adding heloserver name to the options for email #214

jrossi · 2014-05-27T15:04:27Z

This allow the manual setting of the server name during HELO message. This is to solve #213

jrossi · 2014-05-27T15:08:50Z

@Mycron Can you test this as I have can not. This pull request addes the option:

<ossec_config>
    <global>
        <helo_server>ossechost01.example.net</helo_server>
    </global>
</ossec_config>

This still needs to be tested and docs completed, but i will do that once things have been tested.

Mycron · 2014-05-28T08:22:19Z

Hi, jrossi.
I committed your code, but with testing i get follow output on e-mail server:
May 28 12:02:47 whale postfix/smtpd[32728]: NOQUEUE: reject: RCPT from : 504 5.5.2 <%s>: Helo command rejected: need fully-qualified hostname; from=ossecm@whale to=[email protected] proto=SMTP helo=<%s>

As you can see, code not substitute value in variable heloserver.

Mycron · 2014-05-28T08:43:51Z

My previous comment not working :( With form "Helo <%s>\r\n" i get follow log:
May 28 12:41:27 whale postfix/smtpd[4696]: NOQUEUE: reject: RCPT from ...: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; from=ossecm@whale to=[email protected] proto=SMTP helo=

ddpbsd · 2014-05-28T13:42:28Z

The snprintf keeps the literal %s. I haven't checked the rest of the code, but it seems like it should be simple enough to skip the define, and snprintf the "Helo " directly.

Mycron · 2014-05-29T06:45:57Z

AFAIK, this function use format as 'printf'.
http://www.cplusplus.com/reference/cstdio/snprintf/
Therefore i expect substitution of "%s" and moreover the rest of the code use it in "mail from", "rcpt to" and so on.

jrossi · 2014-05-30T03:46:46Z

@Mycron What error are you getting. Please see this full pull request as it does the correct thing.

Mycron · 2014-05-30T13:27:51Z

Hi.
I get an error in helo command, which sent by ossec to mail server:
May 28 12:02:47 whale postfix/smtpd[32728]: NOQUEUE: reject: RCPT from : 504 5.5.2 <%s>: Helo command rejected: need fully-qualified hostname; from=ossecm@whale to=[email protected] proto=SMTP helo=<%s>

ddpbsd · 2014-05-30T14:02:22Z

@jrossi It's possible that my testing was faulty, but I wasn't able to get a test program (made a very simple test case) to work. The %s in the #define never gets replaced in the snprintf.

It's definitely not as pretty

ddpbsd · 2014-07-11T19:34:24Z

@Mycron @jrossi Please take a look at my commit here: ddpbsd@ad1ece9

I think this fixes the issue (for non-custom email at least).
WARNING: My apparmor decoder/rules are included in that branch.

ddpbsd · 2014-07-21T13:17:28Z

@jrossi Is this something you're still interested in? How do we proceed with this?

jrossi · 2014-07-22T12:16:54Z

I need to make this hack work :) I will look again this week. And test I have vagrant setup to test mail notifications now so that should help.

Mycron · 2014-07-22T15:37:19Z

Hi, folks
I was compile commit from ddpbsd, but withot success :(
Src from message show that substitution didn't work:

Received: from %s (unknown [192.168.14.233]) <---- %s is still there

On Tue, Jul 22, 2014 at 4:16 PM, Jeremy Rossi [email protected]
wrote:

I need to make this hack work :) I will look again this week. And test I
have vagrant setup to test mail notifications now so that should help.

—
Reply to this email directly or view it on GitHub
#214 (comment).

cgzones · 2014-07-22T15:52:18Z

@Mycron what compiler and system do you use?

ddpbsd · 2014-07-22T16:03:14Z

I finally got around to setting up a testing environment, and I see it too.
Back to the drawing board. :)

On Tue, Jul 22, 2014 at 11:37 AM, Vasiliy Shpanskiy <
[email protected]> wrote:

Hi, folks
I was compile commit from ddpbsd, but withot success :(
Src from message show that substitution didn't work:

Received: from %s (unknown [192.168.14.233]) <---- %s is still there

On Tue, Jul 22, 2014 at 4:16 PM, Jeremy Rossi [email protected]
wrote:

I need to make this hack work :) I will look again this week. And test I
have vagrant setup to test mail notifications now so that should help.

