/usr/share/doc/samhain/manual.html/configuration-email.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>E-mail</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuration of logging facilities"
HREF="basic-configuration.html"><LINK
REL="PREVIOUS"
TITLE="Activating logging facilities and filtering messages"
HREF="thresholds.html"><LINK
REL="NEXT"
TITLE="Log file"
HREF="trustedexample.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="thresholds.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 4. Configuration of logging facilities</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="trustedexample.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="CONFIGURATION-EMAIL"
>4.4. E-mail</A
></H1
><P
>  It is possible to define email recipients at compile-time, but it is
  also possible to define recipients, or aliases (lists of recipients)
  in the configuration file.
  Each recipient (list) definition starts with either: </P
><P
>	<B
CLASS="COMMAND"
>SetMailAddress=<TT
CLASS="REPLACEABLE"
><I
>recipient</I
></TT
></B
></P
><P
>  or:</P
><P
>	<B
CLASS="COMMAND"
>SetMailAlias=<TT
CLASS="REPLACEABLE"
><I
>listname</I
></TT
>:<TT
CLASS="REPLACEABLE"
><I
>addresslist</I
></TT
></B
></P
><P
>  Filters and/or a threshold severity for the recipient (list) may 
  follow. The definition of a recipient  
  is ended (a) explicitely when terminated with the line 
  <B
CLASS="COMMAND"
>CloseAddress</B
>, or (b) implicitely when another 
  recipient (list) definition is started.</P
><P
>  Items that can/must be configured are:
  <P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>Recipients address</DT
><DD
><P
>	<B
CLASS="COMMAND"
>SetMailAddress=<TT
CLASS="REPLACEABLE"
><I
>username@hostname</I
></TT
></B
>
        </P
><P
>	Each address must on a separate
	line in the configuration file.
        </P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="90%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>        it is recommended to use numerical IP addresses
        instead of host names (to avoid DNS lookups).
        </P
></TD
></TR
></TABLE
></DIV
></DD
><DT
>Recipients address list</DT
><DD
><P
>	<B
CLASS="COMMAND"
>SetMailAlias=<TT
CLASS="REPLACEABLE"
><I
>listname</I
></TT
>:<TT
CLASS="REPLACEABLE"
><I
>addresslist</I
></TT
></B
>
        </P
><P
>	Define an alias for a list of (already defined) recipients. The 
	format is 
	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>listname</I
></SPAN
> &quot;:&quot; <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>addresslist</I
></SPAN
>,
	where addresses in <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>addresslist</I
></SPAN
> can be separated 
	by comma, tab, or space. Logging threshold and filters (see below)
	can be set for a list as for an individual recipient, but will take
	effect only for email that is specifically targeted at the list
	(e.g. via a per-queue rule in the logfile monitoring module).
        </P
></DD
><DT
>Logging threshold</DT
><DD
><P
>	<B
CLASS="COMMAND"
>SetAddrSeverity=<TT
CLASS="REPLACEABLE"
><I
>severity</I
></TT
></B
>
        </P
><P
>	This defines a logging threshold severity for the last defined recipient (list). 
	The syntax is the same as for <B
CLASS="COMMAND"
>MailSeverity</B
>.
        </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="90%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>MailSeverity and SetAddrSeverity</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>        The MailSeverity setting in the [Log] section defines an upper bound for
	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>all recipients</I
></SPAN
>. Messages not included by the 
	MailSeverity setting will never be emailed.
        </P
></TD
></TR
></TABLE
></DIV
></DD
><DT
>NOT Filter</DT
><DD
><P
>   
	<B
CLASS="COMMAND"
>SetMailFilterNot=<TT
CLASS="REPLACEABLE"
><I
>list_of_regexes</I
></TT
></B
>
        </P
><P
>	  Defines a filtering condition for the last defined recipient (list).
	  If there is no recipient (list) defined yet, it applies to the
	  compiled-in recipients.
	  </P
><P
>	  List items are POSIX regular expressions. As whitespace
	  (blank or tab) is a valid separator in a list, strings with
	  whitespace must be enclosed in single or double quotes. 
	  If a string begins with a double quote, enclose it in single quotes 
	  (and vice versa).
	</P
><P
>	If used, then NONE of the regular expressions in 
	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>list</I
></SPAN
> can occur
	in a message, otherwise it will not be sent by email.
     </P
></DD
><DT
>AND Filter</DT
><DD
><P
>   
	<B
CLASS="COMMAND"
>SetMailFilterAnd=<TT
CLASS="REPLACEABLE"
><I
>list</I
></TT
></B
>
        </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="90%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Order of evaluation</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>        AND conditions are evaluated after all NOT conditions.
