mail alert from checkpoint

[Pantsu]

I want receive email notifications from checkpoint about critical alerts (anty virus, ips, anti-bot) , i find it in smartevent , but when i create new ' Automatic reaction' there are only "Outgoing mail server (SMTP)" Parameter, i think it is not enough  , where i can enter my email credentials (Username and password ) and POP Parameters, i think those  are necessary .

[PhoneBoy]

Neither of those options are supported.
They also should not be required (or are generally not) for internal SMTP servers.

[Pantsu]

Thanks for you reply, but i did't understand ,

1) Is it possible  to receive email from my Server  ? 
2) How it send me email with only those few parameter (without credentials).

[PhoneBoy]

You need an SMTP mail server that will accept email sent from your SmartEvent without authentication.
Usually both the SmartEvent server and an SMTP server are inside your protected network.

[Pantsu]

We have SMTP mail server, but it is in cloud (smtp.office365.com)
1) how i can use this server to accept email sent from my SmartEvent?
2) which would be source , who would send me this email from SmartEvent , if i did not put somewhere mail credentials in SmartEvent .

[PhoneBoy]

The built-in mail feature in SmartEvent Automatic Reaction does not currently support using SMTP Authentication, which would be required to support Office 365.
You should be able to write a script that calls /sbin/sendmail on the management server that supplies the required credentials to send the email.

[jperry]

I'm looking to do this same thing.. Would you have any examples of what the script might look like?

[vitsprediction]

Hi jperry,

Have you found the script or solution?

[Steven_Sultana]

Indeed there must be a way, since for SmartView it is possible to send authenticated and TLS emails.

However I'm messing a bit with /sbin/sendmail (msmtp) and when enabling TLS I'm getting an error that "sendmail: support for TLS is not compiled in" (R81, take 44).

Does that mean Smartview is actually using /opt/CPsuite-R81/fw1/bin/sendmail ?

Does the -m option take the same file as msmtp?

sendmail [-t server] [ [-m filename] | [-s subject] [-f from] email-address]

I have something like this:

[Expert@Lab-MGMT01:0]# cat sendmail.cfg
# Set default values for all accounts.
account default
auth           on
tls            on
tls_trust_file /var/opt/CPshrd-R81/conf/ca-bundle.crt
logfile        /var/log/msmtp

# Office365
host           smtp.office365.com
port           587
from           [email protected]
user           [email protected]
password       PlaintextPassword

# Syslog logging with facility LOG_MAIL instead of the default LOG_USER
syslog LOG_MAIL

Called as:

[Expert@Lab-MGMT01:0]# /opt/CPsuite-R81/fw1/bin/sendmail -m sendmail.cfg [email protected]
0
[Expert@Lab-MGMT01:0]#
[Expert@Lab-MGMT01:0]# sendmail -C sendmail.cfg [email protected]
sendmail: support for TLS is not compiled in
[Expert@Lab-MGMT01:0]#

Any thoughts?

Steven.

[vladt · Accepted solution]

Checkpoint imported the msmtp (sendmail command is actually a link) tool from RHEL 5.2 while removing the SSL/TLS support. 

However, it is still possible to send emails with authentication, for example Gmail. 

Command used:

curl_cli --ssl-reqd \
--url 'smtps://smtp.gmail.com:465' \
--user '[email protected]:APP PASSWORD' \
--mail-from '[email protected]' \
--mail-rcpt '[email protected]' \
--upload-file mail.txt \
--cacert /opt/CPsuite-R81.10/fw1/database/ca_bundle.pem

File contents:

[Expert@fw:0]# cat mail.txt
From: "tester" <[email protected]>
To: "recepient" <[email protected]>
Subject: This is a test

Hi from tester
Bye!