Email Alerts

[Matlu]

Hello 🙋 

On Check Point firewalls, is it possible to “automate” the sending of email alerts regarding “Login Fail” logs?
Can I receive alerts at my personal email address—such as Gmail—regarding failed login attempts via the WebUI?
Thanks for your feedback

[Chris_Atkinson]

Infinity Playblocks is one method of doing this - refer: Automations

[Matlu]

Isn't there a way to do this natively within the firewall itself?

[PhoneBoy · Accepted solution]

That's covered here: https://support.checkpoint.com/results/sk/sk25941
Due to the limitations, you will have to maintain your own SMTP server that is accessible to the gateway as none of the public SMTP servers will allow the configuration needed.

[Matlu]

Hello,
I've reviewed the SK, but I'm not sure about “what type” of traffic would be sent to the email.
Our goal is to receive only “login error” emails from an administrator via the firewall's WebUI.
Is this possible with the SK you shared?

[Danny]

Adjust this one-liner to use your internal mail server and Gmail and add it to Gaia's job scheduler:

grep -e "HTTP login denied\|Web UI connection.*was a failure$" /var/log/messages* | grep -vxFf /usr/tmp/sent 2>/dev/null > /usr/tmp/new; [ -s /usr/tmp/new ] && cat /usr/tmp/new >> /usr/tmp/sent && { sleep 2; echo -e "EHLO $(hostname)\r"; sleep 2; echo -e "MAIL FROM:<fw@$(hostname)>\r"; sleep 2; echo -e "RCPT TO:<you@gmail.com>\r"; sleep 2; echo -e "DATA\r"; sleep 2; echo -e "Subject: [$(hostname)] Login failure\r\n\r"; cat /usr/tmp/new; echo -e "\r\n.\r"; sleep 2; echo -e "QUIT\r"; } | nc -w 30 smtp.gmail.com 25

[Matlu]

Where do I configure this?
I didn't understand this part.
Where do I configure this code? 🤔

[PhoneBoy]

In Gaia's Job Scheduler (i.e. a cron) as @Danny said.