[gentoo-user] google SMTP with postfix - Password not accepted

[t***@sys-concept.com]

Trying to send email via Google SMTP and postfix but getting authentication failed.

white postfix/smtp[32223]: 62E5618008F: to=<***@google.com>, relay=smtp.gmail.com[173.194.203.109]:587, delay=2390, delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and Password not accepted. Learn more at?535 5.7.8  https://support.google.com/mail/?p=BadCredentials n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)

relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes

/etc/postfix/sasl_passwd
[smtp.gmail.com]:587    ***@gmail.com:PASSWORD
postmap /etc/postfix/sasl_passwd
/etc/init.d/postfix restart

The user and password are correct.

[Michael]

Post by t***@sys-concept.com
Trying to send email via Google SMTP and postfix but getting authentication failed.
relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
Password not accepted. Learn more at?535 5.7.8
https://support.google.com/mail/?p=BadCredentials
n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes
/etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
/etc/init.d/postfix restart
The user and password are correct.

I think I know what the problem is - but I do not use postfix and can't
confirm it on my side:

Since mid 2022 Google requires 2FA to allow login into their server. Until
then it used to be the case you could select in their security settings to
"Allow Less Secure Apps", generate an application specific password hash using
their GUI and use this in your mail client. For a year now you won't be able
to do this, unless you first provide a mobile phone number to Google.

If you *must* use Google, they you'll have to login into their Google account
security panel, set 2FA, attempt to connect with your postfix client, create
an application pass code hash for your postfix via their GUI and use that as
your password in your postfix settings. If you change your IP address, or
your PC/client, or anything else Google are using to fingerprint and profile
your device, then you'll have to login again in their GUI to confirm you are
who you are and your client is a legitimate device owned by you.

They have many relevant help pages to explain all this, so you should search
for specific guidance, or find another email provider with less onerous user
profiling demands. ;-)

HTH

[William Kenworthy]

getmail can facilitate getting googlemail into postfix.  In my case, it
fetches an mail then invokes sendemail to forward into postfix.  The
docs for the google side of the equation are quite good.

BillK

Post by Michael

Post by t***@sys-concept.com
Trying to send email via Google SMTP and postfix but getting authentication failed.
relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
Password not accepted. Learn more at?535 5.7.8
https://support.google.com/mail/?p=BadCredentials
n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes
/etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
/etc/init.d/postfix restart
The user and password are correct.

I think I know what the problem is - but I do not use postfix and can't
Since mid 2022 Google requires 2FA to allow login into their server. Until
then it used to be the case you could select in their security settings to
"Allow Less Secure Apps", generate an application specific password hash using
their GUI and use this in your mail client. For a year now you won't be able
to do this, unless you first provide a mobile phone number to Google.
If you *must* use Google, they you'll have to login into their Google account
security panel, set 2FA, attempt to connect with your postfix client, create
an application pass code hash for your postfix via their GUI and use that as
your password in your postfix settings. If you change your IP address, or
your PC/client, or anything else Google are using to fingerprint and profile
your device, then you'll have to login again in their GUI to confirm you are
who you are and your client is a legitimate device owned by you.
They have many relevant help pages to explain all this, so you should search
for specific guidance, or find another email provider with less onerous user
profiling demands. ;-)
HTH

[Peter Humphrey]

getmail can facilitate getting googlemail into postfix. In my case, it
fetches an mail then invokes sendemail to forward into postfix. The
docs for the google side of the equation are quite good.

Coming to this after a while, can you point me to the one that helps, please?
I've had a look round but I haven't found anything helpful. Thanks.

[Neil Bothwick]

Post by Peter Humphrey

getmail can facilitate getting googlemail into postfix. In my case,
it fetches an mail then invokes sendemail to forward into postfix.
The docs for the google side of the equation are quite good.

Coming to this after a while, can you point me to the one that helps,
please? I've had a look round but I haven't found anything helpful.
Thanks.

I use this getmail config for GMail. It uses procmail to deliver to
Docecot, but it should work as a starting point for you.

