assp-user Mailing List for Anti-Spam SMTP Proxy Server

Hi.

I am using Wazuh (ossec fork) as an HIDS on a machine running ASSP.

It has a rule where it will monitor open ports.  A couple of the assp 
udp ports change.  The output looks like this:

Rule: 533 fired (level 7) -> "Listened ports status (netstat) changed (new port opened or closed)."
Portion of the log(s):

ossec: output: 'netstat listening ports':
tcp 0.0.0.0:22 0.0.0.0:* 863/sshd
tcp6 :::22 :::* 863/sshd
tcp 0.0.0.0:25 0.0.0.0:* 2305/perl
udp 0.0.0.0:123 0.0.0.0:* 1658/ntpd
udp 127.0.0.1:123 0.0.0.0:* 1658/ntpd
udp 192.168.90.10:123 0.0.0.0:* 1658/ntpd
udp6 ::1:123 :::* 1658/ntpd
udp6 :::123 :::* 1658/ntpd
tcp 0.0.0.0:125 0.0.0.0:* 1621/master
tcp 0.0.0.0:465 0.0.0.0:* 2305/perl
tcp 0.0.0.0:2525 0.0.0.0:* 2305/perl
tcp 127.0.0.1:3306 0.0.0.0:* 1258/mysqld
udp 0.0.0.0:42540 0.0.0.0:* 2305/perl
*udp 0.0.0.0:47142 0.0.0.0:* 2305/perl*
*udp 0.0.0.0:49514 0.0.0.0:* 2305/perl*
udp 0.0.0.0:49534 0.0.0.0:* 2305/perl
udp 0.0.0.0:54808 0.0.0.0:* 2305/perl
tcp 0.0.0.0:55553 0.0.0.0:* 2305/perl


another time it looks like:


Rule: 533 fired (level 7) -> "Listened ports status (netstat) changed (new port opened or closed)."
Portion of the log(s):

ossec: output: 'netstat listening ports':
tcp 0.0.0.0:22 0.0.0.0:* 863/sshd
tcp6 :::22 :::* 863/sshd
tcp 0.0.0.0:25 0.0.0.0:* 2305/perl
udp 0.0.0.0:123 0.0.0.0:* 1658/ntpd
udp 127.0.0.1:123 0.0.0.0:* 1658/ntpd
udp 192.168.90.10:123 0.0.0.0:* 1658/ntpd
udp6 ::1:123 :::* 1658/ntpd
udp6 :::123 :::* 1658/ntpd
tcp 0.0.0.0:125 0.0.0.0:* 1621/master
tcp 0.0.0.0:465 0.0.0.0:* 2305/perl
tcp 0.0.0.0:2525 0.0.0.0:* 2305/perl
tcp 127.0.0.1:3306 0.0.0.0:* 1258/mysqld
*udp 0.0.0.0:42139 0.0.0.0:* 2305/perl*
udp 0.0.0.0:42540 0.0.0.0:* 2305/perl
udp 0.0.0.0:49534 0.0.0.0:* 2305/perl
*udp 0.0.0.0:52302 0.0.0.0:* 2305/perl*
udp 0.0.0.0:54808 0.0.0.0:* 2305/perl
tcp 0.0.0.0:55553 0.0.0.0:* 2305/perl
tcp 0.0.0.0:55555 0.0.0.0:* 2305/perl



Is there anyway to keep a static list of UDP ports so it doesn't trigger a wazuh alert?

thanks,
Geoff

On 2020-06-04 11:32 PM, Ercolino De Spiacico wrote:

> So defined that normal password in Thunderbird means PLAIN as I see from the
> logs my ASSP tries to log using LOGIN. Regardless looking at the supported AUTH
> list they are all supported:
> 
> AUTH PLAIN LOGIN DIGEST-MD5 CRAM-MD5
> 
  When "Normal Password" is selected, TB uses either PLAIN or Login for send
authentication. TB prefers whichever is the most secure, in this case LOGIN.
(LOGIN is just base64 encoded.)
  Selecting "Encrypted Password" allows TB to move up the chain a bit to
CRAM-MD5 or DIGEST-MD5.

