Configure SMTP Server to Use AWS SES

Introduction

This document describes how to configure your Secure Network Analytics Manager (SNA) to use Amazon Web Services Simple Email Service (AWS SES).

Prerequisites

Requirements

Cisco recommends knowledge of these topics:

• AWS SES

Components Used

The information in this document is based on these software and hardware versions:

• Stealthwatch Management Console v7.3.2

• AWS SES Services as they exist on 25MAY2022 with Easy DKIM

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Configure

Review AWS SES configuration

Three bits of information are required from AWS:

1. AWS SES location
2. SMTP Username
3. SMTP Password

Note: AWS SES located in the sandbox is acceptable but be aware of the limitations for sandbox environments: https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html

In the AWS console, navigate to Amazon SES, then select Configuration and click  Verified Identities.

You must have a verified domain. A verified email address is not required. Refer to AWS documentation https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html#verify-domain-procedure

Note the location of your SMTP endpoint. This value is needed later.

Create AWS SES SMTP Credentials

In the AWS console, navigate to Amazon SES, then click  Account Dashboard. 

Scroll down to the " Simple Mail Transfer Protocol (SMTP) settings" and click  Create SMTP Credentials when you are ready to complete this configuration.

Older, unused credentials (approximately 45 days) do not seem to error as invalid credentials.

In this new window, update the username to any value and click  Create.

When the page presents the credentials, save them. Keep this browser tab open.

Configure SNA Manager SMTP Configuration

Login to the SNA Manager, and open SMTP Notifications section

1. Open Central Management > Appliance Manager.
2. Click the Actions menu for the appliance.
3. Select Edit Appliance Configuration.
4. Select the General tab.
5. Scroll down to SMTP Configuration
6. Enter the values gathered from AWS
   1. SMTP Server: This is the SMTP Endpoint location gathered from the SMTP Settings from the AWS SES Account Dashboard page
   2. Port: Enter 25, 587, or 2587
   3. From Email: This can be set to any email address that contains the AWS Verified Domain

   4. User Name: This is the SMTP user name that was presented on the last step in the Review AWS SES Configuration section

   5. Password: This is the SMTP password that was presented on the last step in the Review AWS SES Configuration section

   6. Encryption Type: Select STARTTLS (If you select SMTPS, edit the port to 465, or 2465)
7. Apply the settings and wait for the SNA Manager to return to an UP state in Central Management

Gather AWS Certificates

Establish an SSH session to the SNA Manager, and login as the root user.

Review these three items

• Change the SMTP endpoint location (for example email-smtp.us-east-1.amazonaws.com)
• Change the port used (for example default of 587 for STARTTLS)
• The commands have no STDOUT, the prompt is returned upon completion

For STARTTLS (default port of 587):

openssl s_client -starttls smtp -showcerts -connect email-smtp.us-east-1.amazonaws.com:587 <<< "Q" 2>/dev/null > mycertfile.crt awk 'split_after == 1 {n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > "cacert" n ".pem"}' < mycertfile.crt for i in `ls -t1 *.pem`; do cp $i $(awk -F "CN=" '/s:/ {gsub(/ /,x ); print $NF}' $i).pem ; done ; rm -f cacert* mycertfile.crt

For SMTPS (default port of 465):

openssl s_client -showcerts -connect email-smtp.us-east-1.amazonaws.com:465 <<< "Q" 2>/dev/null > mycertfile.crt awk 'split_after == 1 {n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > "cacert" n ".pem"}' < mycertfile.crt for i in `ls -t1 *.pem`; do cp $i $(awk -F "CN=" '/s:/ {gsub(/ /,x ); print $NF}' $i).pem ; done ; rm -f cacert* mycertfile.crt

