ossec and email configuration - configuration-files

i'm stuck on my OSSEC configuration. my server makes use of exim4 for sending email. that works fine. i have OSSEC with pretty much all of the defaults. i have my email configuration in the ossec.conf file similar to:
<global>
<email_notification>yes</email_notification>
<email_to>me#SOMETHING.COM</email_to>
<smtp_server>127.0.0.1</smtp_server>
<email_from>ossecm#SOMETHING.com</email_from>
</global>
I have tried various smtp_servers to no avail.
Ideally i would like to see anything put into the OSSEC log files, but that is not happening. my exim4 log looks fine (although its clear that there is no attempt there to email based on my ossec config), the ossec-maild is running...
I have tried restarting OSSEC numerous times, and i still can not get the system to send me an email on startup or at any other time.

i would continually receive the following error:
ossec-maild(1223): ERROR: Error Sending email to 127.0.0.1 (smtp server)
when i would attempt to mail something from the command line, exim4 would work fine.
however, it seems that the exim4.service was loaded, but not active. running:
/etc/init.d/exim4 start
started the service and everything started working.
with regards to not logging the ossec-maild into the OSSEC logs, i am still working on that.

Related

ansible tower "msg": "ntlm: Bad HTTP response returned from server. Code 403",

I have ansible version 2.9.18. Trying to send the email notification when deployment job completed. When I execute the template, it will call the mail module .yaml file.
But getting below error while executing the mail module:
Below is the mail module configuration for reference:
However I'm able to execute other tasks on the same server like installing the chrome or other agents. I'm wondering whats wrong while calling the mail module.
We were using only host name alone and tried with IP address as well.
Solution:
We have to use server name with full fqdn name (Ex: servername.sampledomain.com)
This helped us to overcome this error.
The other issue was "ansible_shell_type: powershell" was mentioned in the code level. After committing that line helped us to over come power shell related error.

how to stop postfix MAILER-DAEMON emails

I am running Ubuntu 12.04 with Postfix
Late yesterday, I added a package (ispconfig3) that modified my postfix configuration and also added an entry to the root crontab that was invoking a script.
At around 11PM last night, I uninstalled that package and went to bed. The uninstall deleted the script and it's directory ok. But it did not clean up the crontab entry.
Since cron had trouble invoking the script, it sent root#xx.org an email. But ispconfig3 had modified my postfix configuration, therefore there is no mail transport capability. So a MAILER-DAEMON email was placed in the mail queue.
Overnight, (I'm guessing here!) cron wakes up every minute and tries to do the same thing. So by 7:00AM there are now 1100+ emails in the mail queue. But since postfix is messed up, I can't see them.
At around 8:00ish I realize that something is wrong with my email set up. I check postfix configuration, backout the changes and now I can get emails ok. I can send them, receive them, etc.
Then the flurry of emails start. Every minute or so, I get around 30 MAILER-DAEMON emails indicating that cron couldn't invoke the script. I check
sudo crontab -l
see the stale command for the non-existing script. I clear it out:
sudo crontab -e
I expect the emails to stop.
They don't.
In fact, every minute they seem to be increasing in number. I then spend a few hours looking at a ton of configuration files to try to figure out what is going on. By 11:00ish or so, it's up to 50+ emails coming in every minute.
I finally realized that this stream of emails was occurring because of the failures that occurred the night before and that it was going to go on for 7 days. The "7d" comes from a postfix configuration setting. (BTW I changed that to be "2d" i.e. only a couple of hours).
In any case, I solved it. I'm adding this post so others can save themselves some time. See below.
Finally hit on the idea to look at the mail queue.
A bit of googling and I found this site:
https://www.garron.me/en/linux/delete-purge-flush-mail-queue-postfix.html
I tried
postqueue -p
which listed all of the "(mail transport unavailable)" emails:
... snip ...
-- 1104 Kbytes in 1185 Requests.
I then did:
postqueue -f # this flushes the mail queue
postqueue -p
Mail queue is empty
And all of a sudden email flurry ended.
Note: the website above said to use:
postfix -f
that did not work for me. A bit of googling found the postqueue command.
Another note: I was worried there were emails in that mail queue that were not "mail transport unavailable", so I double checked all 1185 emails to ensure it was ok to purge them.

Jenkins won't send e-mails anymore

This might be a tough thing to figure out but i have to give it a try.
With no changes i am aware of, my jenkins just stopped sending out e-mail notifications. I use jenkins 1.609 and email extension plugin 2.40.5. Jenkins runs as a service using a service user who also has the rights on the server to send e-mails. Ports to our smtp-server are unlocked. Used telnet for testing that everything works as expected. SMTP-server works fine, so it has something to do with jenkins and i cant figure out what is going wrong.
For some unknown reason jenkins still fails to send e-mails. When i use the test-feature that jenkins offers i get: javax.mail.AuthenticationFailedException: 535 5.7.3 Authentication unsuccessful which tells me that either user or pw is incorrect, but as mentioned i've checked many times, it's setup correctly. Can anyone help out with this?
UPDATE:
After decrypting the password i can safely say that jenkins does save the password correct. Is there any way i can check that jenkins actually compares the correct encrypted passwords with each other? From my understanding jenkins uses 2 different encrypting techniques, maybe it uses tech1 for stored pw and tech2 for compare pw?
ANOTHER UPDATE:
Just tried adding a new certificate to the keystore, just in case, still no change.
MORE UPDATES:
Tried updating the mailer plugin- no change
Tried different users - all failed with the same error
So no matter what user i try, they all fail, but have jenkins execute a script which sends e-mails using said users it works.
August 18, 2016 - no change

nopcommerce password recovery not working properly

Password recovery is not working on the server after deployment. It is working fine on the localhost. I checked password recovery template and it is showing active. I am getting all the other mails after deployment such as order confirmation and welcome mails but there is some problem in password recovery. If I check the message queue it is showing sent but we are not receiving it. I tried to change the message template and if I keep only the text instead of any URL's than it is working fine but when I add passwords recovery URL we are not getting mails. If URL is a problem than how my other mails are working. I haven't made any changes in the core files. I checked on the nopcommerce forum but there are no one facing this issue.
Any help will be appreciated.

failing while sending bug email in emacs

C-cC-c,get this info:
Sending...terminated by signal: Broken pipe
I find paste a long file in text mode is wrong(GUI version is OK),
and want to send a bug email.
what should i config? sending mail in emacs is cool!
thanks!
Emacs uses the /usr/sbin/sendmail command (specified by the sendmail-program variable) to deliver email you compose. You might be getting the error because your sendmail command is not working properly.
To resolve the issue you could try using the sendmail command directly (try man sendmail) to verify it really works. If it doesn't work properly, you should fix it and sending email from Emacs should start working.