[luckyworlock]

Hi,
I just found NEMS and install it and love it.
i can configure all the host that i want to monitored but still have a problem receiving notification email.
I have setting the contact details config properly and still can not receive email.
When i test with the command sudo nems-mailtest my@emailaddress this error coming :
Jan 31 10:32:24 nems sendemail[24614]: ERROR => TLS setup failed: SSL connect attempt failed error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Please help, cause i am newbie with this.

regards
Luckyworlock

[BrendonKoz]

Hello luckyworlock,

If you're currently using v1.3.0 of NEMS, RobbieFerguson (the author) just pushed a new version that aims to correct issues with the email notifications not working as expected. To force the update:

1) sudo nems-quickfix
2) Open NEMS SST and press "Save"
3) sudo systemctl restart nagios3

Once this is done, see if you're now able to receive notifications. Also, do be absolutely certain that you've provided a valid email address for your user, and assigned your user to the service notification(s) you intend to receive.

[luckyworlock]

Hi Brendon,

Thanks for the reply, i have follow your instruction but the error still same :

sudo nems-mailtest email@domain.com
Please wait...Feb 01 09:54:23 nems sendemail[14209]: DEBUG => Connecting to 192. 168.0.205:25
Feb 01 09:54:24 nems sendemail[14209]: DEBUG => My IP address is: 192.168.0.17
Feb 01 09:54:24 nems sendemail[14209]: SUCCESS => Received: 220 mail.domain.com Microsoft ESMTP MAIL Service ready at Thu, 1 Feb 2018 09:54:38 +0700
Feb 01 09:54:24 nems sendemail[14209]: INFO => Sending: EHLO nems
Feb 01 09:54:24 nems sendemail[14209]: SUCCESS => Received: 250-mail.domain.com Hello [192.168.0.17], 250-SIZE 10485760, 250-PIPELINING, 250-DSN, 250-ENHANCEDSTATUSCODES, 250-STARTTLS, 250-AUTH, 250-8BITMIME, 250-BINARYMIME, 250-CHUNKING, 250-XEXCH50, 250 XSHADOW
Feb 01 09:54:24 nems sendemail[14209]: INFO => Sending: STARTTLS
Feb 01 09:54:24 nems sendemail[14209]: SUCCESS => Received: 220 2.0.0 SMTP server ready
Feb 01 09:54:24 nems sendemail[14209]: ERROR => TLS setup failed: SSL connect attempt failed error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

Please help

[baggins]

You are probably using the wrong port. Try 587 instead of 25.

BR

[luckyworlock]

i have change it to 587 but still no luck.

[Robbie Ferguson]

Hi Luckyworlock,
I'm so glad you love NEMS! Thanks!

On with your question... this tells us that NEMS tried to send an email using a secure connection, but your SMTP server rejected that connection.

So the first thing to check is that your server port for SMTP is set correctly in NEMS SST. It is very common for 587 to be correct, so if you're unsure, try it as baggins suggested above.

Looking deeper at your output...

192.168.0.205:25 -- this is a LAN IP you have set for your SMTP server.

Are you sure you have an SMTP server on your LAN? And if you do, do you have TLS support configured correctly?

Your issue looks like a problem with your SMTP server, not NEMS.

I have plans to add a switch to NEMS SST that allows you to use non-secure SMTP servers, but because I so HIGHLY recommend against it, I'm in no hurry to do so. You need to make sure your SMTP server supports TLS.

Also, because this is an internal SMTP server, what happens if your SMTP server goes down? NEMS will want to send you an alert, but you'll never get it    Catch 22. I'd recommend using an outside server, like Gmail.

Let me know how it goes.

[luckyworlock]

Hi Robbie,

Thank for the reply..
Im pretty sure my mail server (Exchange 2010) support TLS.
Because the error message is TLS setup failed: SSL connect attempt failed error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed, i wondering how to import personal certificate to NEMS?
or do you have any clue?

[Robbie Ferguson]

Why are you using a self-signed certificate with a SMTP server? I'd suggest giving it a hostname (subdomain) and registering with LetsEncrypt. An SMTP server has to have an external address, accessible from the web (otherwise it cannot be verified and mail will simply be marked as spam) so this comes down to your SMTP server being setup incorrectly, which has nothing to do with NEMS.

I can show you how to disable TLS but I won't do that. The moment I start showing people how to disable security measures that are in place for your protection, some unknowing user who doesn't understand it will do it and get themselves hacked.

Bypassing certificate verification opens you up to MITM attack. Please fix your SMTP server, or use a different one (like Gmail) that already has TLS configured with a cert, as I already stated.

[Robbie Ferguson]

I have decided that I will add a switch to NEMS SST in the next major release (1.4) that allows disabling TLS. It will be made clear in NEMS SST that this is not a recommended setup, but I'd like to add it for those who require it. https://docs.nemslinux.com/todo

I will not however provide details on how to "hack" the script to bypass this protection. Please use a SMTP server that supports TLS and has signed certificates.

[luckyworlock]

hi Robbie,

ok i try google and found this :

sudo nems-mailtest mail_address@yahoo.com
[sudo] password for joe:
Please wait...Feb 05 10:45:05 nems sendemail[10044]: DEBUG => Connecting to smtp.gmail.com:587
Feb 05 10:45:45 nems sendemail[10044]: ERROR => Connection attempt to smtp.gmail.com:587 failed: IO::Socket::INET6: getaddrinfo: Temporary failure in name resolution
Feb 05 10:45:45 nems sendemail[10044]: HINT => Try specifying a different mail relay with the -s option.

Please help..