ossec-maild segfault with a certain ossec.conf
Florian Crouzat
Following a long discussion on IRC, it appears that ossec-maild segfault
when the following criterias are matched:
<global>
<logall>yes</logall>
<email_notification>yes</email_notification>
<email_from>oss...@example.com</email_from>
<smtp_server>1.2.3.4</smtp_server>
<email_maxperhour>2000</email_maxperhour>
...
</global>
<alerts>
<log_alert_level>1</log_alert_level>
<email_alert_level>8</email_alert_level>
</alerts>
<!-- Unknown problems in the system -->
<email_alerts>
<rule_id>100002</rule_id>
<email_to>f...@example.com</email_to>
<do_not_delay />
<do_not_group />
</email_alerts>
The relevant part is that this configuration miss a required <email_to>
in <global> and yet, ossec-maild starts fine. Mail logs show "lost
connexion after MAIL from...".
Ossec server logs: ERROR: Error Sending email to 192.168.150.17 (smtp
server)
At a certain point, the daemon segfaults.
Solution: ossec-maild should not start when mandatory configuration
element is missing (<email_to>) in the context of a mail-enabled ossec
server.
--
Cheers,
Florian Crouzat