6、Wazuh配置電子郵件警報(SMTP)

6.1、環境安裝依賴

Ubuntu

apt-get install postfix mailutils libsasl2-2 ca-certificates libsasl2-modules

Centos

yum update && yum install postfix mailx cyrus-sasl cyrus-sasl-plain

6.2、配置postfix

在/etc/postfix/main.cf檔案中配置Postfix，將以下行新增到檔案末尾：

Ubuntu

relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/ssl/certs/thawte_Primary_Root_CA.pem
smtp_use_tls = yes
 

CentOS

relayhost = [mail.qq.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt
smtp_use_tls = no

6.3、 配置電子郵件地址和密碼：

echo [smtp.gmail.com]:587 [email protected]:PASSWORD > /etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
chmod 400 /etc/postfix/sasl_passwd
 

6.4、 確保資料庫密碼：

chown root:root /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
chmod 0600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

6.5、 重新啟動：

systemctl reload postfix

6.6、 使用以下命令測試配置：

echo "Test mail from postfix" | mail -s "Test Postfix" -r "[email protected]" [email protected]

您應該在收到電子郵件[email protected]。

6.7、配置Wazuh

在/var/ossec/etc/ossec.conf如下配置Wazuh ：

<ossec_config>

 <global>
   <jsonout_output>yes</jsonout_output>
   <alerts_log>yes</alerts_log>
   <logall>no</logall>
   <logall_json>no</logall_json>
   <email_notification>yes</email_notification>
   <smtp_server>localhost</smtp_server>
   <email_from>[email protected]</email_from>
   <email_to>[email protected]</email_to>
   <email_to>[email protected]</email_to>
   <email_maxperhour>12</email_maxperhour>
   <email_log_source>alerts.log</email_log_source>
 </global>