<div>
Em you are aware that canarytokens is NOT a mailserver....<br />
it is a honeypot. <br />
Anything that connects to it is just logged, or if these are clearly obvious trespassing systems,<br />
they can be blacklisted on a firewall...
</div>


<div>
noci,<br />
<br />
Yes I am aware that opencanary is a honeypot but I am talking about canarytokens which is a different system. Same company, but a different product. Canarytokens appears to have an email client built into it but I cannot determine how to configure it or how to get docker to work with postfix which may be a solution to my problem as well.
</div>


<div>
opencanary is the honeypot, canary tokens are &quot;services&quot; for the honeypot...<br />
This is the &quot;mailserver&quot;:<br />
<a href="https://github.com/thinkst/canarytokens/blob/master/smtpd.tac" rel="ugc nofollow">https://github.com/thinkst/canarytokens/blob/master/smtpd.tac</a><br />
<br />
As you can read on line 106, there is ONLY one mailbox allowed: console.<br />
and as you can see the whole purpose of this canarytoken.. is to just log mail attempts.<br />
And this will f.e. show activity as scanning for a mail server on a network where all mail servers are preconfigured. Meaning some tool is active that doesn't know about those configured services... which might be an intruder.<br />
Just the plain fact that it connects is sufficient proof of its existence. A recv record might give some more evidence about intentions.
</div>


<div>
noci,<br />
<br />
Thank you for the info. So if I install opencanary in addition to canarytokens will that allow for email notifications?
</div>


<div>
What I am after is getting the email alerts to work. The canarytokens webserver has an input field that allows you to specify the email address to notify once a token has been 'stepped on'. When i start bring the docker services up (docker-compose up). I get the following output:<br />
<br />
switchboard | 2016-03-10 18:52:47+0000 [-] Starting factory &lt;channel_input_smtp.Canary<wbr />SMTPFactor<wbr />y object at 0x7fd1c3c84a10&gt;<br />
<br />
So it appears that canarysmtpfactory is running. This is part of my confusion for what I am missing on the host.
</div>


<div>
The docker should have all stuff, i will check it out.<br />
<br />
Just getting all files, did you configure the frontend.env &amp;&nbsp;switchboard.env?<br />
later info follows. (I need to update my dockers &amp;&nbsp;install docker-compose on a test system)
</div>


<div>
Yes, I configured both of those files to match my environment. I can connect to it over port 80 and telnet to port 25.
</div>


<div>
I also checked my spam filter and the emails from the canary system are not arriving so it seems the host is not generating them. I do have &nbsp;local email server I could relay the email off of but I also don't know how to configure the canarytoken host for that.
</div>


<div>
The whole thing should operate as a honey port, so obviously you can connect to those ports.<br />
And access to it will be logged.<br />
<br />
For some reason a cloudfront server is unreachable when i try to pull the frontend &amp;&nbsp;switchboard parts.<br />
So there is problem getting them (all but one are available).
</div>


<div>
Probably 'docker attach switchboard' &nbsp;will allow you to access the configuration files.<br />
for the stuff that sends mail.
</div>


<div>
What about the commands to configure the email once I am attached? And thanks for everything so far. I feel like we're on the right track.
</div>


<div>
Here are the only commands I can find and I've already configured them via the switchboard.env file<br />
<br />
CANARY_MANDRILL_API_KEY=<br />
CANARY_PUBLIC_IP=<br />
CANARY_ALERT_EMAIL_FROM_AD<wbr />DRESS=<br />
CANARY_ALERT_EMAIL_FROM_DI<wbr />SPLAY=<br />
CANARY_ALERT_EMAIL_SUBJECT<wbr />=<br />
CANARY_NXDOMAINS=
</div>


<div>
with `docker ps' you can make a list of the running containers<br />
with `docker -i -t &lt;id of container&gt; exec bash' you can get an active shell in a container.<br />
<br />
and explore from there. Still need to get frontend and switchboard loaded.<br />
Oh the reference to mandrill api key should indicate that the mandrill mailserver is used.<br />
That is a commercial mail service. so hard to estimate how problematic it would be to change that to something else.
</div>


<div>
The service uses mandrill, a mail service where you put an address list and then push mail to through an API.<br />
Hence the CANARY_MANDRILL_API_KEY. &nbsp;So the target address list is with mandrill.<br />
<br />
Access a container:<br />

<pre><code class="code-1 nolinks" id="code-20-41502516-1"><span># docker ps</span>
<span>CONTAINER ID        IMAGE                              COMMAND                  CREATED             STATUS              PORTS                                                        NAMES</span>
<span>d609b3e3b7fd        thinkst/canarytokens_nginx         &quot;/usr/sbin/nginx -c /&quot;   10 hours ago        Up 10 hours         443/tcp, 0.0.0.0:80-&gt;80/tcp                                  nginx</span>
<span>584aa0606afe        thinkst/canarytokens_switchboard   &quot;twistd -noy switchbo&quot;   10 hours ago        Up 10 hours         0.0.0.0:25-&gt;25/tcp, 0.0.0.0:53-&gt;53/tcp, 0.0.0.0:53-&gt;53/udp   switchboard</span>
<span>38f8eb31e170        thinkst/canarytokens_frontend      &quot;twistd -noy frontend&quot;   10 hours ago        Up 10 hours                                                                      frontend</span>
<span>42bf38f280c6        redis                              &quot;/entrypoint.sh redis&quot;   11 hours ago        Up 10 hours         6379/tcp                                                     redis</span>
<span>#</span>
<span># docker exec -t -i 584aa0606afe  bash</span>
<span>root@584aa0606afe:/srv# </span>
</code></pre>
Lets find mandril<br />

