fail2ban test send email - notifications

I am trying to test the sending of emails with fail2ban, apparently mta = mail should do the trick and I also tried the mail action. But I am not sure how to test if it is working. From what I read action_mwl sends email on start and stop, but it is not doing so. Could you please let me know how to test.
Thanks
[default]
bantime = 600
findtime = 300
banaction = ufw
banaction_allports = iptables-allports
destemail = XXXXXX#gmail.com
sendername = Fail2ban
mta = mail
action = %(action_mwl)s
mail[name=ssh, dest=XXXXXX#gmail.com]
[sshd]
enabled = true
port = XXXXXX
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
[postfix-sasl]
enabled = true
findtime = 10800
bantime = 7200
port = smtp,465,587 submission,imap2,imap3,imaps,pop3,pop3s
filter = postfix[mode=auth]
logpath = /var/log/fail2ban-postfix.log
backend = %(postfix_backend)s
maxretry = 2

This works - Feb 2022
A previous answer of mine was deleted, something I find to be a mistake to do.
The answer, gives a GOOD answer to the question, is a unique solution, where this won't be found on the web.
This solution regarding Fail2Ban is also a solution for ModSecurity Email alert notification, where for ModSecurity blocking a Fail2Ban filter-jail is configured, and then an email for such filter-jail enables the Fail2Ban alert notification for a ModSecurity event.
I have conducted a lot of tests to find the solution, which answers several asked questions.
The solution is to add a second action line with the content:
sendmail[mailcmd='/usr/sbin/sendmail -f "<sender>" "<dest>"', dest="email#recipient.com", sender="fail2ban", sendername="Fail2Ban", name="jail_name"]

Related

BacklogLimitExceeded error with Celery, Django, RabbitMQ (or Redis) and RPC

I have a django application that needs to do sometimes millions of API requests. In order to make it faster, I'm using Celery to send the requests and wait for response before consuming them.
I have tried setting up Celery with Redis as a broker and a backend:
CELERY_BROKER_URL = 'redis://localhost:6379'
CELERY_RESULT_BACKEND = 'redis://localhost:6379'
CELERY_ACCEPT_CONTENT = ['application/json']
CELERY_RESULT_SERIALIZER = 'json'
CELERY_TASK_SERIALIZER = 'json'
That gave me an error: BacklogLimitExceeded: 54c6d0ce-318d-461b-b942-5edcd258b5f1
Then I changed to a RabbitMQ broker and RPC backend :
CELERY_BROKER_URL = 'amqp://guest#localhost//'
CELERY_RESULT_BACKEND = 'rpc://'
CELERY_ACCEPT_CONTENT = ['application/json']
CELERY_RESULT_SERIALIZER = 'json'
CELERY_TASK_SERIALIZER = 'json'
Same error
My code for the API call is quite classic:
I have a list of urls_chunks = [[url1, url2....url1000], [url1, url2....url1000]]
This is needed because of the API rate limit of 1000 per minute (at the end of each call group I sleep 1 minute)
for urls in urls_chunks:
returned_data = []
for url in urls:
result = call_api.delay(url)
returned_data.append(result)
for response in returned_data:
result = response.result
## Do something with the result
sleep(60)
I think all the url calls / responses are being cached somewhere and exceeding memory? but I thought that wouldn't happen with RPC. I thought of using a purge() but that does not work either as it is not supported by RPC...
Anyone know how to deal with this? I'm currently running in dev environment on MacOS, with the intention of deploying to Ubuntu.
Thanks!

Telegram RPC request to destroy specific session

Which is the right RPC in the current Layer 54 in order to destroy a telegram session?
I've tried the:
destroy_session#e7512126 session_id:long = DestroySessionRes;
Which should answer with:
destroy_session_ok#e22045fc session_id:long = DestroySessionRes;
destroy_session_none#62d350c9 session_id:long = DestroySessionRes;
But or I am doing something wrong, or it isn't the right way to do this.
destroy_session#e7512126 session_id:long = DestroySessionRes;
Make sure you use the correct sessionid, clearly not from within the same current session
To destroy the current session, you can simply do it from your Phone:
On Android:
Settings > Privacy and Security > Active Sessions - Tap on a session to terminate

no bounce mail in PHPlist

When I send emails by phplist, I never get any bounce email report in any of above email address. Any idea why?
$message_envelope = 'bounce222#allheart.co.in';
$bounce_mailbox_host = 'localhost';
$bounce_mailbox_user = 'noreply#allheart.co.in';
$bounce_mailbox_password = 'MI5Topsecretpassword';
$bounce_mailbox_port = "110/pop3/notls";
If I use both email same in envelop and user, it starts getting error.
Everything is ok only if I get bounce emails in noreply#allheart.co.in, which is not working at all.
Also, when I get a bounce, it shows in SES, but not in PHPlist. I am sure I am doing something wrong, but can't figure it out.
PHPlist verion v3.0.6
Using amazon SES
phplist configured on hostgator
If you take down the bounce address to a phplist database do one thing. Change your program code in phplist config.php page like this:
$bounce_mailbox_host = "mail.yourdomain.com"
$bounce_mailbox_username = "bounce"
$bounce_mailbox_password = "password"
$bounce_mailbox_port = "993/pop3/notls" instead of "110/notls"
And add:
$manually_process_bounces = 1
Or else create a cron job for this.

