How to receive e-mail alerts from internal devices



  • Maybe it's me, but I find the search function of this website hit or miss, so forgive me if there are already good resources available for this question, and point me to the right place.

    Goal:

    We have a number of internal devices that have the ability to send logs via e-mail, however I do not currently have anything setup to do this. What I would like ideally is to be able to...

    1. Customize the "From" address based on the device being sent or
      1A) Customize or format the subject of the e-mail being sent to more easily identify from what device it's coming (I would think this would rely more on the device sending the email vs the "email server" itself.

    2. Specify based on device and log messages different recipients. For instance, we have some engineers who would need to receive these alerts from some devices but not all.

    Additional Info:

    • We currently are Office365 users.
    • Our internal Windows domain is a .local (if that matters)
    • For my firewall currently, I'm authenticating logs through my email account and Office365 so it appears as though I'm emailing myself. I've had some difficulty getting this config setup in other devices, and I would just like to customize the "From" if possible based on device without setting up a new mailbox for each device (if possible).

    Ideally, I'd do this in a Linux server. I've setup a basic Postfix server after finding Basic Email Sending with Linux. I've got that postfix server sending email direct, but am having trouble connecting other devices to send through it.

    Hopefully that's enough info of my goal for someone to help point me in the right direction.



  • That Postfix server needs to be set to accept relay messages from those other machines. Typically this is done by IP address.



  • Did you setup the firewall to allow access to postfix?

    firewall-cmd --add-service=smtp --permanent
    firewall-cmd --reload
    


  • Yeah, I'd love to use a single email relay. I've just been setting up each server with Postfix but that's inefficient. Would love to direct all device emails that can't autosend via Office 365 through this single relay. A how-to would be ideal. I was searching for this very thing here a couple days ago and couldn't find anything.



  • In the /etc/postfix/main.cf file, the following would need to be changed:
    inet_interfaces needs to be changed from localhost to all
    mynetworks should include the networks or hosts that will be accessing your postfix server.



  • Before we get too deep off into postfix specifics, my main question is about the proper or "best" way to accomplish this and whether postfix is that method.

    @black3dynamite I'm implementing these steps now. Will test once I've tweaked these settings and see where I get. Thanks



  • @zachary715

    I'm doing the same thing (also on a .local) using an O365 relay server. It's a Windows Server set up to be an SMTP relay for O365.

    If you fire an email to it, it'll relay it to O365, and send as whatever "from address" you use, so long as the SMTP Relay account is able to send on behalf of that email.

    What I do, is set up an O365 security group for each email I want to send as.

    Example:

    • Set up a security group in O365 and set the email to [email protected]
    • Give the "smtp relay" account permission to send as/send on behalf on the above.
    • Use that email as the "from address", and point your server to the SMTP relay server.

    I haven't done it on Linux, so I'm completely unfamiliar with that, but I can walk you through setting it up on a Windows Server using the built-in components (it uses IIS), if you go the Windows Server route.



  • @black3dynamite said in How to receive e-mail alerts from internal devices:

    In the /etc/postfix/main.cf file, the following would need to be changed:
    inet_interfaces needs to be changed from localhost to all
    mynetworks should include the networks or hosts that will be accessing your postfix server.

    I've also added my fixed IP address to the SPF record in Office 365. I discovered a while ago that without this, emails eventually get blocked as unauthorised to send on behalf of the domain I was using.



  • @tim_g said in How to receive e-mail alerts from internal devices:

    @zachary715

    I'm doing the same thing (also on a .local) using an O365 relay server. It's a Windows Server set up to be an SMTP relay for O365.

    If you fire an email to it, it'll relay it to O365, and send as whatever "from address" you use, so long as the SMTP Relay account is able to send on behalf of that email.

    What I do, is set up an O365 security group for each email I want to send as.

    Example:

    • Set up a security group in O365 and set the email to [email protected]
    • Give the "smtp relay" account permission to send as/send on behalf on the above.
    • Use that email as the "from address", and poing yoru server to the SMTP relay server.

    I haven't done it on Linux, so I'm completely unfamiliar with that, but I can walk you through setting it up on a Windows Server using the built-in components (it uses IIS), if you go the Windows Server route.

    That works for those devices that can self-authenticate via an actual account on Office 365. That works for my Sophos XG UTM for example but not for the majority of Linux servers I'm running.



