imthenachoman / How-To-Secure-A-Linux-Server

An evolving how-to guide for securing a Linux server.
Creative Commons Attribution Share Alike 4.0 International
17.25k stars 1.1k forks source link

SSMTP adding #45

Closed hellresistor closed 3 years ago

hellresistor commented 4 years ago

Simple way to set mail output using an existing account :)

lgaida commented 4 years ago

I also stumpled across ssmtp while i was trying to find a way to send mails without having to set up either exim4 or postfix. However sSMTP is orphaned since March 2019. You might want to checkout msmtp, which works fine for me and is even simpler than sSMTP. The config example for msmtp works like a charm, just be sure to install both msmtp and msmtp-mta.

hellresistor commented 4 years ago

Thank you! I will explore msmtp!

hellresistor commented 4 years ago

Igaida and the Issue on ssmtp about special chars (like as # ) on password, exist this issue?

lgaida commented 4 years ago

I don't think so but it may depend on how you edit the config file, e.g manually editing via vi/nano or echoing into the file...

hellresistor commented 4 years ago

I have it work with passeval and gpg passfile. ;) TY your tip about msmtp! O/ maybe need add this command because psad mail notification ln -s /usr/bin/msmtp /usr/sbin/sendmail

imthenachoman commented 4 years ago

@hellresistor This looks great. My server has been down so I can't test but as soon as it is up I will confirm and then merge. Thanks!

hellresistor commented 4 years ago

As I tested.. using msmtp -v mail@mail.dom need put at least one time the password of keyfile...

Well... resuming this will not so much secure.. since that password has stored on ram.. as your server are located on cloud server.. Otherwise Not matters if you have the physical control :) This its my opinon.. someone correct me if I see wrong way ;)

imthenachoman commented 3 years ago

So I am finally getting time to check this. Just trying to understand, why would something like msmtp be better than exim4?

imthenachoman commented 3 years ago

What happens if the network goes down? Will msmtp queue the messages?

hellresistor commented 3 years ago

So I am finally getting time to check this. Just trying to understand, why would something like msmtp be better than exim4?

As I know, with msmtp is possible configure any email provider.

What happens if the network goes down? Will msmtp queue the messages?

Good question, but it suppose do same as sendmail.

imthenachoman commented 3 years ago

From what I am reading, it doesn't look like msmtp will queue the messages. For queuing you need another program.

hellresistor commented 3 years ago

So I am finally getting time to check this. Just trying to understand, why would something like msmtp be better than exim4?

i have readed this again and not answered it really. Well I cannot say was better... should exim4 better to google services, of sure. But This It is more like an alternative.

hellresistor commented 3 years ago

here the steps to msmtp with a GPG authentication.

mymsmtp(){
echo"#########################
## MSMTP Configuration ##
#########################"
MYMAIL="$USRMAIL@$DOMPROV"
ln -s /usr/bin/msmtp /usr/sbin/sendmail
#wget http://www.cacert.org/revoke.crl -O /etc/ssl/certs/revoke.crl
#chmod 644 /etc/ssl/certs/revoke.crl
touch /root/.msmtprc
cat <<EOF> .msmtprc
defaults
account gmail
host $MAILPROV
port $MAILPORT
#proxy_host 127.0.0.1
#proxy_port 9001
from $MYEMAIL
timeout off 
protocol smtp
#auto_from [(on|off)]
#from envelope_from
#maildomain [domain]
auth on
user $USRMAIL
passwordeval "gpg -q --for-your-eyes-only --no-tty -d /root/msmtp-mail.gpg"
#passwordeval "gpg --quiet --for-your-eyes-only --no-tty --decrypt /root/msmtp-mail.gpg"
tls on
tls_starttls on
tls_trust_file /etc/ssl/certs/ca-certificates.crt
#tls_crl_file /etc/ssl/certs/revoke.crl
#tls_fingerprint [fingerprint]
#tls_key_file [file]
#tls_cert_file [file]
tls_certcheck on
tls_force_sslv3 on
tls_min_dh_prime_bits 512
#tls_priorities [priorities]
#dsn_notify (off|condition)
#dsn_return (off|amount)
#domain argument
#keepbcc off
logfile /var/log/mail.log
syslog on
account default : gmail
EOF
chmod 0400 /root/.msmtprc
mygpg
echo "Hello there" | msmtp --debug $MYEMAIL
echo"######################
## MSMTP Configured ##
######################"
}
imthenachoman commented 3 years ago

Ah. I see what you mean. I will confirm these steps using a VM and then add them in. Thanks!

hellresistor commented 3 years ago

need some adjustment like as you see

hellresistor commented 3 years ago

Deprecated ;)