0

i am sending email notifications from OSSEC active response script firewall-drop.sh, but when the email is sent through it, the FROM address is like this

-@mydomain.com it should be ossec@mydomain.com or root@ossec.mydomain.com

As the script is running from root.

i have tried with different email clients, like mail, mutt, mailx, sendEmail and other python and perl based scripts, all of them add the "-" before @mydomain.com. What could be the reason?

Farhan
  • 4,210
  • 9
  • 47
  • 76

1 Answers1

1

It's fairly common to send automated alerts from email addresses that don't exist, since no one's going to bother checking the accounts for email or want to get spammed with responses to it, or end up having two systems send automatic replies to each other in an endless loop.

So, actually, you probably don't want notifications coming from a real email address.

That said, the reason you're getting alerted from -@yourdomain.com is because you haven't configured the from field in your email script. If you don't tell it who to send the email from, it'll default to -, because null isn't a valid value.

Check this out for a quick Perl email script, and note the $from variable.

$from= 'webmaster@YOURDOMAIN.COM'

HopelessN00b
  • 53,385
  • 32
  • 133
  • 208
  • in all email clients, i have set the FROM address to valid one already, stil it picks the Null... – Farhan Aug 16 '12 at 12:21
  • @Frank Set the from field in your script, as in the webpage I linked. – HopelessN00b Aug 16 '12 at 12:24
  • As i said, i have already tried this wil many clients, it give the same result: Aug 16 13:49:09 mserver qmail: 1345121349.477795 delivery 33663: failure: Connected_to_92.45.5.74_but_sender_was_rejected./Remote_host_said:_501_5.1.7_Bad_sender_address_syntax/ – Farhan Aug 16 '12 at 12:51
  • @Frank `Remote_host_said:_501_5.1.7_Bad‌​_sender_address_syntax` Well, that's what's wrong, then. The mail server you're sending to is telling you you're using the wrong syntax for the sender. – HopelessN00b Aug 16 '12 at 13:59