How do I send mail from Tripwire using SMTP?

Question

I have just installed tripwire using Ubuntu repos and have gone into the configuration files and changed everything to what I want. When in comes to the options for SMTP mail method and the server and port to use, I am stumped. When I run the test email I get this error message.

/usr/sbin/tripwire --test --email blah@nowhere
Sending a test message to: blah@nowhere
### Error: The SMTP connection could not be established.
### Server: localhost
### Exiting...
Email test failed.

I have made appropriate changes to the firewall. I don't have an smtp server installed. Do I need to? Any other ways I could use without installing an SMTP server due to security issues?

Answer 1

If your hostname on your server is not a FQDN (fully qualified domain name - i.e. myhost vs. myhost.example.com, where the latter is a FQDN) you will probably not be able to send out emails with tripwire. This was the case for me using Ubuntu server.

You can check your hostname with:

hostname

And you can change it with:

sudo hostname MYFQDN

where MYFQDN is your new FQDN hostname.

After this you should run a tripwire check:

sudo tripwire --check

You should see various errors now. Tripwire uses HOSTNAME to name various files. You will need to rename a few.

Finally you will also need to reinitialize your database due to the error:

Policy file does not match policy used to create database.

You can do that with:

sudo tripwire -m i

And it should now work.

EDIT: Two additional comments...

1. to permanently change my hostname I had to edit /etc/hostname otherwise your changes will not survive a reboot

2. you may be able to update your database above (instead of using sudo tripwire -m i) by using:

   sudo tripwire -m p

Answer 2

I just installed it on my ubuntu-server box, it needs exim4 to be able to send messages, which is dead easy to configure.

sudo apt-get install tripwire

(This installed bsd-mailx, exim4, exim4-base, exim4-config and exim4-daemon-light

Ran through prompts to setup tripwire passwords etc Then ran:

sudo dpkg-reconfigure exim4-config

Setting up a smarthost (my lan email server) to route messages for me. A quick:

mail -s Test [email protected]

Yip, email is working!

/usr/sbin/tripwire --test --email [email protected]

Results in:

If you receive this message, email notification from tripwire is working correctly.

So there, no changes made to firewall (no need to open ports as we are only sending, not receiving email) and the mta only exists to send tripwire reports.

Now we can start tripwire:

sudo tripwire --init

If you read the /etc/tripwire/twcfg.txt file, you might be forgiven for thinking you can just add your emailserver's details there.. however that doesn't work.

One quick final step, might want to add your email address as an alias for root, so you get roots email!

sudo vim /etc/aliases