  • @nashbrydges said in How to receive e-mail alerts from internal devices:

    @black3dynamite said in How to receive e-mail alerts from internal devices:

    In the /etc/postfix/main.cf file, the following would need to be changed:
    inet_interfaces needs to be changed from localhost to all
    mynetworks should include the networks or hosts that will be accessing your postfix server.

    I've also added my fixed IP address to the SPF record in Office 365. I discovered a while ago that without this, emails eventually get blocked as unauthorised to send on behalf of the domain I was using.

    And I've seen this mentioned, but didn't know if I even needed to go through Office 365 to accomplish this since I'm doing internal only. I was running into this before though when trying to send e-mails from the UPS and they were blocked as spoofed.



  • @zachary715 said in How to receive e-mail alerts from internal devices:

    Before we get too deep off into postfix specifics, my main question is about the proper or "best" way to accomplish this and whether postfix is that method.

    @black3dynamite I'm implementing these steps now. Will test once I've tweaked these settings and see where I get. Thanks

    Yes, that's how we do it.



  • @tim_g said in How to receive e-mail alerts from internal devices:

    @zachary715

    I'm doing the same thing (also on a .local) using an O365 relay server. It's a Windows Server set up to be an SMTP relay for O365.

    If you fire an email to it, it'll relay it to O365, and send as whatever "from address" you use, so long as the SMTP Relay account is able to send on behalf of that email.

    What I do, is set up an O365 security group for each email I want to send as.

    Example:

    • Set up a security group in O365 and set the email to [email protected]
    • Give the "smtp relay" account permission to send as/send on behalf on the above.
    • Use that email as the "from address", and point your server to the SMTP relay server.

    I haven't done it on Linux, so I'm completely unfamiliar with that, but I can walk you through setting it up on a Windows Server using the built-in components (it uses IIS), if you go the Windows Server route.

    @Tim_G Looks like a good opportunity for a write-up/guide 😉 I'd like to do this Linux first but if all else fails, I will revert to this. Would be nice to have a write-up to fall back on and for others who come looking. I'd love to know how to do it both ways for future use case.



  • To have postfix relay to Office 365, you would need to setup postfix to use TLS.

    If you are using Fedora make sure you have these packages installed:

    sudo dnf -y install postfix cyrus-sasl cyrus-sasl-plain mailx
    

    Installing cyrus-sasl and cyrus-sasl-plain is needed if you want to configure postfix to use TLS.

    Start at the section where it talks about configuring postfix to use TLS.
    https://gordan.jandreoski.me/how-to-configure-postfix-relay-to-office365-on-ubuntu-14-04/



  • @black3dynamite said in How to receive e-mail alerts from internal devices:

    To have postfix relay to Office 365, you would need to setup postfix to use TLS.

    If you are using Fedora make sure you have these packages installed:

    sudo dnf -y install postfix cyrus-sasl cyrus-sasl-plain mailx
    

    Installing cyrus-sasl and cyrus-sasl-plain is needed if you want to configure postfix to use TLS.

    Start at the section where it talks about configuring postfix to use TLS.
    https://gordan.jandreoski.me/how-to-configure-postfix-relay-to-office365-on-ubuntu-14-04/

    Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.



  • @black3dynamite said in How to receive e-mail alerts from internal devices:

    To have postfix relay to Office 365, you would need to setup postfix to use TLS.

    If you are using Fedora make sure you have these packages installed:

    sudo dnf -y install postfix cyrus-sasl cyrus-sasl-plain mailx
    

    Installing cyrus-sasl and cyrus-sasl-plain is needed if you want to configure postfix to use TLS.

    Start at the section where it talks about configuring postfix to use TLS.
    https://gordan.jandreoski.me/how-to-configure-postfix-relay-to-office365-on-ubuntu-14-04/

    For Postfix to enable TLS, all you need to add to the main config file is this line:

    smtp_tls_security_level = may
    

    Email headers confirm that emails are encrypted. I've checked on Gmail as well as my Office 365 email.



  • @nashbrydges said in How to receive e-mail alerts from internal devices:

    @black3dynamite said in How to receive e-mail alerts from internal devices:

    To have postfix relay to Office 365, you would need to setup postfix to use TLS.

