Add tls support for SMTP output about falcosidekick

[Issif]

Ok I see. Fortunatly, the package I used handles both methods for authentication. I'll create a dedicated output for O365 and see asap for the templating issue.

Thanks. 👍

[Bfoster-melrok]

Yes this can be closed. thank you.

[Issif]

Hello @Bfoster-melrok,

I developped this output for a while now. I tested with AWS SES and I guess it worked with SMTP with SSL. Have you tried to use port 587 with O365?

I don't have an O365 but I can try with a Gmail account.

Thanks for your issue. We'll find out how to help you and make falcosidekick a better product.

[Bfoster-melrok]

Yes, I set:
SMTP_HOSTPORT=smtp.office365.com:587
SMTP_MINIMUMPRIORITY=warning
SMTP_FROM=valid email
SMTP_USER = valid email
SMTP_PASSWORD = matching valid password
SMTP_TO = valid email

but I am not seeing any emails after running the event generator, while seeing them on other outputs.
In the logs I see:
2021/02/14 08:00:41 [ERROR] : SMTP - template: html:3:10: executing "html" at <eq .Priority "Emergency">: error calling eq: incompatible types for comparison
2021/02/14 08:00:41 [DEBUG] : SMTP payload :
2021/02/14 08:00:51 [ERROR] : SMTP - Unrecognized authentication type [BYAPR08CA0031.namprd08.prod.outlook.com]

[Issif]

The first issue is not related to TLS but templating, I'll take a look. Thanks you.

For your TLS issue, I noticed in several answers on web that people was only able to send emails to smtp.office365.com:587, can you give it a try?

[Bfoster-melrok]

I am using that host and port already.

I think it has something to do with this:
https://support.microsoft.com/en-us/office/outlook-com-no-longer-supports-auth-plain-authentication-07f7d5e9-1697-465f-84d2-4513d4ff0145?ui=en-us&rs=en-us&ad=us

https://stackoverflow.com/questions/42305763/connecting-to-exchange-with-golang

[Issif]

@Bfoster-melrok

It should be ok soon for the issue with templating, see #191

For O365, I need to dig more, I need to find a way to test.

[Bfoster-melrok]

sounds good. Thanks for taking a look at this.

[Issif]

@Bfoster-melrok I started a branch for fixing your issue. Can you build or do you want a docker image?

I added an option for SMTP output: autmethod which can be plain (default) or login (for O365)

https://github.com/falcosecurity/falcosidekick/tree/auth-smtp

[Bfoster-melrok]

Thanks, I built it and tested it. I received emails this time, tho they were blank due to the templating issue.

[Issif]

@Bfoster-melrok it should be ok now, I rebased on master for upgrade of Go version and I backported the fix for template.

[Issif]

@Bfoster-melrok without any answer from you, I'll consider this issue as fixed and I'll close it soon.