> Thunderbird does work with the same username and password I'm using in ASSP so
> they are correct indeed.
>
  No spurious leading/trailing whitespace? A screenshot of your settings may
help, or a copy/paste from the config file.
  An option is to use ASSP's debug mode. It dumps a lot of information that
helps with tracing the problem.

-- 
James Moe
moe dot james at sohnen-moe dot com
520.743.3936
Think.

Since I wasn't able to make ASSP authenticate I ended up using stunnel for TLS and use sasl on postfix to perform the authentication. ASSP is still playing a bit part in the email flow, just a shame I couldn't fix the auth issue as it would have been simpler. Regardless is this can help other users this is what it looks like:

+------------------------------+              +------------------------------+
|       Internet emails        |              |        email clients         |
+-----+-----------------+------+              +-----+------------------+-----+
      ^                 |                           |                  |
      |25               |                           |                  |
      |                 |                           |                  |
+-----+------------+    |                           |                  |
|     MailJet      |    |                           |                  |
+-----+------------+    |                           |                  |
      ^                 |                           |                  |
      |587       +------+------+              +-----+------------------+-----+
      |          |fail2ban assp|              |    fail2ban   postfix sasl   |
      |          +------+------+              +-----+------------------+-----+
      |                 |                           |                  |
+-----+------------+    |                           |                  |
|     stunnel      |    |                           |                  |
+-----+------------+    |25                      645|587               |993
      ^                 |                           |                  |
      |11125            |                           |                  |
      |                 v                           v                  v
+-----+-----------------+------+      125     +-----+------------------+-----+
|                              +------------->+                              |
|             ASSP             |              |           Postfix            |
|                              +<-------------+                              |
+------------------------------+      225     +------------------------------+


🙂


________________________________
From: Ercolino De Spiacico <bel...@ho...>
Sent: 05 June 2020 07:32 AM
To: For Users of ASSP <ass...@li...>
Subject: Re: [Assp-user] TLS outbound

So defined that normal password in Thunderbird means PLAIN as I see from the logs my ASSP tries to log using LOGIN. Regardless looking at the supported AUTH list they are all supported:

AUTH PLAIN LOGIN DIGEST-MD5 CRAM-MD5

Thunderbird does work with the same username and password I'm using in ASSP so they are correct indeed. Can this be a char encoding issue or something? Or can ASSP be forced to use PLAIN perhaps?

Don't know what to think about any more...

Did anybody ever used MailJet with ASSP? It's a free service to send up to 200 email/day perfect for personal usage.


________________________________
From: James Moe via Assp-user <ass...@li...>
Sent: 04 June 2020 10:02 PM
To: For Users of ASSP <ass...@li...>
Cc: James Moe <ji...@so...>
Subject: Re: [Assp-user] TLS outbound

On 2020-06-04 5:53 AM, Ercolino De Spiacico wrote:

> I have set the the ASSP RelayHost to:
> SSL:in-v3.mailjet.com:587
> populated the RelayAuthUser and RelayAuthPass accordingly, and I now get this
> error in the ASSP logs:
>
>     Jun-04-20 13:31:36 m1-73895-03416 [Worker_1] [TLS-out] 46.x.x.252 info:
>     authentication - login is used
>     Jun-04-20 13:31:43 m1-73895-03416 [Worker_1] [TLS-out] 46.x.x.252 [SMTP
>     Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
>
> The very same RelayHost:port + username/password works just fine if I set this
> directly in e.g. Thunderbird selecting "Normal Password" whatever that means but
> I guess is the same as LOGIN.
>
  "Normal Password" means authentication is done in the clear. Not really a
problem if a secure connection is established previously, which your log shows
is the case.
  Are you sure the name/pass are EXACTLY the same?

