[gentoo-user] google SMTP with postfix - Password not accepted

[gentoo-user] google SMTP with postfix - Password not accepted

[thelma]

Trying to send email via Google SMTP and postfix but getting authentication failed.

white postfix/smtp[32223]: 62E5618008F: to=<user@google.com>, relay=smtp.gmail.com[173.194.203.109]:587, delay=2390, delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and Password not accepted. Learn more at?535 5.7.8  https://support.google.com/mail/?p=BadCredentials n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)

relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes

/etc/postfix/sasl_passwd
[smtp.gmail.com]:587    USERNAME@gmail.com:PASSWORD
postmap /etc/postfix/sasl_passwd
/etc/init.d/postfix restart

The user and password are correct.

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Michael]

[-- Attachment #1: Type: text/plain, Size: 2218 bytes --]

On Tuesday, 20 June 2023 06:29:52 BST thelma@sys-concept.com wrote:
> Trying to send email via Google SMTP and postfix but getting authentication
> failed.
> 
> white postfix/smtp[32223]: 62E5618008F: to=<user@google.com>,
> relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
> delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
> failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
> Password not accepted. Learn more at?535 5.7.8
>  https://support.google.com/mail/?p=BadCredentials
> n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
> 
> relayhost = [smtp.gmail.com]:587
> smtp_sasl_auth_enable = yes
> smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
> smtp_sasl_security_options = noanonymous
> smtp_tls_CAfile = /etc/postfix/cacert.pem
> smtp_use_tls = yes
> 
> /etc/postfix/sasl_passwd
> [smtp.gmail.com]:587    USERNAME@gmail.com:PASSWORD
> postmap /etc/postfix/sasl_passwd
> /etc/init.d/postfix restart
> 
> The user and password are correct.

I think I know what the problem is - but I do not use postfix and can't 
confirm it on my side:

Since mid 2022 Google requires 2FA to allow login into their server.  Until 
then it used to be the case you could select in their security settings to 
"Allow Less Secure Apps", generate an application specific password hash using 
their GUI and use this in your mail client.  For a year now you won't be able 
to do this, unless you first provide a mobile phone number to Google.

If you *must* use Google, they you'll have to login into their Google account 
security panel, set 2FA, attempt to connect with your postfix client, create 
an application pass code hash for your postfix via their GUI and use that as 
your password in your postfix settings.  If you change your IP address, or 
your PC/client, or anything else Google are using to fingerprint and profile 
your device, then you'll have to login again in their GUI to confirm you are 
who you are and your client is a legitimate device owned by you.

They have many relevant help pages to explain all this, so you should search 
for specific guidance, or find another email provider with less onerous user 
profiling demands.  ;-)

HTH

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[William Kenworthy]

getmail can facilitate getting googlemail into postfix.  In my case, it 
fetches an mail then invokes sendemail to forward into postfix.  The 
docs for the google side of the equation are quite good.

BillK


On 20/6/23 16:30, Michael wrote:
> On Tuesday, 20 June 2023 06:29:52 BST thelma@sys-concept.com wrote:
>> Trying to send email via Google SMTP and postfix but getting authentication
>> failed.
>>
>> white postfix/smtp[32223]: 62E5618008F: to=<user@google.com>,
>> relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
>> delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
>> failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
>> Password not accepted. Learn more at?535 5.7.8
>>   https://support.google.com/mail/?p=BadCredentials
>> n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
>>
>> relayhost = [smtp.gmail.com]:587
>> smtp_sasl_auth_enable = yes
>> smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
>> smtp_sasl_security_options = noanonymous
>> smtp_tls_CAfile = /etc/postfix/cacert.pem
>> smtp_use_tls = yes
>>
>> /etc/postfix/sasl_passwd
>> [smtp.gmail.com]:587    USERNAME@gmail.com:PASSWORD
>> postmap /etc/postfix/sasl_passwd
>> /etc/init.d/postfix restart
>>
>> The user and password are correct.
> I think I know what the problem is - but I do not use postfix and can't
> confirm it on my side:
>
> Since mid 2022 Google requires 2FA to allow login into their server.  Until
> then it used to be the case you could select in their security settings to
> "Allow Less Secure Apps", generate an application specific password hash using
> their GUI and use this in your mail client.  For a year now you won't be able
> to do this, unless you first provide a mobile phone number to Google.
>
> If you *must* use Google, they you'll have to login into their Google account
> security panel, set 2FA, attempt to connect with your postfix client, create
> an application pass code hash for your postfix via their GUI and use that as
> your password in your postfix settings.  If you change your IP address, or
> your PC/client, or anything else Google are using to fingerprint and profile
> your device, then you'll have to login again in their GUI to confirm you are
> who you are and your client is a legitimate device owned by you.
>
> They have many relevant help pages to explain all this, so you should search
> for specific guidance, or find another email provider with less onerous user
> profiling demands.  ;-)
>
> HTH