[retriever]
type = SimpleIMAPSSLRetriever
server = imap.gmail.com
username = ***@gmail.com
password = thisisnotmyrealpassword
mailboxes = ('Inbox',)

[destination]
type = MDA_external
path = /usr/bin/procmail

[options]
verbose = 0
read_all = false
delete = true

[Peter Humphrey]

Post by Neil Bothwick
I use this getmail config for GMail. It uses procmail to deliver to
Docecot, but it should work as a starting point for you.

---<8

Thanks for the help, Neil.

Until now I've been using fetchmail, but I can't find any help in using it, and
this entry in /etc/fetchmailrc fails with a permission error:

poll pop.gmail.com proto pop3, user "<me>.gmail.com",
with password "<mypass>", is "prh" here, ssl, dropdelivered, fetchall,
no keep;

I also tried setting up a gmail IMAP source in KMail, and that worked so I
assume the permissions are right at their end. (I removed the account when
KMail kept resurrecting scores of mails I'd already deleted, even though
access on my mobile showed an absence of mails.)

Perhaps I should switch to getmail...

[Peter Humphrey]

Post by Peter Humphrey
Perhaps I should switch to getmail...

On the other hand, I'd prefer to stick with fetchmail for my Zen POP3 account,
since it's working well. Then I could use getmail to fetch my gmail mail.
Would that be safe?

If it works I could move Zen mail to getmail later, at my leisure. (That's the
only sort of time I have these days... :( )

[Neil Bothwick]

Post by Peter Humphrey
On the other hand, I'd prefer to stick with fetchmail for my Zen POP3
account, since it's working well. Then I could use getmail to fetch my
gmail mail. Would that be safe?
If it works I could move Zen mail to getmail later, at my leisure.
(That's the only sort of time I have these days... :( )

Here's my getmail config for Zen

[retriever]
type = SimplePOP3Retriever
server = mailhost.zen.co.uk
username = zen123456
password = yeahyeahyeah

[destination]
type = MDA_external
path = /usr/bin/procmail

[options]
verbose = 0
read_all = false

[William Kenworthy]

Post by Peter Humphrey

Post by Peter Humphrey
Perhaps I should switch to getmail...

On the other hand, I'd prefer to stick with fetchmail for my Zen POP3 account,
since it's working well. Then I could use getmail to fetch my gmail mail.
Would that be safe?
If it works I could move Zen mail to getmail later, at my leisure. (That's the
only sort of time I have these days... :( )

getmail works fine with gmail - just follow their instructions to configure.

getmail itself is a bit flakey - using it with hydroxide as a proton
bridge it keeps going to sleep(need to restart getmail every hour), and
on 3 accounts with my ISP I get random crashes with no indication why. 
But with gmail and ventraip.mail its quite stable. On the plus side imap
getmail IDLE works ... I had problems with fetchmail so moved to getmail.

BillK

[Peter Humphrey]

Post by William Kenworthy

Post by Peter Humphrey

Post by Peter Humphrey
Perhaps I should switch to getmail...

On the other hand, I'd prefer to stick with fetchmail for my Zen POP3
account, since it's working well. Then I could use getmail to fetch my
gmail mail. Would that be safe?
If it works I could move Zen mail to getmail later, at my leisure.
(That's the only sort of time I have these days... :( )

getmail works fine with gmail - just follow their instructions to configure.

I'm sure it does - just not for me. I've followed Google's instructions to the
letter, but still no joy.

[Michael]

Post by Peter Humphrey
I also tried setting up a gmail IMAP source in KMail, and that worked so I
assume the permissions are right at their end. (I removed the account when
KMail kept resurrecting scores of mails I'd already deleted, even though
access on my mobile showed an absence of mails.)

A bit O/T, but since you mention it I have observed the same behavior here
with Kmail. Different users, different email accounts (inc. Gmail). At
times, emails which have been deleted and even emptied from the Bin/Trash
folder reappear. Deleted again, only to reappear. This can carry on for a
while until the user gets so annoyed as to close Kmail.