Reply to this email directly or view it on GitHub
#214 (comment).

Reply to this email directly or view it on GitHub
#214 (comment).

ddpbsd · 2014-07-22T16:12:37Z

I see the problem with my code, it was changing it for the stupid sms
format. I added the bits to the regular email section too. It's not quite
identifying itself properly yet, but it's closer.

On Tue, Jul 22, 2014 at 12:03 PM, dan (ddp) [email protected] wrote:

I finally got around to setting up a testing environment, and I see it
too. Back to the drawing board. :)

On Tue, Jul 22, 2014 at 11:37 AM, Vasiliy Shpanskiy <
[email protected]> wrote:

Hi, folks
I was compile commit from ddpbsd, but withot success :(
Src from message show that substitution didn't work:

Received: from %s (unknown [192.168.14.233]) <---- %s is still there

On Tue, Jul 22, 2014 at 4:16 PM, Jeremy Rossi [email protected]
wrote:

I need to make this hack work :) I will look again this week. And test
I
have vagrant setup to test mail notifications now so that should help.

Reply to this email directly or view it on GitHub
#214 (comment).

Reply to this email directly or view it on GitHub
#214 (comment).

ddpbsd · 2014-07-22T16:23:58Z

Ok, I think I got it that time. The server reported as the right hostname
(according to tcpdump), so give it a shot!

On Tue, Jul 22, 2014 at 12:12 PM, dan (ddp) [email protected] wrote:

I see the problem with my code, it was changing it for the stupid sms
format. I added the bits to the regular email section too. It's not quite
identifying itself properly yet, but it's closer.

On Tue, Jul 22, 2014 at 12:03 PM, dan (ddp) [email protected] wrote:

I finally got around to setting up a testing environment, and I see it
too. Back to the drawing board. :)

On Tue, Jul 22, 2014 at 11:37 AM, Vasiliy Shpanskiy <
[email protected]> wrote:

Hi, folks
I was compile commit from ddpbsd, but withot success :(
Src from message show that substitution didn't work:

Received: from %s (unknown [192.168.14.233]) <---- %s is still there

On Tue, Jul 22, 2014 at 4:16 PM, Jeremy Rossi [email protected]

wrote:

I need to make this hack work :) I will look again this week. And test
I
have vagrant setup to test mail notifications now so that should help.

Reply to this email directly or view it on GitHub
#214 (comment).

Reply to this email directly or view it on GitHub
#214 (comment).

jrossi · 2014-09-22T00:01:19Z

@ossec I updated this pull request and I think it should work now. Can someone look see ?

cgzones · 2014-09-22T12:16:32Z

I would like to merge it, but github prevents merging cause to some conflicts to #274 .
Can you rebase it?

jrossi · 2014-09-22T12:17:40Z

Yeapers. Will later today. Thanks

cgzones · 2014-09-22T12:24:43Z

src/config/global-config.c

@@ -167,6 +167,7 @@ int Read_Global(XML_NODE node, void *configp, void *mailp)
    char *xml_emailfrom = "email_from";
    char *xml_emailidsname = "email_idsname";
    char *xml_smtpserver = "smtp_server";
+    char *xml_heloserver = "helo_server";


can you declare this as const char * ?

…si/ossec-hids into fixed-ehlo-name-sendmail-213

jrossi · 2014-09-29T19:22:33Z

@ossec anyone able to take a look see?

ddpbsd · 2014-09-29T19:25:31Z

Haven't had a chance to test it. Building now.

jrossi · 2014-09-29T19:26:33Z

@ddpbsd thank you

adding heloserver name to the options for email Seems to work for me.

aquerubin · 2014-09-30T21:24:49Z

I was looking at this change and it occurs to me wouldn't it make more sense to use the hostname rather than hardcoding 'notify.ossec.net' in the helo banner when mail->heloserver is not explicitly configured?

jrossi · 2014-09-30T23:21:08Z

That makes sense. I am off in the make file weeds and some other areas. Pull request?

aquerubin · 2014-10-01T01:21:39Z

On Tue, 30 Sep 2014, Jeremy Rossi wrote:

That makes sense. I am off in the make file weeds and some other areas.
Pull request?