> I'm confused because MailJet as per output above says to support many
> authentication mechanism including LOGIN but eventually it doesn't like it. Is
> there any way to force a different AUTH mechanism outbound in the RelayHost
> setup of ASSP?
>
  Yes. Tell Thunderbird to use anything except "Normal Password." "Encrypted
Password" is a reasonable choice. (Although "OAuth2" might be a challenge to setup.)

--
James Moe
moe dot james at sohnen-moe dot com
520.743.3936
Think.


_______________________________________________
Assp-user mailing list
Ass...@li...
https://lists.sourceforge.net/lists/listinfo/assp-user

So defined that normal password in Thunderbird means PLAIN as I see from the logs my ASSP tries to log using LOGIN. Regardless looking at the supported AUTH list they are all supported:

AUTH PLAIN LOGIN DIGEST-MD5 CRAM-MD5

Thunderbird does work with the same username and password I'm using in ASSP so they are correct indeed. Can this be a char encoding issue or something? Or can ASSP be forced to use PLAIN perhaps?

Don't know what to think about any more...

Did anybody ever used MailJet with ASSP? It's a free service to send up to 200 email/day perfect for personal usage.


________________________________
From: James Moe via Assp-user <ass...@li...>
Sent: 04 June 2020 10:02 PM
To: For Users of ASSP <ass...@li...>
Cc: James Moe <ji...@so...>
Subject: Re: [Assp-user] TLS outbound

On 2020-06-04 5:53 AM, Ercolino De Spiacico wrote:

> I have set the the ASSP RelayHost to:
> SSL:in-v3.mailjet.com:587
> populated the RelayAuthUser and RelayAuthPass accordingly, and I now get this
> error in the ASSP logs:
>
>     Jun-04-20 13:31:36 m1-73895-03416 [Worker_1] [TLS-out] 46.x.x.252 info:
>     authentication - login is used
>     Jun-04-20 13:31:43 m1-73895-03416 [Worker_1] [TLS-out] 46.x.x.252 [SMTP
>     Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
>
> The very same RelayHost:port + username/password works just fine if I set this
> directly in e.g. Thunderbird selecting "Normal Password" whatever that means but
> I guess is the same as LOGIN.
>
  "Normal Password" means authentication is done in the clear. Not really a
problem if a secure connection is established previously, which your log shows
is the case.
  Are you sure the name/pass are EXACTLY the same?

> I'm confused because MailJet as per output above says to support many
> authentication mechanism including LOGIN but eventually it doesn't like it. Is
> there any way to force a different AUTH mechanism outbound in the RelayHost
> setup of ASSP?
>
  Yes. Tell Thunderbird to use anything except "Normal Password." "Encrypted
Password" is a reasonable choice. (Although "OAuth2" might be a challenge to setup.)

--
James Moe
moe dot james at sohnen-moe dot com
520.743.3936
Think.


_______________________________________________
Assp-user mailing list
Ass...@li...
https://lists.sourceforge.net/lists/listinfo/assp-user

On 2020-06-04 5:53 AM, Ercolino De Spiacico wrote:

> I have set the the ASSP RelayHost to:
> SSL:in-v3.mailjet.com:587
> populated the RelayAuthUser and RelayAuthPass accordingly, and I now get this
> error in the ASSP logs:
> 
>     Jun-04-20 13:31:36 m1-73895-03416 [Worker_1] [TLS-out] 46.x.x.252 info:
>     authentication - login is used
>     Jun-04-20 13:31:43 m1-73895-03416 [Worker_1] [TLS-out] 46.x.x.252 [SMTP
>     Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
> 
> The very same RelayHost:port + username/password works just fine if I set this
> directly in e.g. Thunderbird selecting "Normal Password" whatever that means but
> I guess is the same as LOGIN.
> 
  "Normal Password" means authentication is done in the clear. Not really a
problem if a secure connection is established previously, which your log shows
is the case.
  Are you sure the name/pass are EXACTLY the same?