I am not sure what causes this, but I suspect Kmail/akonadi does not like
multiple user inputs in close succession, while it is still synchronising
previous local changes to the remote IMAP folder(s). For example, I have
observed if a number of messages are selected and deleted, then without
waiting for Kmail progress bar to finish you move to a different folder and
delete a message, you are most likely to trigger this problem. The more
impatient a user is and the more accounts they have configured, the more often
deleted messages tend to reappear in their Kmail. A variation of the same
problem is when new messages are shown in the Folder List, but none appears
when you select the folder to look at its contents. Pressing F5 or Update
This Folder/Subfolders does not help.

The workarounds I have devised are:

1. Close Kmail, restart it and keep an eye on the progress bar to confirm it
has finished synchronizing all folders with remote IMAP servers, before I
click on anything else.

2. If the above does not succeed I close Kmail and run 'akonadictl stop',
before I restart it.

3. If the problem is not resolved, I repeat step 2 above and proceed to run:

akonadictl start
akonadictl fsck (wait for it to finish)
akonadi vacuum (wait for it to finish)

then relaunch Kmail.

4. A last resort is to launch akonadiconsole, go to the Browser tab and delete
any messages there.

I anyone knows of a better solution, other than trying alternative mail
clients, please post back.

[Peter Humphrey]

Post by Michael
1. Close Kmail, restart it and keep an eye on the progress bar to confirm it
has finished synchronizing all folders with remote IMAP servers, before I
click on anything else.
2. If the above does not succeed I close Kmail and run 'akonadictl stop',
before I restart it.

Yes, I did allow plenty of time for synchronising - hours, in fact.

Post by Michael
akonadictl start
akonadictl fsck (wait for it to finish)
akonadi vacuum (wait for it to finish)

I didn't think of that.

Post by Michael
then relaunch Kmail.
4. A last resort is to launch akonadiconsole, go to the Browser tab and
delete any messages there.
I anyone knows of a better solution, other than trying alternative mail
clients, please post back.

[t***@sys-concept.com]

Post by Michael

Post by t***@sys-concept.com
Trying to send email via Google SMTP and postfix but getting authentication failed.
relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
Password not accepted. Learn more at?535 5.7.8
https://support.google.com/mail/?p=BadCredentials
n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes
/etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
/etc/init.d/postfix restart
The user and password are correct.

I think I know what the problem is - but I do not use postfix and can't
Since mid 2022 Google requires 2FA to allow login into their server. Until
then it used to be the case you could select in their security settings to
"Allow Less Secure Apps", generate an application specific password hash using
their GUI and use this in your mail client. For a year now you won't be able
to do this, unless you first provide a mobile phone number to Google.
If you *must* use Google, they you'll have to login into their Google account
security panel, set 2FA, attempt to connect with your postfix client, create
an application pass code hash for your postfix via their GUI and use that as
your password in your postfix settings. If you change your IP address, or
your PC/client, or anything else Google are using to fingerprint and profile
your device, then you'll have to login again in their GUI to confirm you are
who you are and your client is a legitimate device owned by you.
They have many relevant help pages to explain all this, so you should search
for specific guidance, or find another email provider with less onerous user
profiling demands. ;-)
HTH

Thank you Michael for detail explanation.

So it seems to me that what I want to do will not work.
I have a static IP with Telus on a remote location (trying to save $10) and whenever
IP on the remote location changes I would run a script that would send me an email with a new IP address of the remote system.
But from what you are describing, it will not work.

"...If you change your IP address, or your PC/client, or anything else Google are using
to fingerprint and profile your device, then you'll have to login again in their GUI to confirm you are
who you are and your client is a legitimate device owned by you."

So if the remote IP will change I have to re-initiate the fingerprint profile via
Google GUI. So much for trying to save $10.00 Any better solution for me, to get a remote system new IP address.

Telus has a tendency of changing the static IP without any warning, it happened to me in the middle of ssh connection with the remote system.