    If you are using Fedora make sure you have these packages installed:

    sudo dnf -y install postfix cyrus-sasl cyrus-sasl-plain mailx
    

    Installing cyrus-sasl and cyrus-sasl-plain is needed if you want to configure postfix to use TLS.

    Start at the section where it talks about configuring postfix to use TLS.
    https://gordan.jandreoski.me/how-to-configure-postfix-relay-to-office365-on-ubuntu-14-04/

    For Postfix to enable TLS, all you need to add to the main config file is this line:

    smtp_tls_security_level = may
    

    Email headers confirm that emails are encrypted. I've checked on Gmail as well as my Office 365 email.

    That's good know.



  • @black3dynamite Here is what it looks like at the Gmail end (personal details obfuscated).
    0_1521650451195_d0d47ddd-5b41-49e8-a4b2-8d10eada797c-image.png



  • @black3dynamite said in How to receive e-mail alerts from internal devices:

    In the /etc/postfix/main.cf file, the following would need to be changed:
    inet_interfaces needs to be changed from localhost to all
    mynetworks should include the networks or hosts that will be accessing your postfix server.

    Made these changes along with ensuring that SMTP ports were open and I am now receiving email from the UPS device via Postfix.

    Settings on UPS:

    From: [email protected]
    SMTP Server: Postfix server IP Address (192.168.1.x)
    Port: 25
    No authentication

    If this works on the rest of my devices, then I believe we'll be in business and I won't have to involve Office365 at all.



  • @nashbrydges said in How to receive e-mail alerts from internal devices:

    @tim_g said in How to receive e-mail alerts from internal devices:

    @zachary715

    I'm doing the same thing (also on a .local) using an O365 relay server. It's a Windows Server set up to be an SMTP relay for O365.

    If you fire an email to it, it'll relay it to O365, and send as whatever "from address" you use, so long as the SMTP Relay account is able to send on behalf of that email.

    What I do, is set up an O365 security group for each email I want to send as.

    Example:

    • Set up a security group in O365 and set the email to [email protected]
    • Give the "smtp relay" account permission to send as/send on behalf on the above.
    • Use that email as the "from address", and poing yoru server to the SMTP relay server.

    I haven't done it on Linux, so I'm completely unfamiliar with that, but I can walk you through setting it up on a Windows Server using the built-in components (it uses IIS), if you go the Windows Server route.

    That works for those devices that can self-authenticate via an actual account on Office 365. That works for my Sophos XG UTM for example but not for the majority of Linux servers I'm running.

    No authentication is needed, that's what the SMTP server is for. For internal devices, so long as they all an SMTP server and port, optionally a from address... that's all that is needed. The SMTP server (O365 Relay) takes care of the auth.



  • @zachary715 said in How to receive e-mail alerts from internal devices:

    @black3dynamite said in How to receive e-mail alerts from internal devices:

    To have postfix relay to Office 365, you would need to setup postfix to use TLS.

    If you are using Fedora make sure you have these packages installed:

    sudo dnf -y install postfix cyrus-sasl cyrus-sasl-plain mailx
    

    Installing cyrus-sasl and cyrus-sasl-plain is needed if you want to configure postfix to use TLS.

    Start at the section where it talks about configuring postfix to use TLS.
    https://gordan.jandreoski.me/how-to-configure-postfix-relay-to-office365-on-ubuntu-14-04/

    Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.

    You don't need a relay if whatever is sending alerts/emails does full authentication by itself. The problem is that many things do not, and many do not even do authentication at all and just have a spot for server and port only.



  • @black3dynamite said in How to receive e-mail alerts from internal devices:

    To have postfix relay to Office 365, you would need to setup postfix to use TLS.

    Not last time I checked. I do it because i like encryption, but it is not required.



  • @zachary715 said in How to receive e-mail alerts from internal devices:

    Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.

    How is the email "internal"? Do you have a local email server hosting email?
    I do not think you even understand what you are asking here.



  • @zachary715 said in How to receive e-mail alerts from internal devices:

    • We currently are Office365 users.

    You have no internal email. period.





  • Setting up a Postfix relay. I need to rewrite this as I took the blog down.

    http://web.archive.org/web/20170320084803/http://jaredbusch.com/2014/12/28/setup-postfix-on-centos-7-to-relay-mail-to-an-internal-exchange-server/

    Note: this works for O365 also if you setup your public IP as a connectoer in Office 365.