> I'm confused because MailJet as per output above says to support many
> authentication mechanism including LOGIN but eventually it doesn't like it. Is
> there any way to force a different AUTH mechanism outbound in the RelayHost
> setup of ASSP?
> 
  Yes. Tell Thunderbird to use anything except "Normal Password." "Encrypted
Password" is a reasonable choice. (Although "OAuth2" might be a challenge to setup.)

-- 
James Moe
moe dot james at sohnen-moe dot com
520.743.3936
Think.

Thank you, so here's the score. the SMTP provider gives this:

[root@centos8 assp]# telnet in-v3.mailjet.com 25
Trying 104.199.96.85...
Connected to in-v3.mailjet.com.
Escape character is '^]'.
220 in.mailjet.com ESMTP Mailjet
EHLO test.com
250-smtpin.mailjet.com
250-PIPELINING
250-SIZE 15728640
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN DIGEST-MD5 CRAM-MD5
250-AUTH=PLAIN LOGIN DIGEST-MD5 CRAM-MD5
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 SMTPUTF8

I have set the the ASSP RelayHost to:
SSL:in-v3.mailjet.com:587
populated the RelayAuthUser and RelayAuthPass accordingly, and I now get this error in the ASSP logs:

Jun-04-20 13:31:36 m1-73895-03416 [Worker_1] [TLS-out] 46.x.x.252 info: authentication - login is used
Jun-04-20 13:31:43 m1-73895-03416 [Worker_1] [TLS-out] 46.x.x.252 [SMTP Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
The very same RelayHost:port + username/password works just fine if I set this directly in e.g. Thunderbird selecting "Normal Password" whatever that means but I guess is the same as LOGIN.

I'm confused because MailJet as per output above says to support many authentication mechanism including LOGIN but eventually it doesn't like it. Is there any way to force a different AUTH mechanism outbound in the RelayHost setup of ASSP?

Or am I perhaps looking in the wrong place to fix this?
Thank!

________________________________
From: Thomas Eckardt <Tho...@th...>
Sent: 02 June 2020 05:55 AM
To: For Users of ASSP <ass...@li...>
Subject: Re: [Assp-user] TLS outbound

assp is man in the middle - both connections are handled independent - assp tries to use the highest possible encryption mode for each connection

Thomas





Von:        "Ercolino De Spiacico" <bel...@ho...>
An:        "ass...@li..." <ass...@li...>
Datum:        01.06.2020 13:31
Betreff:        [Assp-user] TLS outbound
________________________________



I have been trying to set up ASSP to use MailJet outbound. I have two questions in regards:

1) say I have postfix using ASSP as relay host and sends standard emails on port 25, if ASSP is set up with doTLS and relay hosts with TLS details is this meant to work end to end or do I really have to have the same communication type "postfix -> ASSP"  as well as "ASSP -> MailJet" ? e,g, both must plain or TLS but not a mix-and-match right?

2) regardless of the first question, as a test I have set both connection to be TLS, my emails stay in the postfix queue with the following ASSP log errors (SSLDebug Levl 3):
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1638: don't start handshake: IO::Socket::SSL=GLOB(0xa12afa0)
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1031: no socket yet
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1033: accept created normal socket IO::Socket::SSL=GLOB(0x7efd2ec084d8)
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1043: will not start SSL handshake yet
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1061: starting sslifying
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1109: Net::SSLeay::accept -> -1
Jun-01-20 12:14:11 [Worker_1] Error: Worker_1 accept_SSL to client 127.0.0.1 failed IO::Socket::SSL=GLOB(0xa12afa0) (timeout: 5 s) : SSL wants a read first

also mailq adds some extra info.

root@centos7~# mailq
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
A6E1D1260FC      691 Mon Jun  1 12:14:05  se...@xx...
(lost connection with 127.0.0.1[127.0.0.1] while receiving the initial server greeting)
                                         destination@yyyyyyy.yyy

