Wazuh配置使用腾讯企业邮箱告警

测试环境：

CentOS Linux release 7.6.1810

Wazuh 3.10.2

1、wazuh服务器上安装postfii及相关服务

yum install -y postfix mailx cyrus-sasl cyrus-sasl-plain

2、修改postfix配置文件

# vi /etc/postfix/main.cf

command_directory = /usr/sbin

data_directory = /var/lib/postfix

mail_owner = postfix

home_mailbox = /home/ossec/mail

myhostname = qiyeyou.com

mydomain = qiyeyou.com

myorigin = $mydomain

mydestination = $mydoamin

relayhost = [smtp.exmail.qq.com]:587   #这里使用SSL 587端口，465端口没有测试通

smtp_sasl_auth_enable = yes

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd

smtp_sasl_security_options = noanonymous

smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt

smtp_use_tls = yes

smtp_sender_dependent_authentication = yes

smtp_generic_maps = hash:/etc/postfix/generic

3、生成sasl_passwd文件

# vi etc/postfix/sasl_passwd

[smtp.exmail.qq.com]:587 [email protected]:mypassword

4、生成generic文件，用于将所有系统发送邮箱都转换成[email protected]

# vi etc/postfix/generic

@hostname [email protected]

这里有个小技巧，如果不知道hostname是什么，可以先发一封测试邮件，此时root下是使用hostname发送的，然后查看tail -f /var/log/maillog里的from值，就能获取到@hostname是什么了

5、postmap生成hash数据库

# postmap /etc/postfix/generic

# postmap /etc/postfix/sasl_passwd

6、修改文件归属及权限

# chown root:root /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

# chown root:root /etc/postfix/generic /etc/postfix/generic.db

# chmod 400 /etc/postfix/sasl_passwd 

# chmod 400 /etc/postfix/generic

# chmod 0600 /etc/postfix/sasl_passwd.db

# chmod 0600 /etc/postfix/generic.db

8、重启postfix

# systemctl reload postfix

9、测试postfix配置

echo 'This is a test mail' | mail -s 'This is a test mail' [email protected]

10、修改/var/ossec/ossec.conf文件

# vi /var/ossec/ossec.conf

    yes

    localhost

    [email protected]

    [email protected]

 

参考链接：

https://documentation.wazuh.com/3.10/user-manual/manager/manual-email-report/smtp_authentication.html

https://wazuh.com/blog/how-to-send-email-notifications-with-wazuh/

https://blog.kuoruan.com/106.html