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Peter Humphrey]

On Tuesday, 20 June 2023 09:55:10 BST William Kenworthy wrote:
> getmail can facilitate getting googlemail into postfix.  In my case, it
> fetches an mail then invokes sendemail to forward into postfix.  The
> docs for the google side of the equation are quite good.

Coming to this after a while, can you point me to the one that helps, please? 
I've had a look round but I haven't found anything helpful. Thanks.

-- 
Regards,
Peter.

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 993 bytes --]

On Sat, 14 Oct 2023 06:02:21 +0100, Peter Humphrey wrote:

> On Tuesday, 20 June 2023 09:55:10 BST William Kenworthy wrote:
> > getmail can facilitate getting googlemail into postfix.  In my case,
> > it fetches an mail then invokes sendemail to forward into postfix.
> > The docs for the google side of the equation are quite good.  
> 
> Coming to this after a while, can you point me to the one that helps,
> please? I've had a look round but I haven't found anything helpful.
> Thanks.

I use this getmail config for GMail. It uses procmail to deliver to
Docecot, but it should work as a starting point for you.

[retriever]
type = SimpleIMAPSSLRetriever
server = imap.gmail.com
username = neil.bothwick@gmail.com
password = thisisnotmyrealpassword
mailboxes = ('Inbox',)

[destination]
type = MDA_external
path = /usr/bin/procmail

[options]
verbose = 0
read_all = false
delete = true


-- 
Neil Bothwick

Drink varnish and you'll have a lovely finish.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Peter Humphrey]

On Saturday, 14 October 2023 08:04:27 BST Neil Bothwick wrote:

> I use this getmail config for GMail. It uses procmail to deliver to
> Docecot, but it should work as a starting point for you.

---<8

Thanks for the help, Neil.

Until now I've been using fetchmail, but I can't find any help in using it, and 
this entry in /etc/fetchmailrc fails with a permission error:

poll pop.gmail.com proto pop3, user "<me>.gmail.com",
    with password "<mypass>", is "prh" here, ssl, dropdelivered, fetchall,
    no keep;

I also tried  setting up a gmail IMAP source in KMail, and that worked so I 
assume the permissions are right at their end. (I removed the account when 
KMail kept resurrecting scores of mails I'd already deleted, even though 
access on my mobile showed an absence of mails.)

Perhaps I should switch to getmail...

-- 
Regards,
Peter.

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Peter Humphrey]

On Saturday, 14 October 2023 12:26:29 BST I wrote:

> Perhaps I should switch to getmail...

On the other hand, I'd prefer to stick with fetchmail for my Zen POP3 account, 
since it's working well. Then I could use getmail to fetch my gmail mail. 
Would that be safe?

If it works I could move Zen mail to getmail later, at my leisure. (That's the 
only sort of time I have these days... :(  )

-- 
Regards,
Peter.

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 754 bytes --]

On Sat, 14 Oct 2023 14:28:53 +0100, Peter Humphrey wrote:

> On the other hand, I'd prefer to stick with fetchmail for my Zen POP3
> account, since it's working well. Then I could use getmail to fetch my
> gmail mail. Would that be safe?
> 
> If it works I could move Zen mail to getmail later, at my leisure.
> (That's the only sort of time I have these days... :(  )

Here's my getmail config for Zen

[retriever]
type = SimplePOP3Retriever
server = mailhost.zen.co.uk
username = zen123456
password = yeahyeahyeah

[destination]
type = MDA_external
path = /usr/bin/procmail

[options]
verbose = 0
read_all = false



-- 
Neil Bothwick

You do not need a parachute to skydive. You only need a parachute to
skydive twice.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[William Kenworthy]

