Incoming mail

This topic explains incoming email options for FireFlow, by either fetching emails from the mailbox using basic authentication, modern authentication, or by forwarding emails to FireFlow’s MTA.

It is necessary to configure incoming mail for FireFlow, in order to enable users to do the following:

• Submit change requests to FireFlow via email.
• Add comments to change requests by replying to FireFlow system-generated emails.

To configure incoming mail for FireFlow using basic and modern authentication , see Run the FireFlow setup program.

Alternatively, see below if you wish to Configure sendmail to receive forwarded emails as an MTA.

Incoming mail configuration methods

FireFlow supports the following methods for retrieving incoming mail:

Setup MS Exchange Online server for incoming mail

The following steps explain how to configure MS Exchange Online server for incoming mail. For details about working with MS Exchange Online server, see Microsoft documentation.

Do the following:

1. In MS Exchange Online, get your existing Microsoft Entra ID Tenant ID. You will need this for the FireFlow setup.

2. Register a new application and get its Client ID. You will need this for the FireFlow setup.

3. Add Permissions to the application for Microsoft Graph:

   • Application: Mail.ReadWrite

4. Create a user or select an existing user with mailbox to pull emails for FireFlow (For example, [email protected]). You will need the UPN of this user for FireFlow setup.

5. To limit application access to this specific user mailbox only.

   1. Create a mail enabled security group and add the user from previous step to it.

   2. Limit application access only to the security group (requires using application Client ID and the security group UPN).

6. Create a Client Secret for the application. You will need this for the FireFlow setup.

   Important: Be careful with the Client Secret. Treat it like you would any other sensitive password.

   Note: When the Client Secret expires you will need to create a new one and run the FireFlowsetup again. To keep email functionality working correctly, we recommend generating and deploying a new Client Secret before it expires.

Configure sendmail to receive forwarded emails as an MTA

This solution involves configuring the organization’s main email server to forward emails that are addressed to FireFlow to the MTA running on the FireFlow server.

The outcome is that all emails sent to the FireFlow email address ([email protected]) are automatically forwarded to the address on the FireFlow server ([email protected]). The emails are received by the MTA running on the FireFlow server (sendmail) and processed by FireFlow.

Do the following:

1. Create a DNS entry (MX record) for the FireFlow server on the organization’s main DNS server (for example, fireflow.mycompany.com).

2. Log in to the FireFlow server using the username "root" and the related password.

3. If sendmail is not configured to listen on external interfaces, do the following:

   1. Enter the following commands to back up the current sendmail configuration and then edit it:

      cp -p /etc/mail/sendmail.mc /etc/mail/sendmail.mc_bkpcp -p /etc/mail/sendmail.cf /etc/mail/sendmail.cf_bkpvi /etc/mail/sendmail.mc

   2. Comment the following line by adding a dnl # prefix:

      dnl # DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl

   3. Save the file and exit vi.

   4. Enter the following command to compile the sendmail configuration:

      m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf

4. Use the algosec_conf script to configure the hostname to be same as the FireFlow server's DNS entry name.

   For more details, see Configure ASMS machines.

5. Configure sendmail to process emails that are sent to the FireFlow server's address ([email protected]) using fireflow-mailgate, by doing the following:

   1. Enter the following commands to backup the current aliases and then edit it:

      cp -p /etc/aliases /etc/aliases_bkpcp -p /etc/aliases.db /etc/aliases.db_bkpln -s /usr/share/fireflow/local/bin/fireflow-mailgate /etc/smrsh/vi /etc/aliases

   2. Add the following line to the end of the file:

      fireflow:       "|/etc/smrsh/fireflow-mailgate"

   3. Save the file and exit vi.

   4. Enter the following command to compile the aliases file:

      [root@algosec /]# newaliases

   5. Restart sendmail, by entering the following command:

      /etc/init.d/sendmail restart

6. To verify that sendmail was configured correctly, submit a request by sending an email to the FireFlow server's email address.

FireFlow should create a new change request within a couple of minutes.

Troubleshoot issues with sendmail

Do the following:

1. If emails are not reaching FireFlow, you may need to configure sendmail to agree to relay messages from the main SMTP server, by doing the following:

   1. Enter the following commands to backup the current access file and then edit it:

      cp -p /etc/mail/access /etc/mail/access_bkpcp -p /etc/mail/access.db /etc/mail/access.db_bkpvi /etc/mail/access

   2. Add a line to the file, allowing RELAY from the SMTP server's IP address.

      For example, if the SMTP server's IP address is 192.168.2.34, the line should appear as follows:

      192.168.2.34                    RELAY

   3. Save the file and exit vi.

   4. Enter the following command to compile the access file:

      makemap hash /etc/mail/access.db < /etc/mail/access

2. Check whether sendmail is configured to listen on external interfaces, by doing one of the following:

   1. Try to connect to the FireFlow server on port 25, by entering the following command on another machine:

      telnet <SERVER> 25

      Replace <SERVER> with the FireFlow server's IP address.

      If the connection does not succeed, then sendmail is not configured to listen on external interfaces.

   2. Check if there is a process listening on port 25, on an interface other than 127.0.0.1, by entering the following command:

      netstat -an | grep 25

      If the output consists of only one line that specifies 127.0.0.1, then sendmail is not configured to listen on external interfaces.

3. Sometimes the specific setup requires additional steps to configure incoming email as MTA:
   1. Add the DNS name of the FireFlow server to /etc/mail/local-host-names.
   2. Add the following lines to sendmail config:
   • define('MAIL_HUB','DOMAIN.com')dnl
   • define('LOCAL_RELAY','DOMAIN.com')dnl
   3. Create an email address matching what is being forwarded and assign it to the FireFlow Linux user.
   4. Change the entry in the sendmail config to use the external IP instead of localhost.
   5. Allow incoming SMTP through iptables.

Note: All sendmail output is written to the log file /var/log/maillog. This file is useful for troubleshooting purposes.

*/1 * * * * BASH_ENV=/etc/profile bash -c "/usr/share/fireflow/local/bin/fireflow-wsgetmail.pl --debug &>> /var/log/wsgetmail.log"