Thanks
_______________________________________________
Assp-user mailing list
Ass...@li...
https://lists.sourceforge.net/lists/listinfo/assp-user




DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no known virus in this email!
*******************************************************

assp is man in the middle - both connections are handled independent - 
assp tries to use the highest possible encryption mode for each connection

Thomas





Von:    "Ercolino De Spiacico" <bel...@ho...>
An:     "ass...@li..." 
<ass...@li...>
Datum:  01.06.2020 13:31
Betreff:        [Assp-user] TLS outbound



I have been trying to set up ASSP to use MailJet outbound. I have two 
questions in regards:

1) say I have postfix using ASSP as relay host and sends standard emails 
on port 25, if ASSP is set up with doTLS and relay hosts with TLS details 
is this meant to work end to end or do I really have to have the same 
communication type "postfix -> ASSP"  as well as "ASSP -> MailJet" ? e,g, 
both must plain or TLS but not a mix-and-match right?

2) regardless of the first question, as a test I have set both connection 
to be TLS, my emails stay in the postfix queue with the following ASSP log 
errors (SSLDebug Levl 3):
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1638: don't 
start handshake: IO::Socket::SSL=GLOB(0xa12afa0)
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1031: no 
socket yet
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1033: accept 
created normal socket IO::Socket::SSL=GLOB(0x7efd2ec084d8)
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1043: will 
not start SSL handshake yet
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1061: 
starting sslifying
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1109: 
Net::SSLeay::accept -> -1
Jun-01-20 12:14:11 [Worker_1] Error: Worker_1 accept_SSL to client 
127.0.0.1 failed IO::Socket::SSL=GLOB(0xa12afa0) (timeout: 5 s) : SSL 
wants a read first

also mailq adds some extra info.

root@centos7~# mailq
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
A6E1D1260FC      691 Mon Jun  1 12:14:05  se...@xx...
(lost connection with 127.0.0.1[127.0.0.1] while receiving the initial 
server greeting)
                                         destination@yyyyyyy.yyy

Thanks
_______________________________________________
Assp-user mailing list
Ass...@li...
https://lists.sourceforge.net/lists/listinfo/assp-user




DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally 
privileged and protected in law and are intended solely for the use of the 

individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no 
known virus in this email!
*******************************************************

I have been trying to set up ASSP to use MailJet outbound. I have two questions in regards:

1) say I have postfix using ASSP as relay host and sends standard emails on port 25, if ASSP is set up with doTLS and relay hosts with TLS details is this meant to work end to end or do I really have to have the same communication type "postfix -> ASSP"  as well as "ASSP -> MailJet" ? e,g, both must plain or TLS but not a mix-and-match right?

2) regardless of the first question, as a test I have set both connection to be TLS, my emails stay in the postfix queue with the following ASSP log errors (SSLDebug Levl 3):
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1638: don't start handshake: IO::Socket::SSL=GLOB(0xa12afa0)
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1031: no socket yet
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1033: accept created normal socket IO::Socket::SSL=GLOB(0x7efd2ec084d8)
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1043: will not start SSL handshake yet
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1061: starting sslifying
Jun-01-20 12:14:06 [Worker_1] SSL-DEBUG: .../IO/Socket/SSL.pm:1109: Net::SSLeay::accept -> -1
Jun-01-20 12:14:11 [Worker_1] Error: Worker_1 accept_SSL to client 127.0.0.1 failed IO::Socket::SSL=GLOB(0xa12afa0) (timeout: 5 s) : SSL wants a read first

also mailq adds some extra info.

root@centos7~# mailq
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
A6E1D1260FC      691 Mon Jun  1 12:14:05  se...@xx...
(lost connection with 127.0.0.1[127.0.0.1] while receiving the initial server greeting)
                                         destination@yyyyyyy.yyy

Thanks