  • @jaredbusch said in How to receive e-mail alerts from internal devices:

    @zachary715 said in How to receive e-mail alerts from internal devices:

    Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.

    How is the email "internal"? Do you have a local email server hosting email?
    I do not think you even understand what you are asking here.

    Yeah good point. It has to go external since I'm using Office 365. My point though was simply do I need to relay to Office 365 to get what I need, or is a simple postfix server sufficient? I have my first device setup and working fine the way I intended. Not sure if other devices will cooperate as easy or not.

    Is there a security or other reason to not set it up this way? Are there any benefits to running the relay through Office 365? All questions I have to better wrap my head around this.



  • @jaredbusch said in How to receive e-mail alerts from internal devices:

    Setting up a Postfix relay. I need to rewrite this as I took the blog down.

    http://web.archive.org/web/20170320084803/http://jaredbusch.com/2014/12/28/setup-postfix-on-centos-7-to-relay-mail-to-an-internal-exchange-server/

    Note: this works for O365 also if you setup your public IP as a connectoer in Office 365.

    Yeah I actually saw that thread but as you stated, the blog was down so I just started a new thread to discuss it. I wanted to know more than "How to setup with Office365" though to understand why that was needed at all. Obviously will be very helpful though if I get to needing it so thanks for sharing.



  • @zachary715 said in How to receive e-mail alerts from internal devices:

    @jaredbusch said in How to receive e-mail alerts from internal devices:

    @zachary715 said in How to receive e-mail alerts from internal devices:

    Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.

    How is the email "internal"? Do you have a local email server hosting email?
    I do not think you even understand what you are asking here.

    Yeah good point. It has to go external since I'm using Office 365. My point though was simply do I need to relay to Office 365 to get what I need, or is a simple postfix server sufficient?

    You have to SEND to O365 always. You have no local mail server to send to. It is not necessarily a "relay". It can just send to anyone, your own MX included.



  • @jaredbusch said in How to receive e-mail alerts from internal devices:

    @zachary715 said in How to receive e-mail alerts from internal devices:

    @jaredbusch said in How to receive e-mail alerts from internal devices:

    @zachary715 said in How to receive e-mail alerts from internal devices:

    Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.

    How is the email "internal"? Do you have a local email server hosting email?
    I do not think you even understand what you are asking here.

    Yeah good point. It has to go external since I'm using Office 365. My point though was simply do I need to relay to Office 365 to get what I need, or is a simple postfix server sufficient?

    You have to SEND to O365 always. You have no local mail server to send to. It is not necessarily a "relay". It can just send to anyone, your own MX included.

    I understand what you're saying. Step Q of your guide is what I've skipped thus far and I'm trying to determine if/when it's needed. I haven't connected this postfix server to any SMTP connectors with Office365. As far as Office 365 is concerned, this postfix server doesn't exist and isn't interacting, other than when it sends email to one of its recipients.

    In what scenario would I need/want to connect the postfix server to an SMTP connector with Office 365? What functionality, security, or otherwise do I gain?



  • @tim_g said in How to receive e-mail alerts from internal devices:

    @zachary715 said in How to receive e-mail alerts from internal devices:

    @black3dynamite said in How to receive e-mail alerts from internal devices:

    To have postfix relay to Office 365, you would need to setup postfix to use TLS.

    If you are using Fedora make sure you have these packages installed:

    sudo dnf -y install postfix cyrus-sasl cyrus-sasl-plain mailx
    

    Installing cyrus-sasl and cyrus-sasl-plain is needed if you want to configure postfix to use TLS.

    Start at the section where it talks about configuring postfix to use TLS.
    https://gordan.jandreoski.me/how-to-configure-postfix-relay-to-office365-on-ubuntu-14-04/

    Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.

    You don't need a relay if whatever is sending alerts/emails does full authentication by itself. The problem is that many things do not, and many do not even do authentication at all and just have a spot for server and port only.

    Ahh so I skipped over this. The device I'm sending from now doesn't require authentication, although it is available. I have skipped it. Should I desire authentication for security reasons? Are there other devices I'll likely run into which will require authentication, therefore requiring me to connect to Office365?