On 14/10/23 21:28, Peter Humphrey wrote:
> On Saturday, 14 October 2023 12:26:29 BST I wrote:
>
>> Perhaps I should switch to getmail...
> On the other hand, I'd prefer to stick with fetchmail for my Zen POP3 
> account,
> since it's working well. Then I could use getmail to fetch my gmail mail.
> Would that be safe?
>
> If it works I could move Zen mail to getmail later, at my leisure. 
> (That's the
> only sort of time I have these days... :( )
>
getmail works fine with gmail - just follow their instructions to configure.

getmail itself is a bit flakey - using it with hydroxide as a proton 
bridge it keeps going to sleep(need to restart getmail every hour), and 
on 3 accounts with my ISP I get random crashes with no indication why.  
But with gmail and ventraip.mail its quite stable. On the plus side imap 
getmail IDLE works ... I had problems with fetchmail so moved to getmail.

BillK

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Peter Humphrey]

On Sunday, 15 October 2023 03:43:00 BST William Kenworthy wrote:
> On 14/10/23 21:28, Peter Humphrey wrote:
> > On Saturday, 14 October 2023 12:26:29 BST I wrote:
> >> Perhaps I should switch to getmail...
> > 
> > On the other hand, I'd prefer to stick with fetchmail for my Zen POP3
> > account, since it's working well. Then I could use getmail to fetch my
> > gmail mail. Would that be safe?
> > 
> > If it works I could move Zen mail to getmail later, at my leisure.
> > (That's the only sort of time I have these days... :( )
> 
> getmail works fine with gmail - just follow their instructions to configure.

I'm sure it does - just not for me. I've followed Google's instructions to the 
letter, but still no joy.

-- 
Regards,
Peter.

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Michael]

[-- Attachment #1: Type: text/plain, Size: 2215 bytes --]

On Saturday, 14 October 2023 12:26:29 BST Peter Humphrey wrote:

> I also tried  setting up a gmail IMAP source in KMail, and that worked so I
> assume the permissions are right at their end. (I removed the account when
> KMail kept resurrecting scores of mails I'd already deleted, even though
> access on my mobile showed an absence of mails.)

A bit O/T, but since you mention it I have observed the same behavior here 
with Kmail.  Different users, different email accounts (inc. Gmail).  At 
times, emails which have been deleted and even emptied from the Bin/Trash 
folder reappear.  Deleted again, only to reappear.  This can carry on for a 
while until the user gets so annoyed as to close Kmail.

I am not sure what causes this, but I suspect Kmail/akonadi does not like 
multiple user inputs in close succession, while it is still synchronising 
previous local changes to the remote IMAP folder(s).  For example, I have 
observed if a number of messages are selected and deleted, then without 
waiting for Kmail progress bar to finish you move to a different folder and 
delete a message, you are most likely to trigger this problem.  The more 
impatient a user is and the more accounts they have configured, the more often 
deleted messages tend to reappear in their Kmail.  A variation of the same 
problem is when new messages are shown in the Folder List, but none appears 
when you select the folder to look at its contents.  Pressing F5 or Update 
This Folder/Subfolders does not help.

The workarounds I have devised are:

1. Close Kmail, restart it and keep an eye on the progress bar to confirm it 
has finished synchronizing all folders with remote IMAP servers, before I 
click on anything else.

2. If the above does not succeed I close Kmail and run 'akonadictl stop', 
before I restart it.

3. If the problem is not resolved, I repeat step 2 above and proceed to run:

akonadictl start
akonadictl fsck (wait for it to finish)
akonadi vacuum  (wait for it to finish)

then relaunch Kmail.

4. A last resort is to launch akonadiconsole, go to the Browser tab and delete 
any messages there.

I anyone knows of a better solution, other than trying alternative mail 
clients, please post back.


[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Peter Humphrey]

On Sunday, 15 October 2023 10:45:45 BST Michael wrote:

> The workarounds I have devised are:
> 
> 1. Close Kmail, restart it and keep an eye on the progress bar to confirm it
> has finished synchronizing all folders with remote IMAP servers, before I
> click on anything else.
> 
> 2. If the above does not succeed I close Kmail and run 'akonadictl stop',
> before I restart it.
> 
> 3. If the problem is not resolved, I repeat step 2 above and proceed to run:

Yes, I did allow plenty of time for synchronising -  hours, in fact.