[Matt Connell]

Post by t***@sys-concept.com
Any better solution for me, to get a remote system new IP address.
Telus has a tendency of changing the static IP without any warning, it happened to me in the middle of ssh connection with the remote system.

Dynamic DNS is what you want. Example: I have a subdomain set up
(whatever-i-feel-like.mydomain.tech) and some software to update it.
Of course, this is dependent on a combination of 1) software and 2)
service that is supported by the software. In my case, I use OpnSense
and their dynamic client updating my DNS on Namecheap using an API key.

Perhaps someone has a more simple/elegant solution, but mine required
no change of software or service and it is extremely reliable.

[t***@sys-concept.com]

Post by Michael

Post by t***@sys-concept.com
Trying to send email via Google SMTP and postfix but getting authentication failed.
relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
Password not accepted. Learn more at?535 5.7.8
https://support.google.com/mail/?p=BadCredentials
n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes
/etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
/etc/init.d/postfix restart
The user and password are correct.

I think I know what the problem is - but I do not use postfix and can't
Since mid 2022 Google requires 2FA to allow login into their server. Until
then it used to be the case you could select in their security settings to
"Allow Less Secure Apps", generate an application specific password hash using
their GUI and use this in your mail client. For a year now you won't be able
to do this, unless you first provide a mobile phone number to Google.
If you *must* use Google, they you'll have to login into their Google account
security panel, set 2FA, attempt to connect with your postfix client, create
an application pass code hash for your postfix via their GUI and use that as
your password in your postfix settings. If you change your IP address, or
your PC/client, or anything else Google are using to fingerprint and profile
your device, then you'll have to login again in their GUI to confirm you are
who you are and your client is a legitimate device owned by you.
They have many relevant help pages to explain all this, so you should search
for specific guidance, or find another email provider with less onerous user
profiling demands. ;-)
HTH

I setup a Twilio trial account with bash-scrip to send me SMS if the remote IP changes (on a cron job every hr.) and it works, but I'm not sure how log
the account will be free.

# Twilio credentials
TWILIO_ACCOUNT_SID="xxxxxxxxxxxxxxxxxxxxxxxxxxx"
TWILIO_AUTH_TOKEN="xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
TWILIO_PHONE_NUMBER="+xxxxxxxxx"
TO_PHONE_NUMBER="+xxxxxxxxxxxx"

# File to store the last known IP address
IP_FILE="/home/user/ip_address.txt"

# Read the last known IP address from the file
OLD_IP=$(cat "$IP_FILE")

# Query the "what is my ip" service to get the current IP address
NEW_IP=$(curl -s https://api.ipify.org)

# Compare the new IP address with the old one
if [[ "$NEW_IP" != "$OLD_IP" ]]; then
echo "Your IP address has changed to $NEW_IP"

# Send a Twilio message with the new IP address
MESSAGE="New IP address: $NEW_IP"
curl -X POST "https://api.twilio.com/2010-04-01/Accounts/$TWILIO_ACCOUNT_SID/Messages.json" \
--data-urlencode "To=$TO_PHONE_NUMBER" \
--data-urlencode "From=$TWILIO_PHONE_NUMBER" \
--data-urlencode "Body=$MESSAGE" \
-u "$TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN"

# Update the IP file with the new IP address
echo "$NEW_IP" > "$IP_FILE"
else
echo "Your IP address is still $OLD_IP"
fi

[Dr Rainer Woitok]

Thelma,

Post by t***@sys-concept.com
Trying to send email via Google SMTP and postfix but getting authentication failed.
...
The user and password are correct.

Starting at 2022-06-01 Google requires either an application password or
OAuth2 for logging in. Check the Gentoo archives for a thread with sub-
ject `Google and "fetchmail" + "ssmtp"´ started by me at 2022-03-17.

This thread refers to an article on the Web describing how to support
OAuth2 for Fetchmail and Postfix and also contains a detailed descripti-
on of my personal solution using OAuth2 with neither Fetchmail nor Post-
fix, which still works.

Sincerely,
Rainer