        </P
></TD
></TR
></TABLE
></DIV
><P
>	If used, then ALL strings in <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>list</I
></SPAN
> must occur
	in a message, otherwise it will not be sent by email. 
	The syntax is the same as for <B
CLASS="COMMAND"
>SetMailFilterNot</B
>.
     </P
></DD
><DT
>OR Filter</DT
><DD
><P
>   
	<B
CLASS="COMMAND"
>SetMailFilterOr=<TT
CLASS="REPLACEABLE"
><I
>list</I
></TT
></B
>
        </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="90%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Order of evaluation</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>        OR conditions are evaluated after all AND conditions.
        </P
></TD
></TR
></TABLE
></DIV
><P
>	If used, then AT LEAST ONE of the strings in 
	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>list</I
></SPAN
> must occur
	in a message, otherwise it will not be sent by email.
	The syntax is the same as for <B
CLASS="COMMAND"
>SetMailFilterNot</B
>.
     </P
></DD
><DT
>Closing a recipient (list) definition</DT
><DD
><P
>	 <B
CLASS="COMMAND"
>CloseAddress</B
>
        </P
><P
>	This explicitely closes the definition of a recipient (list).
	However, this is optional syntactic sugar (i.e. not really required), since
	recipient (list) definitions are
	closed implicitely by the beginning of another recipient (list) definition
	(i.e. <B
CLASS="COMMAND"
>SetMailAddress</B
> or <B
CLASS="COMMAND"
>SetMailAlias</B
>).
     </P
></DD
><DT
>Relay host / Mail exchanger</DT
><DD
><P
>	<B
CLASS="COMMAND"
>SetMailRelay=<TT
CLASS="REPLACEABLE"
><I
>mail.some_domain.com</I
></TT
></B
> 
        </P
><P
>	You may need this option because some sites don't allow outbound
        e-mail connections from any arbitrary host. If the recipient is 
        offsite, and your site uses a mail relay host to route 
        outbound e-mails, you need to specify the relay host.
	</P
></DD
><DT
>Maximum interval</DT
><DD
><P
>        <B
CLASS="COMMAND"
>SetMailTime=<TT
CLASS="REPLACEABLE"
><I
>86400</I
></TT
></B
> 
        </P
><P
>	You may want to set a maximum interval
        between any two consecutive e-mails, to be sure that 
        <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>
        is still 'alive'.
     </P
></DD
><DT
>Maximum pending</DT
><DD
><P
>	<B
CLASS="COMMAND"
>SetMailNum=<TT
CLASS="REPLACEABLE"
><I
>10</I
></TT
></B
>
        </P
><P
>	Messages can be queued to send several messages 
	in one e-mail. You may want to set the the maximum number of messages 
	to queue. (Note: messages  of  highest priority (alert) 
	are always sent immediately. At most 128 messages can be queued.
     </P
></DD
><DT
>Multiple recipients</DT
><DD
><P
>	<B
CLASS="COMMAND"
>MailSingle=<TT
CLASS="REPLACEABLE"
><I
>yes/no</I
></TT
></B
>
        </P
><P
>	If there are multiple recipients, 
	whether to send a single mail
	with the recipient list, or send multiple mails. If all 
	recipients are on same domain, a single mail may suffice,
	otherwise it depends on whether the mail server supports
	forwarding (for security, most don't).
     </P
></DD
><DT
>Subject line</DT
><DD
><P
>   
	<B
CLASS="COMMAND"
>MailSubject=<TT
CLASS="REPLACEABLE"
><I
>string</I
></TT
></B
>
        </P
><P
>	Here, <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>string</I
></SPAN
> may contain the 
        placeholders %T, %H, %S, and/or
	%M that will get replaced by the time, hostname, message
	severity and message text,
	respectively. The default subject line is equivalent to "%T %H".
	This option may be useful if you want to send emails to an 
	email-to-sms gateway.
     </P
></DD
><DT
>Sender</DT
><DD
><P
>   
	<B
CLASS="COMMAND"
>SetMailSender=<TT
CLASS="REPLACEABLE"
><I
>string</I
></TT
></B
>
        </P
><P
>	Here, <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>string</I
></SPAN
> is the address that
	is inserted in the From: field. If a name without domain
	is given (i.e. without '@xyz.tld'), the FQDN of the local
	host will be added automatically.
