 102 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,11 @@ Install()
102102
if [ "X${USER_BINARYINSTALL}" = "X" ]; then
103103
# Add DATABASE=pgsql or DATABASE=mysql to add support for database
104104
# alert entry
105-
${MAKEBIN} PREFIX=${INSTALLDIR} TARGET=${INSTYPE} build
105+
_make_opts="PREFIX=${INSTALLDIR} TARGET=${INSTYPE}"
106+
if [ "X${USE_CURL_BUILD}" = "Xyes" ]; then
107+
_make_opts="${_make_opts} USE_CURL=yes"
108+
fi
109+
${MAKEBIN} ${_make_opts} build
106110
if [ $? != 0 ]; then
107111
cd ../
108112
catError "0x5-build"
@@ -114,7 +118,11 @@ Install()
114118
UpdateStopOSSEC
115119
fi
116120

117-
${MAKEBIN} PREFIX=${INSTALLDIR} TARGET=${INSTYPE} install
121+
_make_opts="PREFIX=${INSTALLDIR} TARGET=${INSTYPE}"
122+
if [ "X${USE_CURL_BUILD}" = "Xyes" ]; then
123+
_make_opts="${_make_opts} USE_CURL=yes"
124+
fi
125+
${MAKEBIN} ${_make_opts} install
118126
if [ $? != 0 ]; then
119127
cd ../
120128
catError "0x5-build"
@@ -540,6 +548,78 @@ ConfigureServer()
540548
else
541549
SMTP=${USER_EMAIL_SMTP}
542550
fi
551+
552+
USE_CURL_BUILD="no"
553+
554+
# SMTP Auth
555+
if [ "X${USER_SMTP_AUTH}" = "X" ]; then
556+
echo ""
557+
$ECHO " - ${smtpauth} ($yes/$no) [$no]: "
558+
read AUTH_SMTP
559+
else
560+
AUTH_SMTP=${USER_SMTP_AUTH}
561+
fi
562+
563+
if [ "X${AUTH_SMTP}" = "X${yes}" ]; then
564+
USE_CURL_BUILD="yes"
565+
if [ "X${USER_SMTP_USER}" = "X" ]; then
566+
$ECHO " - ${smtpuser}: "
567+
read SMTP_USER
568+
else
569+
SMTP_USER=${USER_SMTP_USER}
570+
fi
571+
if [ "X${USER_SMTP_PASS}" = "X" ]; then
572+
$ECHO " - ${smtppass}: "
573+
read SMTP_PASS
574+
else
575+
SMTP_PASS=${USER_SMTP_PASS}
576+
fi
577+
fi
578+
579+
# SMTP Secure (smtps:// on connect; port 587 submission uses auth + STARTTLS with secure_smtp=no)
580+
if [ "X${USER_SMTP_SECURE}" = "X" ]; then
581+
$ECHO " - ${smtpsecure} ($yes/$no) [$no]: "
582+
read SMTP_SECURE
583+
else
584+
SMTP_SECURE=${USER_SMTP_SECURE}
585+
fi
586+
587+
if [ "X${SMTP_SECURE}" = "X${yes}" ]; then
588+
USE_CURL_BUILD="yes"
589+
fi
590+
591+
# SMTP Port
592+
if [ "X${AUTH_SMTP}" = "X${yes}" ]; then
593+
_smtp_port_default="587"
594+
else
595+
_smtp_port_default="25"
596+
fi
597+
if [ "X${USER_SMTP_PORT}" = "X" ]; then
598+
$ECHO " - ${smtpport} [${_smtp_port_default}]: "
599+
read SMTP_PORT
600+
if [ "X${SMTP_PORT}" = "X" ]; then
601+
SMTP_PORT=${_smtp_port_default}
602+
fi
603+
else
604+
SMTP_PORT=${USER_SMTP_PORT}
605+
fi
606+
if [ "X${SMTP_PORT}" != "X" ] && [ "X${SMTP_PORT}" != "X25" ]; then
607+
USE_CURL_BUILD="yes"
608+
fi
609+
610+
# TLS certificate verification (libcurl builds only)
611+
if [ "X${USER_SMTP_TLS_VERIFY}" = "X" ]; then
612+
$ECHO " - ${smtptlsverify} ($yes/$no) [$yes]: "
613+
read SMTP_TLS_VERIFY
614+
else
615+
SMTP_TLS_VERIFY=${USER_SMTP_TLS_VERIFY}
616+
fi
617+
if [ "X${SMTP_TLS_VERIFY}" = "X" ]; then
618+
SMTP_TLS_VERIFY=${yes}
619+
fi
620+
if [ "X${SMTP_TLS_VERIFY}" = "X${no}" ]; then
621+
USE_CURL_BUILD="yes"
622+
fi
543623
;;
544624
esac
545625