Sure but before I go working on some of that other stuff, I'd like to get
closure on the IPv6 pull request which is almost a year old and appears to
have fallen completely off the priority list.

Antonio Querubin
e-mail: [email protected]
xmpp: [email protected]

adding heloserver name to the options for email

055eaf8

jrossi added the enhancement label May 27, 2014

jrossi added the rn:master label May 30, 2014

jrossi added this to the ossec-hids-2.9 milestone May 30, 2014

fixing up the helo stuff

14862f5

jrossi mentioned this pull request Sep 14, 2014

HELO name in sendmail.c #213

Closed

cgzones reviewed Sep 22, 2014
View reviewed changes

jrossi added 2 commits September 22, 2014 08:40

merging changes

a0c8df9

Merge branch 'fixed-ehlo-name-sendmail-213' of https://github.com/jros…

8fc3af9

…si/ossec-hids into fixed-ehlo-name-sendmail-213

ddpbsd added a commit that referenced this pull request Sep 29, 2014

Merge pull request #214 from jrossi/fixed-ehlo-name-sendmail-213

bf66517

adding heloserver name to the options for email Seems to work for me.

ddpbsd merged commit bf66517 into ossec:master Sep 29, 2014

jrossi deleted the fixed-ehlo-name-sendmail-213 branch October 20, 2014 01:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

adding heloserver name to the options for email #214

adding heloserver name to the options for email #214

jrossi commented May 27, 2014

jrossi commented May 27, 2014

Mycron commented May 28, 2014

Mycron commented May 28, 2014

ddpbsd commented May 28, 2014

Mycron commented May 29, 2014

jrossi commented May 30, 2014

Mycron commented May 30, 2014

ddpbsd commented May 30, 2014

ddpbsd commented Jul 11, 2014

ddpbsd commented Jul 21, 2014

jrossi commented Jul 22, 2014

Mycron commented Jul 22, 2014

cgzones commented Jul 22, 2014

ddpbsd commented Jul 22, 2014

ddpbsd commented Jul 22, 2014

ddpbsd commented Jul 22, 2014

jrossi commented Sep 22, 2014

cgzones commented Sep 22, 2014

jrossi commented Sep 22, 2014

cgzones Sep 22, 2014

jrossi commented Sep 29, 2014

ddpbsd commented Sep 29, 2014

jrossi commented Sep 29, 2014

aquerubin commented Sep 30, 2014

jrossi commented Sep 30, 2014

aquerubin commented Oct 1, 2014

adding heloserver name to the options for email #214

adding heloserver name to the options for email #214

Conversation

jrossi commented May 27, 2014

jrossi commented May 27, 2014

Mycron commented May 28, 2014

Mycron commented May 28, 2014

ddpbsd commented May 28, 2014

Mycron commented May 29, 2014

jrossi commented May 30, 2014

Mycron commented May 30, 2014

ddpbsd commented May 30, 2014

ddpbsd commented Jul 11, 2014

ddpbsd commented Jul 21, 2014

jrossi commented Jul 22, 2014

Mycron commented Jul 22, 2014

cgzones commented Jul 22, 2014

ddpbsd commented Jul 22, 2014

ddpbsd commented Jul 22, 2014

ddpbsd commented Jul 22, 2014

jrossi commented Sep 22, 2014

cgzones commented Sep 22, 2014

jrossi commented Sep 22, 2014

cgzones Sep 22, 2014

Choose a reason for hiding this comment

jrossi commented Sep 29, 2014

ddpbsd commented Sep 29, 2014

jrossi commented Sep 29, 2014

aquerubin commented Sep 30, 2014

jrossi commented Sep 30, 2014

aquerubin commented Oct 1, 2014