How can I make Google Apps trust my Unix/Linux servers to send email?

Question

I would like to use the regular mailx package's /bin/mail app to send email alerts:

echo "Testing alerts from prod server" | mail -s "Example email" [email protected]

I control DNS for mydomain.com. mydomain.com also uses Google Apps.

It seems Google Apps doesn't generally deliver email from random SMTP clients. What's the best way to make Google apps 'trust' my Unix servers to send mail?

Answer 1

You probably need to set up authentication to your smarthost to send email. In this case, the smarthost is presumably some Google server.

Roughly speaking, the way this works is

                                   (authentication)
mail -----------> local mailserver ----------------> remote smarthost

That is, the local mailserver receives the message from the client program (e.g. mail), then authenticates and delivers to the remote smarthost.

You don't state which mail server you are using locally, but I'll use the example of Exim. In the case of Exim, you need to add an entry to the /etc/exim4/passwd.client password file. Here is the default state of that file.

# password file used when the local exim is authenticating to a remote
# host as a client.
#
# see exim4_passwd_client(5) for more documentation
#
# Example:
### target.mail.server.example:login:password

Per the comment, man 5 exim4_passwd_client has more information.

I think most distributions set up a local mailserver by default, though which one is used may vary. Debian and therefore probably Ubuntu set up Exim by default. Note that even the mailserver is installed, it may not be set up to connect to a smarthost by default.

If a local mailserver isn't installed, you should install one. Some programs can authenticate and deliver to a smarthost directly, bypassing the local mailserver, but that is not a good idea.

Answer 2

I had to activate the "Less secure apps" described here to make it accept eMails. But I am using a vanilla gmail account.

Answer 3

Sorry to revive such an old question, but it's still coming up in the search results for this issue.

What I have discovered, is that Google is now doing full "Device Management", so from every device that you want to login from you'll have to visit:

https://accounts.google.com/DisplayUnlockCaptcha

The problem is that I don't have X11 setup on my exim4 server, and I can't figure out the magic CURL formula to go to the link and pull the token that is dynamically generated when you press the "Continue" button on that URL.

Because of this, even when I have configured TLS/mta support in exim4 (SSH/smtps is no longer supported by Google), to connect to smtp.google.com:587 it will not accept my username/password without going to:

https://myaccount.google.com/lesssecureapps?utm_source=google-account&utm_medium=web

to enable access by "less secure app".

I even tested this manually via:

openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlf

Issuing:

EHLO {servername}
AUTH PLAIN {base64 encoded combo username password string}

Every time I get the error:

535-5.7.8 Username and Password not accepted. Learn more at
535 5.7.8  https://support.google.com/mail/?p=BadCredentials l22sm5213582ywl.68 - gsmtp

You get the base64 encoded string with the command:

echo -ne "\0{login_email}\0{login_password}"|base64

Once I set the "enable less secure apps" the exact example above returns:

235 2.7.0 Accepted

And, exim4 likewise starts working.

Can anyone recommend a CLI way to access the captcha link?