@@ -551,7 +631,25 @@ ConfigureServer()
551631
echo " <email_notification>yes</email_notification>" >> $NEWCONFIG
552632
echo " <email_to>$EMAIL</email_to>" >> $NEWCONFIG
553633
echo " <smtp_server>$SMTP</smtp_server>" >> $NEWCONFIG
554-
echo " <email_from>ossecm@${HOST}</email_from>" >> $NEWCONFIG
634+
if [ "X${AUTH_SMTP}" = "X${yes}" ]; then
635+
echo " <auth_smtp>yes</auth_smtp>" >> $NEWCONFIG
636+
echo " <smtp_user>$SMTP_USER</smtp_user>" >> $NEWCONFIG
637+
echo " <smtp_password>$SMTP_PASS</smtp_password>" >> $NEWCONFIG
638+
fi
639+
if [ "X${SMTP_SECURE}" = "X${yes}" ]; then
640+
echo " <secure_smtp>yes</secure_smtp>" >> $NEWCONFIG
641+
fi
642+
if [ "X${SMTP_PORT}" != "X" ]; then
643+
echo " <smtp_port>$SMTP_PORT</smtp_port>" >> $NEWCONFIG
644+
fi
645+
if [ "X${SMTP_TLS_VERIFY}" = "X${no}" ]; then
646+
echo " <smtp_tls_verify>no</smtp_tls_verify>" >> $NEWCONFIG
647+
fi
648+
if [ "X${AUTH_SMTP}" = "X${yes}" ] && [ "X${SMTP_USER}" != "X" ]; then
649+
echo " <email_from>${SMTP_USER}</email_from>" >> $NEWCONFIG
650+
else
651+
echo " <email_from>ossecm@${HOST}</email_from>" >> $NEWCONFIG
652+
fi
555653
else
556654
echo " <email_notification>no</email_notification>" >> $NEWCONFIG
557655
fi
@@ -977,7 +1075,7 @@ main()
9771075

9781076

9791077
# Initial message
980-
echo " $NAME $VERSION ${installscript} - http://www.ossec.net"
1078+
echo " $NAME $VERSION ${installscript} - https://www.ossec.net"
9811079

9821080
catMsg "0x101-initial"
9831081

‎src/config/global-config.c‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ int Read_Global(XML_NODE node, void *configp, void *mailp)
126126
const char *xml_smtp_user = "smtp_user";
127127
const char *xml_smtp_password = "smtp_password";
128128
const char *xml_secure_smtp = "secure_smtp";
129+
const char *xml_smtp_tls_verify = "smtp_tls_verify";
129130
const char *xml_smtp_port = "smtp_port";
130131

131132
#ifdef LIBGEOIP_ENABLED
@@ -490,6 +491,18 @@ int Read_Global(XML_NODE node, void *configp, void *mailp)
490491
} else {
491492
return (OS_INVALID);
492493
}
494+
} else if (strcmp(node[i]->element, xml_smtp_tls_verify) == 0) {
495+
if (strcmp(node[i]->content, "yes") == 0) {
496+
if (Mail) {
497+
Mail->smtp_tls_verify = 1;
498+
}
499+
} else if (strcmp(node[i]->content, "no") == 0) {
500+
if (Mail) {
501+
Mail->smtp_tls_verify = 0;
502+
}
503+
} else {
504+
return (OS_INVALID);
505+
}
493506
} else if (strcmp(node[i]->element, xml_smtp_user) == 0) {
494507
if (Mail) {
495508
if (Mail->smtp_user) {

‎src/config/mail-config.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ typedef struct _MailConfig {
3939
/* SMTP auth (USE_CURL build only) */
4040
int authsmtp; /* 0 = off (default), 1 = on */
4141
int securesmtp; /* 0 = off (default), 1 = on */
42+
int smtp_tls_verify; /* 1 = verify peer/host (default), 0 = accept any cert */
4243
int smtp_port; /* 0 = use default per mode (465/587/25); else override */
4344
char *smtp_user;
4445
char *smtp_pass;

‎src/config/reports-config.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ typedef struct _monitor_config {
3838
/* SMTP auth (USE_SMTP_CURL only) */
3939
int authsmtp;
4040
int securesmtp;
41+
int smtp_tls_verify;
4142
int smtp_port;
4243
char *smtp_user;
4344
char *smtp_pass;