> akonadictl start
> akonadictl fsck (wait for it to finish)
> akonadi vacuum  (wait for it to finish)

I didn't think of that.

> then relaunch Kmail.
> 
> 4. A last resort is to launch akonadiconsole, go to the Browser tab and
> delete any messages there.
> 
> I anyone knows of a better solution, other than trying alternative mail
> clients, please post back.

-- 
Regards,
Peter.

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[thelma]

On 6/20/23 02:30, Michael wrote:
> On Tuesday, 20 June 2023 06:29:52 BST thelma@sys-concept.com wrote:
>> Trying to send email via Google SMTP and postfix but getting authentication
>> failed.
>>
>> white postfix/smtp[32223]: 62E5618008F: to=<user@google.com>,
>> relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
>> delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
>> failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
>> Password not accepted. Learn more at?535 5.7.8
>>   https://support.google.com/mail/?p=BadCredentials
>> n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
>>
>> relayhost = [smtp.gmail.com]:587
>> smtp_sasl_auth_enable = yes
>> smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
>> smtp_sasl_security_options = noanonymous
>> smtp_tls_CAfile = /etc/postfix/cacert.pem
>> smtp_use_tls = yes
>>
>> /etc/postfix/sasl_passwd
>> [smtp.gmail.com]:587    USERNAME@gmail.com:PASSWORD
>> postmap /etc/postfix/sasl_passwd
>> /etc/init.d/postfix restart
>>
>> The user and password are correct.
> 
> I think I know what the problem is - but I do not use postfix and can't
> confirm it on my side:
> 
> Since mid 2022 Google requires 2FA to allow login into their server.  Until
> then it used to be the case you could select in their security settings to
> "Allow Less Secure Apps", generate an application specific password hash using
> their GUI and use this in your mail client.  For a year now you won't be able
> to do this, unless you first provide a mobile phone number to Google.
> 
> If you *must* use Google, they you'll have to login into their Google account
> security panel, set 2FA, attempt to connect with your postfix client, create
> an application pass code hash for your postfix via their GUI and use that as
> your password in your postfix settings.  If you change your IP address, or
> your PC/client, or anything else Google are using to fingerprint and profile
> your device, then you'll have to login again in their GUI to confirm you are
> who you are and your client is a legitimate device owned by you.
> 
> They have many relevant help pages to explain all this, so you should search
> for specific guidance, or find another email provider with less onerous user
> profiling demands.  ;-)
> 
> HTH

Thank you Michael for detail explanation.
   
So it seems to me that what I want to do will not work.
I have a static IP with Telus on a remote location (trying to save $10) and whenever
IP on the remote location changes I would run a script that would send me an email with a new IP address of the remote system.
But from what you are describing, it will not work.

"...If you change your IP address, or your PC/client, or anything else Google are using
to fingerprint and profile your device, then you'll have to login again in their GUI to confirm you are
who you are and your client is a legitimate device owned by you."

So if the remote IP will change I have to re-initiate the fingerprint profile via
Google GUI. So much for trying to save $10.00 Any better solution for me, to get a remote system new IP address.

Telus has a tendency of changing the static IP without any warning, it happened to me in the middle of ssh connection with the remote system.

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Matt Connell]

On Tue, 2023-06-20 at 12:09 -0600, thelma@sys-concept.com wrote:
> Any better solution for me, to get a remote system new IP address.
> 
> Telus has a tendency of changing the static IP without any warning, it happened to me in the middle of ssh connection with the remote system.

Dynamic DNS is what you want.  Example: I have a subdomain set up
(whatever-i-feel-like.mydomain.tech) and some software to update it. 
Of course, this is dependent on a combination of 1) software and 2)
service that is supported by the software.  In my case, I use OpnSense
and their dynamic client updating my DNS on Namecheap using an API key.

Perhaps someone has a more simple/elegant solution, but mine required
no change of software or service and it is extremely reliable.