<pre><code class="code-1 nolinks" id="code-20-41502516-2"><span>root@584aa0606afe:/srv# grep -i mandril *</span>
<span>channel_output_email.py:Output channel that sends emails. Relies on Mandrill to actually send mails.</span>
<span>channel_output_email.py:import mandrill</span>
<span>channel_output_email.py:            mandrill_client = mandrill.Mandrill(settings.MANDRILL_API_KEY)</span>
<span>channel_output_email.py:                result = mandrill_client.messages.send(message=message,</span>
<span>channel_output_email.py:        except mandrill.Error, e:</span>
<span>channel_output_email.py:            # Mandrill errors are thrown as exceptions</span>
<span>channel_output_email.py:            log.err('A mandrill error occurred: %s - %s' % (e.__class__, e))</span>
<span>channel_output_email.py:            # A mandrill error occurred: &lt;class 'mandrill.UnknownSubaccountError'&gt; - No subaccount exists with the id 'customer-123'....</span>
</code></pre>
Let's see where the alert routine is used...<br />

<pre><code class="code-1 nolinks" id="code-20-41502516-3"><span>root@584aa0606afe:/srv# grep  do_send_alert *.py     </span>
<span>channel.py:        self.do_send_alert(input_channel=input_channel,</span>
<span>channel.py:    def do_send_alert(self, **kwargs):</span>
<span>channel_output_email.py:    def do_send_alert(self, input_channel=None, canarydrop=None, **kwargs):</span>
<span>channel_output_twilio.py:    def do_send_alert(self, input_channel=None, canarydrop=None, **kwargs):</span>
</code></pre>
<br />
So clearly the channel_output_email.py needs a change, and possibly the switchboard.env etc....<br />
<br />
And have you read this: <br />
<a href="http://thinkst.com/stuff/bh2015/thinkst_BH_2015_notes.pdf" rel="ugc">http://thinkst.com/stuff/bh2015/thinkst_BH_2015_notes.pdf</a>
</div>


<div>
Excellent work. I am signing up for mandrill now and I'll let you know how it goes.
</div>


<div>
I am attach to the container but I am not able to run any commands once I do. How can i go about editing the channel_output_email.py file?
</div>


<div>
making progress. found out i need to apt-get update and apt-get install vim when I am attached to the container
</div>


<div>
i guess i am still not clear on what to edit in the channel_output_email.py file
</div>


<div>
The docker container uses mandrill to send email. I had to create a mandrill account, create an api key, and add it the key to the config.
</div>


<div>
That is an option, i had the impression that people were very discontented with mandrill.<br />
and were leaving the platform. And as such there is no need to use mandrill, other then this piece of code.
</div>


<div>
<div class="content wysiwyg-content">
I am using the canarytokens-docker image so that I can host the service myself. I have the server up and running but I cannot get email notifications to work. The documentation is pretty minimal (<a href="https://github.com/thinkst/canarytokens-docker" rel="ugc">https://github.com/thinkst/canarytokens-docker</a>). I feel like I an email client is missing from this picture but again it appears as if this product is supposed to be good-to-go. <br />
<br />
I am running CentOS7, I have installed docker and the canarytokens-docker. I can telnet to port 25 on the server but when inputting the rcpt to: I get the following error: rcpt to 550 Cannot receive for specified address<br />
<br />
Has anyone configured this before? Do I need to somehow integrate docker with postfix or sendmail? Any help would be greatly appreciated. Thanks all.
</div>
</div>


I am using the canarytokens-docker image so that I can host the service myself. I have the server up and running but I cannot get email notifications to work. The documentation is pretty minimal (https://github.com/thinkst/canarytokens-docker). I feel like I an email client is missing from this picture but again it appears as if this product is supposed to be good-to-go. 

I am running CentOS7, I have installed docker and the canarytokens-docker. I can telnet to port 25 on the server but when inputting the rcpt to: I get the following error: rcpt to 550 Cannot receive for specified address

Has anyone configured this before? Do I need to somehow integrate docker with postfix or sendmail? Any help would be greatly appreciated. Thanks all.

550 Cannot receive for specified address

Within Internet message handling services (MHS), a message transfer agent or mail transfer agent (MTA) or mail relay is software that transfers electronic mail messages from one computer to another using a client–server application architecture. A MTA implements both the client (sending) and server (receiving) portions of the Simple Mail Transfer Protocol (SMTP). The terms mail server, mail exchanger, and MX host may also refer to a computer performing the MTA function. The Domain Name System (DNS) associates a mail server to a domain with mail exchanger (MX) resource records containing the domain name of a host providing MTA services.

Email Servers

An email client, email reader or more formally mail user agent (MUA) is a computer program in the category of groupware environments used to access and manage a user's email. A web application that provides message management, composition, and reception functions may internally act as an email client; as a whole, it is commonly referred to as webmail. Likewise, email client may be referred to a piece of computer hardware or software whose primary or most visible role is to work as an email client. Email clients can also have other systems, like calendars, notes and contact managers.

Email Clients

Linux is a UNIX-like open source operating system with hundreds of distinct distributions, including: Fedora, openSUSE, Ubuntu, Debian, Slackware, Gentoo, CentOS, and Arch Linux. Linux is generally associated with web and database servers, but has become popular in many niche industries and applications.