JIRA - Send email to anonymous user

I'm trying to figure out a way to send an email to an anonymous user when one creates an issue through the email. What I need is for this anonymous user to receive a notification email when the issue was opened,commented and closed.
According to their official documentation this can only be done if the creator is already a user in JIRA or if a user will be created on the fly. None of which works for me.
The work-arounds that I found so far are:
JEMH - which promises this functionality but looks unstable, meaning it seems to break (at least for a little bit) with every JIRA update and no downtime is acceptable for me.
Writing my own script as was recommended in the similar thread
I have no problems writing my own script but I just wanted to be sure I won't be reinventing the wheel. Are there any other ways of doing this?
I'll be very greatful for any help.
I just noticed this question. JEMH has now evolved into a fully fledged commercial plugin, and has a mass of new features, some of which actually address supporting remote 'anonymous' users for issue creation, essentially turning JIRA into a fully capable email helpdesk solution. Specific template customization is available for this on a per-event basis.
Regarding breakages, staying at the 'latest' release gives developers absolutely no time to catchup. Play smart, give all developers a chance to catchup.
With the depths of JIRA API's that JEMH plumbs, breakages were unfortunately common, but now are less likely thanks to Atlassian stabilizing some core API's in 5.0+. Work also also underway to provide end-end integration testing, which is a mission in its own right!
Here is how I did it using the Script Runner pluging, I've told Jira to get emails from my mailbox, and create issues from them. Than, on the workflow, I saved the sender's email and name to a custom fields using the following script:
from com.atlassian.jira import ComponentManager
import re
cfm = ComponentManager.getInstance().getCustomFieldManager()
# read issue description
description = issue.getDescription()
if (description is not None) and ('Created via e-mail received from' in description):
# extract email and name:
if ('<' in description) and ('>' in description):
# pattern [Created via e-mail received from: name <email#company.com>]
# split it to a list
description_list = re.split('<|>|:',description)
list_length = len(description_list)
for index in range(list_length-1, -1, -1):
if '#' in description_list[index]:
customer_email = description_list[index]
customer_name = description_list[index - 1]
break
else:
# pattern [Created via e-mail received from: email#company.com]
customer_name = "Sir or Madam"
# split it to a list
description_list = re.split(': |]',description)
list_length = len(description_list)
for index in range(list_length-1, -1, -1):
if '#' in description_list[index]:
customer_email = description_list[index]
break
# if the name isn't in the right form, switch it's places:
if (customer_name[0] == '"') and (customer_name[-1] == '"') and (',' in customer_name):
customer_name = customer_name[1:-1]
i = customer_name.index(',')
customer_name = customer_name[i+2:]+" "+customer_name[:i]
# insert data to issue fields
issue.setCustomFieldValue(cfm.getCustomFieldObject("customfield_10401"),customer_email)
issue.setCustomFieldValue(cfm.getCustomFieldObject("customfield_10108"),customer_name)
than, send the mail using the following script:
import smtplib,email
from smtplib import SMTP
from email.MIMEMultipart import MIMEMultipart
from email.MIMEBase import MIMEBase
from email.MIMEText import MIMEText
from email import Encoders
import os
import re
from com.atlassian.jira import ComponentManager
customFieldManager = ComponentManager.getInstance().getCustomFieldManager()
cfm = ComponentManager.getInstance().getCustomFieldManager()
# read needed fields from the issue
key = issue.getKey()
#status = issue.getStatusObject().name
summary = issue.getSummary()
project = issue.getProjectObject().name
# read customer email address
toAddr = issue.getCustomFieldValue(cfm.getCustomFieldObject("customfield_10401"))
# send mail only if a valid email was entered
if (toAddr is not None) and (re.match('[A-Za-z0-9._%+-]+#(?:[A-Za-z0-9-]+\.)+[A-Za-z]{2,4}',toAddr)):
# read customer name
customerName = issue.getCustomFieldValue(cfm.getCustomFieldObject("customfield_10108"))
# read template from the disk
template_file = 'new_case.template'
f = open(template_file, 'r')
htmlBody = ""
for line in f:
line = line.replace('$$CUSTOMER_NAME',customerName)
line = line.replace('$$KEY',key)
line = line.replace('$$PROJECT',project)
line = line.replace('$$SUMMARY',summary)
htmlBody += line + '<BR>'
smtpserver = 'smtpserver.com'
to = [toAddr]
fromAddr = 'jira#email.com'
subject = "["+key+"] Thank You for Contacting Support team"
mail_user = 'jira#email.com'
mail_password = 'password'
# create html email
html = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" '
html +='"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml">'
html +='<body style="font-size:12px;font-family:Verdana">'
html +='<p align="center"><img src="http://path/to/company_logo.jpg" alt="logo"></p> '
html +='<p>'+htmlBody+'</p>'
html +='</body></html>'
emailMsg = email.MIMEMultipart.MIMEMultipart('alternative')
emailMsg['Subject'] = subject
emailMsg['From'] = fromAddr
emailMsg['To'] = ', '.join(to)
emailMsg.attach(email.mime.text.MIMEText(html,'html'))
# Send the email
s = SMTP(smtpserver) # ip or domain name of smtp server
s.login(mail_user, mail_password)
s.sendmail(fromAddr, [to], emailMsg.as_string())
s.quit()
# add sent mail to comments
cm = ComponentManager.getInstance().getCommentManager()
email_body = htmlBody.replace('<BR>','\n')
cm.create(issue,'anonymous','Email was sent to the customer ; Subject: '+subject+'\n'+email_body,False)
content of new_case.template:
Dear $$CUSTOMER_NAME,
Thank you for contacting support team.
We will address your case as soon as possible and respond with a solution very quickly.
Issue key $$KEY has been created as a reference for future correspondence.
If you need urgent support please refer to our Frequently Asked Questions page at http://www.example.com/faq.
Thank you,
Support Team
Issue key: $$KEY
Issue subject: $$PROJECT
Issue summary: $$SUMMARY
All scripts should be attach to the workflow, to Create transition.The scripts are written using Jython, so it needs to be installed to use it.
I doubt this functionality is available already built-in to JIRA, and I have not seen a plugin that will do it.
I looked into this in the past and came up empty. I suspect it is not built in because for many potential customers it would allow them to get away with a 10 user license and yet still support thousands of users.
We went with the unlimited user license instead.
Update: I meant to add to this that you could write a script that would do this, I think. But it looks like it would be a PITA with having to create a custom listener for it to capture changes to the issue https://developer.atlassian.com/display/DOCS/Plugin+Tutorial+-+Writing+event+listeners+with+the+atlassian-event+library
You can send notification to email stored in Jira custom field using Raley Email Notifications
The configuration is trivial, here's an example how to do it:
https://wiki.raleyapps.com/display/RAL/Sending+email+to+value+from+JIRA+issue+custom+field

