search

MISP / mail_to_misp

Connect your mail client/infrastructure to MISP in order to create events based on the information contained within mails.
GNU Affero General Public License v3.0
67 stars 25 forks source link

Fake SMTP #36

Open vedd3r opened 5 years ago

vedd3r commented 5 years ago

Hi guys,

I'm trying to setup mail2misp fake smtp to act as a spamtrap. However, following the README to setup a spamtrap I was presented with 2 errors when I ran sudo python3 fake_smtp.py:

  1. missing aiosmtpd - which I rectified by using pip3 install aiosmtpd.
  2. Once aiosmtpd was installed, I re-ran the sudo command again and was presented with the below error:

misp@dev002:/usr/local/src/mail_to_misp$ ln -s mail_to_misp_config.py fake_smtp_config.py misp@dev002:/usr/local/src/mail_to_misp$ ls -l fake_smtp_config.py lrwxrwxrwx 1 misp misp 22 Sep 16 06:46 fake_smtp_config.py -> mail_to_misp_config.py misp@dev002:/usr/local/src/mail_to_misp$ sudo python3 fake_smtp.py Traceback (most recent call last): File "fake_smtp.py", line 62, in binpath = config.binpath AttributeError: module 'fake_smtp_config' has no attribute 'binpath' misp@dev002:/usr/local/src/mail_to_misp$

Any thoughts? I saw the fake_smtp_config.py-sample and created a symlink name fake_smtp_config.py pointing to the sample file. It ran but I can only see port 2525 listening on localhost but not port 25 (assuming it will use the smtp port to listen and catch incoming emails). Any pointers?

Thanks

rommelfs commented 5 years ago

Looks like your config doesn't contain binpath or the config file doesn't exist. Can you double check?

rommelfs commented 5 years ago

for (1) please feel free to create a pull request with your fix in the requirements file.

vedd3r commented 4 years ago

@rommelfs Apologies for the late response as I was pretty busy the past weeks.

I've used another approach by redirecting the emails using postfix aliases instead. That solved the problem except that the behavior when changing spamtrap = True in the mail2misp config, it does not process the links/urls and add them as url object. I would assume it has something related to when setting the spamtrap parameter to True, it should treat all url/links as Network activity/url instead of External analysis/link.

m2m_config

misp_entry

Should I close this one and create a new issue?

SteveClement commented 2 years ago

Added aiosmtp.