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[thelma]

On 6/20/23 02:30, Michael wrote:
> On Tuesday, 20 June 2023 06:29:52 BST thelma@sys-concept.com wrote:
>> Trying to send email via Google SMTP and postfix but getting authentication
>> failed.
>>
>> white postfix/smtp[32223]: 62E5618008F: to=<user@google.com>,
>> relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
>> delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
>> failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
>> Password not accepted. Learn more at?535 5.7.8
>>   https://support.google.com/mail/?p=BadCredentials
>> n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
>>
>> relayhost = [smtp.gmail.com]:587
>> smtp_sasl_auth_enable = yes
>> smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
>> smtp_sasl_security_options = noanonymous
>> smtp_tls_CAfile = /etc/postfix/cacert.pem
>> smtp_use_tls = yes
>>
>> /etc/postfix/sasl_passwd
>> [smtp.gmail.com]:587    USERNAME@gmail.com:PASSWORD
>> postmap /etc/postfix/sasl_passwd
>> /etc/init.d/postfix restart
>>
>> The user and password are correct.
> 
> I think I know what the problem is - but I do not use postfix and can't
> confirm it on my side:
> 
> Since mid 2022 Google requires 2FA to allow login into their server.  Until
> then it used to be the case you could select in their security settings to
> "Allow Less Secure Apps", generate an application specific password hash using
> their GUI and use this in your mail client.  For a year now you won't be able
> to do this, unless you first provide a mobile phone number to Google.
> 
> If you *must* use Google, they you'll have to login into their Google account
> security panel, set 2FA, attempt to connect with your postfix client, create
> an application pass code hash for your postfix via their GUI and use that as
> your password in your postfix settings.  If you change your IP address, or
> your PC/client, or anything else Google are using to fingerprint and profile
> your device, then you'll have to login again in their GUI to confirm you are
> who you are and your client is a legitimate device owned by you.
> 
> They have many relevant help pages to explain all this, so you should search
> for specific guidance, or find another email provider with less onerous user
> profiling demands.  ;-)
> 
> HTH

I setup a Twilio trial account with bash-scrip to send me SMS if the remote IP changes (on a cron job every hr.) and it works, but I'm not sure how log
the account will be free.

# Twilio credentials
TWILIO_ACCOUNT_SID="xxxxxxxxxxxxxxxxxxxxxxxxxxx"
TWILIO_AUTH_TOKEN="xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
TWILIO_PHONE_NUMBER="+xxxxxxxxx"
TO_PHONE_NUMBER="+xxxxxxxxxxxx"

# File to store the last known IP address
IP_FILE="/home/user/ip_address.txt"

# Read the last known IP address from the file
OLD_IP=$(cat "$IP_FILE")

# Query the "what is my ip" service to get the current IP address
NEW_IP=$(curl -s https://api.ipify.org)

# Compare the new IP address with the old one
if [[ "$NEW_IP" != "$OLD_IP" ]]; then
     echo "Your IP address has changed to $NEW_IP"

     # Send a Twilio message with the new IP address
     MESSAGE="New IP address: $NEW_IP"
     curl -X POST "https://api.twilio.com/2010-04-01/Accounts/$TWILIO_ACCOUNT_SID/Messages.json" \
         --data-urlencode "To=$TO_PHONE_NUMBER" \
         --data-urlencode "From=$TWILIO_PHONE_NUMBER" \
         --data-urlencode "Body=$MESSAGE" \
         -u "$TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN"

     # Update the IP file with the new IP address
     echo "$NEW_IP" > "$IP_FILE"
else
     echo "Your IP address is still $OLD_IP"
fi

Re: [gentoo-user] google SMTP with postfix - Password not accepted

[Dr Rainer Woitok]

Thelma,

On Monday, 2023-06-19 23:29:52 -0600, you wrote:

> Trying to send email via Google SMTP and postfix but getting authentication failed.
> ...
> The user and password are correct.

Starting at 2022-06-01 Google requires either an application password or
OAuth2 for logging in.  Check the Gentoo archives for a thread with sub-
ject `Google and "fetchmail" + "ssmtp"´ started by me at 2022-03-17.

This thread refers  to an article  on the Web  describing how to support
OAuth2 for Fetchmail and Postfix and also contains a detailed descripti-
on of my personal solution using OAuth2 with neither Fetchmail nor Post-
fix, which still works.

Sincerely,
  Rainer