     </P
></DD
><DT
>SMTP port</DT
><DD
><P
>   
	<B
CLASS="COMMAND"
>SetMailPort=<TT
CLASS="REPLACEABLE"
><I
>port_number</I
></TT
></B
>
        </P
><P
>	This option allows to specify a custom port for SMTP (the default
	is 25).
     </P
></DD
></DL
></DIV
></P
><P
>  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Example:</I
></SPAN
></P
><PRE
CLASS="PROGRAMLISTING"
>  [Misc]  
  #
  # Do not send messages about added files, and startup messages.
  # We have no recipient defined yet, thus this applies to
  # compiled-in recipients only (if there are any).
  #
  SetMailFilterNot = 'POLICY ADDED', START
  # 
  # E-mail recipient (offsite in this case). 
  # 
  SetMailAddress=username@host.some_domain.com
     SetMailFilterNot = LOGKEY
  CloseAddress
  # 
  # Need a relay host for outgoing mail. 
  # 
  SetMailRelay=relay.mydomain.com 
  #  
  # Number of pending mails. 
  # 
  SetMailNum=10 
  #  
  # Maximum time between e-mails. 
  # Want a message every day, just to be sure that the 
  # program still runs. 
  # 
  SetMailTime=86400
  #
  # Do not send messages about added files, and startup messages
  #
  SetMailFilterNot = 'POLICY ADDED', START
  #
  # To all recipients in a single mail. 
  MailSingle=yes </PRE
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="EMAILDETAILS"
>4.4.1. E-mail reports and their integrity</A
></H2
><P
>  The subject line contains timestamp and local hostname,
  which are repeated in the message body.
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> uses its own 
  built-in SMTP code
  rather than the system mailer, because in case of temporary connection
  failures, the system mailer (e.g. <SPAN
CLASS="APPLICATION"
>sendmail</SPAN
>) 
  would queue the message
  on disk, where it may become visible to unauthorized persons.</P
><P
>  During temporary connection failures, messages are stored in memory. 
  The maximum number of stored messages is 128. 
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> will re-try to mail every 
  hour for at most 48 hours.
  In conformance with RFC 821, <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> will 
  keep the responsibility for the 
  message delivery until the recipient's mail server has confirmed receipt 
  of the e-mail (except that, as noted above, after 48 hours it will 
  assume a permanent connection failure, i.e. e-mailing will be switched off).</P
><P
>  The body of the mail may consist of several messages that were pending
  on the internal queue  (see <A
HREF="configfacility.html"
>Section 4.2</A
>&#62;),
  followed by a signature that is 
  computed from the message and a key. The key is initialized with
  a random number, and for each e-mail iterated  by a 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>hash chain</I
></SPAN
>.</P
><P
>  The initial key is revealed in the first email sent 
  (obviously, you have to believe that this first e-mail is authentic).
  This initial key is not transmitted in cleartext, but encrypted 
  with a one-time pad (<A
HREF="keypad.html"
>Section 11.2</A
>&#62;). </P
><P
>  The signature is followed by a unique identification string.
  This is used to identify seperate audit trails (here, a 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>trail</I
></SPAN
> 
  is a sequence of e-mails from the same run of 
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>), and
  to enumerate individual e-mails within a trail.</P
><P
>  The mail thus looks like:</P
><PRE
CLASS="PROGRAMLISTING"
>  -----BEGIN MESSAGE-----
  first message    
  second message    
  ... 
  -----BEGIN SIGNATURE-----
  signature 
  ID TRAIL_ID:hostname 
  -----END MESSAGE-----</PRE
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Integrity verification</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>To verify the integrity</I
></SPAN
> of an e-mail audit trail, 
  a convenience function is provided:</P
><P
>  <B
CLASS="COMMAND"
>samhain -M <TT
CLASS="REPLACEABLE"
><I
>/mailbox/file/path</I
></TT
></B
></P
><P
>  The mailbox file may contain multiple and/or overlapping audit trails
  from different runs of <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> and/or 
  different clients (hosts).</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>CAVEATS</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  Verification will fail, if the compiled-in key of the verifying executable
  is different from the one that generated the message(s) 
  (see <A
HREF="keypad.html"
>Section 11.2</A
>&#62;).
  </P
><P
>  If you use a pre-compiled executable from some binary
  distribution, be sure to read <A
HREF="keypad.html"
>Section 11.2</A
>&#62; carefully.
  </P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="thresholds.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="trustedexample.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Activating logging facilities and filtering messages</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="basic-configuration.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Log file</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / configuration-email.html