‎src/monitord/main.c‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,7 @@ int main(int argc, char **argv)
144144

145145
mond.authsmtp = 0;
146146
mond.securesmtp = 0;
147+
mond.smtp_tls_verify = 1;
147148
mond.smtp_port = 0;
148149
mond.smtp_user = NULL;
149150
mond.smtp_pass = NULL;
@@ -164,6 +165,7 @@ int main(int argc, char **argv)
164165
const char *(xml_idsname[]) = {"ossec_config", "global", "email_idsname", NULL};
165166
const char *(xml_auth_smtp[]) = {"ossec_config", "global", "auth_smtp", NULL};
166167
const char *(xml_secure_smtp[]) = {"ossec_config", "global", "secure_smtp", NULL};
168+
const char *(xml_smtp_tls_verify[]) = {"ossec_config", "global", "smtp_tls_verify", NULL};
167169
const char *(xml_smtp_port[]) = {"ossec_config", "global", "smtp_port", NULL};
168170
const char *(xml_smtp_user[]) = {"ossec_config", "global", "smtp_user", NULL};
169171
const char *(xml_smtp_pass[]) = {"ossec_config", "global", "smtp_password", NULL};
@@ -238,6 +240,21 @@ int main(int argc, char **argv)
238240
}
239241
}
240242

243+
if (mond.reports) {
244+
char *tmp_tls_verify = OS_GetOneContentforElement(&xml, xml_smtp_tls_verify);
245+
if (tmp_tls_verify) {
246+
if (strcmp(tmp_tls_verify, "yes") == 0) {
247+
mond.smtp_tls_verify = 1;
248+
} else if (strcmp(tmp_tls_verify, "no") == 0) {
249+
mond.smtp_tls_verify = 0;
250+
} else {
251+
merror("%s: ERROR: Invalid value for 'smtp_tls_verify' (expected yes/no). Disabling email reports.", ARGV0);
252+
mond.reports = NULL;
253+
}
254+
free(tmp_tls_verify);
255+
}
256+
}
257+
241258
if (mond.reports) {
242259
char *tmp_port = OS_GetOneContentforElement(&xml, xml_smtp_port);
243260
if (tmp_port) {

‎src/monitord/sendcustomemail.c‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -269,9 +269,14 @@ int OS_SendCustomEmail2(char **to, char *subject, char *fname, monitor_config *m
269269
memset(curl_errbuf, 0, sizeof(curl_errbuf));
270270
curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curl_errbuf);
271271

272-
/* Explicit TLS verification so behavior is not dependent on libcurl defaults */
273-
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
274-
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
272+
if (mail->smtp_tls_verify) {
273+
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
274+
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
275+
} else {
276+
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
277+
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
278+
verbose("%s: SMTP TLS certificate verification disabled (smtp_tls_verify=no).", ARGV0);
279+
}
275280

276281
if (mail->authsmtp && mail->smtp_user && mail->smtp_pass) {
277282
curl_easy_setopt(curl, CURLOPT_USERNAME, mail->smtp_user);

‎src/os_maild/config.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ int MailConf(int test_config, const char *cfgfile, MailConfig *Mail)
5050
Mail->smtpserver_resolved = NULL;
5151
Mail->authsmtp = 0;
5252
Mail->securesmtp = 0;
53+
Mail->smtp_tls_verify = 1;
5354
Mail->smtp_port = 0;
5455
Mail->smtp_user = NULL;
5556
Mail->smtp_pass = NULL;
@@ -75,9 +76,9 @@ int MailConf(int test_config, const char *cfgfile, MailConfig *Mail)
7576
}
7677

7778
#ifndef USE_SMTP_CURL
78-
if (Mail->authsmtp || Mail->securesmtp || Mail->smtp_port ||
79+
if (Mail->authsmtp || Mail->securesmtp || !Mail->smtp_tls_verify || Mail->smtp_port ||
7980
Mail->smtp_user || Mail->smtp_pass) {
80-
merror("%s: SMTP authentication/TLS options (auth_smtp, secure_smtp, smtp_port, smtp_user, smtp_password) require building with USE_CURL=yes.", ARGV0);
81+
merror("%s: SMTP authentication/TLS options (auth_smtp, secure_smtp, smtp_tls_verify, smtp_port, smtp_user, smtp_password) require building with USE_CURL=yes.", ARGV0);
8182
MailConf_clear_smtp_config(Mail);
8283
return (OS_INVALID);
8384
}

0 commit comments

Comments
 (0)