Stumped!
Where does bro get the host value from?
This is the error I am getting:
Dec 3 13:01:12 host sSMTP[7223]: MAIL FROM:<bro@host>
Dec 3 13:01:12 host sSMTP[7223]: 504 Need Fully Qualified Address
I need 'host' to expand to 'host.my.domain'
Thanks.
Technically from the "hostname" command by default. You can change it by using a FQDN in broctl.cfg like this…
mailfrom = Big Brother <bro@yourserver.com>
.Seth
Should it be mailfrom or MailFrom? either way it didn't appear to
influence anything.
I did fix it so that `hostname` now returns host.domain.ca. this
didn't help either.
I turned on debugging for ssmtp:
Dec 4 14:01:21 hostname sSMTP[75788]: Set Root="postmaster"
Dec 4 14:01:21 hostname sSMTP[75788]: Set MailHub="mail.domain.ca"
Dec 4 14:01:21 hostname sSMTP[75788]: Set RemotePort="25"
Dec 4 14:01:21 hostname sSMTP[75788]: Set RewriteDomain="domain.ca"
Dec 4 14:01:21 hostname sSMTP[75788]: Set HostName="hostname.nscc.ca"
Dec 4 14:01:21 hostname sSMTP[75788]: Set FromLineOverride="True"
Dec 4 14:01:21 hostname sSMTP[75788]: Set MailHub="mail.domain.ca"
Dec 4 14:01:21 hostname sSMTP[75788]: via SMTP Port Number="25"
Dec 4 14:01:21 hostname sSMTP[75788]: 220 mail.domain.ca ESMTP
(blahblahblahblah)
Dec 4 14:01:21 hostname sSMTP[75788]: HELO hostname.domain.ca
Dec 4 14:01:21 hostname sSMTP[75788]: 250 mail.domain.ca Hello
hostname.domain.ca [1.2.3.4], pleased to meet you
Dec 4 14:01:21 hostname sSMTP[75788]: MAIL FROM:<bro@hostname>
Dec 4 14:01:21 hostname sSMTP[75788]: 504 Need Fully Qualified Address
Dec 4 14:01:21 hostname sSMTP[75788]: 504 Need Fully Qualified Address
Just doing: `mail me@domain.ca` from the command line works.
Thoughts?
Thanks.
Hmm - I found this in ./base/frameworks/notice/mail.bro:
## Address that emails will be from.
const mail_from = "Big Brother <bro@localhost>" &redef;
## Reply-to address used in outbound email.
const reply_to = "" &redef;
So it looks like you need to add
redef Notice::mail_from = "Big Brother <bro@host.domain.ca>";
to your local.bro, and possibly change "reply_to" as well. Then run broctl check;broctl install;broctl restart (wash, rinse, spin) as usual.
Worked like a charm. Thanks!
The mailfrom (or MailFrom, it's case insensitive) option in broctl.cfg actually sets this same variable. It's likely overwriting what you are setting in local.bro anyway. 
Glad it's working now.
.Seth
I browsed some of the broctl doc online, and glanced at the source code, and what Seth says is correct - the mods to broctl.cfg should have done the job. I can only surmise that the broctl.cfg you modified was not the one that was being used, or perhaps the wash-rinse-spin sequence failed somehow.
Hmm the only thing I can't find is how the Notice::mail_from var is set given the info in the mailfrom config var. That one escapes me. Running "broctl config" shows it but it is not what is being used by Notice, as far as I can tell.
Hmm the only thing I can't find is how the Notice::mail_from var is set given the info in the mailfrom config var. That one escapes me. Running "broctl config" shows it but it is not what is being used by Notice, as far as I can tell.
There's code in BroControl/install.py that automatically adds associated "redefs" for some config options when doing `broctl install`, but I don't see one that uses MailFrom to add a "redef Notice::mail_from=…". So I think that's a bug.
Jon
Arg! Thanks Jon.
.Seth