The certificate files with the pem extension is created created in the current working directory, take not of this directory (output from pwd command / last line)

sna_manager:~# openssl s_client -starttls smtp -showcerts -connect email-smtp.us-east-1.amazonaws.com:587 <<< "Q" 2>/dev/null > mycertfile.crt 
sna_manager:~# awk 'split_after == 1 {n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > "cacert" n ".pem"}' < mycertfile.crt 
sna_manager:~# for i in `ls -t1 *.pem`; do cp $i $(awk -F "CN=" '/s:/ {gsub(/ /,x ); print $NF}' $i).pem ; done ; rm -f cacert* mycertfile.crt 
sna_manager:~# ll 
total 16 
-rw-r--r-- 1 root root 1648 May 27 14:54 Amazon.pem 
-rw-r--r-- 1 root root 1829 May 27 14:54 AmazonRootCA1.pem 
-rw-r--r-- 1 root root 2387 May 27 14:54 email-smtp.us-east-1.amazonaws.com.pem 
-rw-r--r-- 1 root root 1837 May 27 14:54 StarfieldServicesRootCertificateAuthority-G2.pem 
sna_manager:~# pwd 
/root

Download the files created on the SNA Manager to your local machine with the file transfer program of your choice (Filezilla, winscp, etc), and add these certificates to the SNA Manager trust store in Central Management.

1. Open Central Management > Appliance Manager.
2. Click the Actions menu for the appliance.
3. Select Edit Appliance Configuration.
4. Select the General tab.
5. Scroll down to Trust Store
6. Select Add New
7. Upload each of the certificates, recommed to use the filename as the Friendly Name

Configure Response Management Email Action

Login to the SNA Manager, and open the Response Management section

1. Select the Configure tab in the main ribbon along the top of the screen

2. Select Response Management

3. From the Response Management page, select Actions tab

4. Select Add New Action

5. Select Email

   1. Provide a name for this Email action

   2. Enter the recipient email address in the "To" field (note this must belong to the domain verified in AWS SES)

   3. The subject can be anything.
      
6. Click  Save

Verify

Login to the SNA Manager, and open the Response Management section:

1. Select the Configure tab in the main ribbon along the top of the screen
2. Select Response Management
3. From the Response Management page, select Actions tab

4. Select the ellipsis in the Actions column for the row of the email action you configured in the Configure Response Management Email Action section, and select Edit.

5. Select Test Action and if the configuration is valid, a success message is presented, and an email is delivered.
   In the email header amazonses is shown in the " Received" field, and amazonses, along with the verified domain in the ARC-Authentication-Results (AAR) Chain
   
   
6. If the test was unsuccessful,a banner is presented at the top of the screen - continue to the troubleshoot section
   

Troubleshoot

The /lancope/var/logs/containers/sw-reponse-mgmt.log file contains the error messages for the test actions. The most common error, and the fix is listed in the table.
Note, that the error messages listed in the table are just a portion of the error log line

Addendum: DH key too small.

This is an AWS side issue, as they use 1024 bit keys when DHE and EDH ciphers are used (logjam susceptible) and the SNA Manager refuses to continue the SSL session. The command output shows the server temp keys from the openssl connection when DHE/EDH ciphers are used.

sna_manager:~# openssl s_client -starttls smtp -connect email-smtp.us-east-2.amazonaws.com:587 -cipher "EDH" <<< "Q" 2>/dev/null | grep "Server Temp" 
Server Temp Key: DH, 1024 bits 
sna_manager:~# openssl s_client -starttls smtp -connect email-smtp.us-east-2.amazonaws.com:587 -cipher "DHE" <<< "Q" 2>/dev/null | grep "Server Temp" 
Server Temp Key: DH, 1024 bits 
sna_manager:~# openssl s_client -starttls smtp -connect email-smtp.us-east-2.amazonaws.com:587 <<< "Q" 2>/dev/null | grep "Server Temp" 
Server Temp Key: ECDH, P-256, 256 bits

The only available workaround is to remove all DHE and EDH ciphers with the command as the root user on the SMC, AWS selects a ECDHE cipher suite and the connection succeeds.

cp /lancope/services/swos-compliance/security/tls-ciphers /lancope/services/swos-compliance/security/tls-ciphers.bak ; > /lancope/services/swos-compliance/security/tls-ciphers ; echo "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_CCM_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:AES256-GCM-SHA384" > /lancope/services/swos-compliance/security/tls-ciphers ; docker restart sw-response-mgmt

Related Information

• https://docs.aws.amazon.com/ses/latest/dg/setting-up.html
• https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html#verify-domain-procedure
• https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html
• https://docs.aws.amazon.com/ses/latest/dg/smtp-connect.html
• Technical Support & Documentation - Cisco Systems