Check if mail was successfully sent in VB.NET with SMTPClient

I'm trying to create an application that sends an email to an smtp-server.
The server is not set fixed, but will be looked up according to the domainpart of the email-address where the email should be sent to.
Example:
Email To: test#stackoverflow.com
Domain-Part: stackoverflow.com
Result of a MX-Record Lookup (commandline "nslookup -type=mx stackoverflow.com":
stackoverflow.com MX preference = 30, mail exchanger = stackoverflow.com.s9b1.psmtp.com
stackoverflow.com MX preference = 40, mail exchanger = stackoverflow.com.s9b2.psmtp.com
stackoverflow.com MX preference = 10, mail exchanger = stackoverflow.com.s9a1.psmtp.com
stackoverflow.com MX preference = 20, mail exchanger = stackoverflow.com.s9a2.psmtp.com
It would be quite useful, to know if the message was accepted by the mailserver and the message was successfully sent.
What I am able so far is, that I can get the SMTP-Server error code (if there was an error (StatusCode 5xx) by using the System.Net.Mail.SMTPClient Object and its SendAsync Function. There, if there was an error, I get an Exception-Object in the Callback-Event of the SMTPClient
I'm well aware that not every mailserver will tell me if the mailaccount truly exists and then reject my mail with an errorcode but instead just accept the message and then delete it. Therefore I would be grateful for another Method to check if the mail was sent (note: not read, that would be the read confirmation)
The final purpose would be:
Try to send an email to a recipient using it's domains mailserver and if it fails, proceed according to the errorcode (user does not exist -> abort / mailserver did not respond -> use another mailserver if available).
Thanks in advance (and sorry for typos :))
Unfortunately what you are looking for does not exist. Email jumps through so many hops that there is no definition of what "sent" actually means. For instance, your example of stackoverflow actually points to Postini's email servers. Postini probably passes the email around from gateways to AV's and routers. From there they either pool email or pass them on to another email server.
With email, the closest definition of "sent" is "at least I didn't get an error".
Also, a minor thing, but when using nslookup remember to add a trailing period to the domain, otherwise the domain search list is used. Generally not a big deal but every once in a while it might trip you up.
nslookup -type=mx stackoverflow.com.