Mailing List Archive

On Tuesday, 20 June 2023 06:29:52 BST thelma@sys-concept.com wrote:
> Trying to send email via Google SMTP and postfix but getting authentication
> failed.
>
> white postfix/smtp[32223]: 62E5618008F: to=<user@google.com>,
> relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
> delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
> failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
> Password not accepted. Learn more at?535 5.7.8
> https://support.google.com/mail/?p=BadCredentials
> n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
>
> relayhost = [smtp.gmail.com]:587
> smtp_sasl_auth_enable = yes
> smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
> smtp_sasl_security_options = noanonymous
> smtp_tls_CAfile = /etc/postfix/cacert.pem
> smtp_use_tls = yes
>
> /etc/postfix/sasl_passwd
> [smtp.gmail.com]:587 USERNAME@gmail.com:PASSWORD
> postmap /etc/postfix/sasl_passwd
> /etc/init.d/postfix restart
>
> The user and password are correct.

I think I know what the problem is - but I do not use postfix and can't
confirm it on my side:

Since mid 2022 Google requires 2FA to allow login into their server. Until
then it used to be the case you could select in their security settings to
"Allow Less Secure Apps", generate an application specific password hash using
their GUI and use this in your mail client. For a year now you won't be able
to do this, unless you first provide a mobile phone number to Google.

If you *must* use Google, they you'll have to login into their Google account
security panel, set 2FA, attempt to connect with your postfix client, create
an application pass code hash for your postfix via their GUI and use that as
your password in your postfix settings. If you change your IP address, or
your PC/client, or anything else Google are using to fingerprint and profile
your device, then you'll have to login again in their GUI to confirm you are
who you are and your client is a legitimate device owned by you.

They have many relevant help pages to explain all this, so you should search
for specific guidance, or find another email provider with less onerous user
profiling demands. ;-)

HTH

getmail can facilitate getting googlemail into postfix.  In my case, it
fetches an mail then invokes sendemail to forward into postfix.  The
docs for the google side of the equation are quite good.

BillK


On 20/6/23 16:30, Michael wrote:
> On Tuesday, 20 June 2023 06:29:52 BST thelma@sys-concept.com wrote:
>> Trying to send email via Google SMTP and postfix but getting authentication
>> failed.
>>
>> white postfix/smtp[32223]: 62E5618008F: to=<user@google.com>,
>> relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
>> delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
>> failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
>> Password not accepted. Learn more at?535 5.7.8
>> https://support.google.com/mail/?p=BadCredentials
>> n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
>>
>> relayhost = [smtp.gmail.com]:587
>> smtp_sasl_auth_enable = yes
>> smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
>> smtp_sasl_security_options = noanonymous
>> smtp_tls_CAfile = /etc/postfix/cacert.pem
>> smtp_use_tls = yes
>>
>> /etc/postfix/sasl_passwd
>> [smtp.gmail.com]:587 USERNAME@gmail.com:PASSWORD
>> postmap /etc/postfix/sasl_passwd
>> /etc/init.d/postfix restart
>>
>> The user and password are correct.
> I think I know what the problem is - but I do not use postfix and can't
> confirm it on my side:
>
> Since mid 2022 Google requires 2FA to allow login into their server. Until
> then it used to be the case you could select in their security settings to
> "Allow Less Secure Apps", generate an application specific password hash using
> their GUI and use this in your mail client. For a year now you won't be able
> to do this, unless you first provide a mobile phone number to Google.
>
> If you *must* use Google, they you'll have to login into their Google account
> security panel, set 2FA, attempt to connect with your postfix client, create
> an application pass code hash for your postfix via their GUI and use that as
> your password in your postfix settings. If you change your IP address, or
> your PC/client, or anything else Google are using to fingerprint and profile
> your device, then you'll have to login again in their GUI to confirm you are
> who you are and your client is a legitimate device owned by you.
>
> They have many relevant help pages to explain all this, so you should search
> for specific guidance, or find another email provider with less onerous user
> profiling demands. ;-)
>
> HTH

Thelma,

On Monday, 2023-06-19 23:29:52 -0600, you wrote:

> Trying to send email via Google SMTP and postfix but getting authentication failed.
> ...
> The user and password are correct.

Starting at 2022-06-01 Google requires either an application password or
OAuth2 for logging in. Check the Gentoo archives for a thread with sub-
ject `Google and "fetchmail" + "ssmtp"? started by me at 2022-03-17.

This thread refers to an article on the Web describing how to support
OAuth2 for Fetchmail and Postfix and also contains a detailed descripti-
on of my personal solution using OAuth2 with neither Fetchmail nor Post-
fix, which still works.

Sincerely,
Rainer

On 6/20/23 02:30, Michael wrote:
> On Tuesday, 20 June 2023 06:29:52 BST thelma@sys-concept.com wrote:
>> Trying to send email via Google SMTP and postfix but getting authentication
>> failed.
>>
>> white postfix/smtp[32223]: 62E5618008F: to=<user@google.com>,
>> relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
>> delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
>> failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
>> Password not accepted. Learn more at?535 5.7.8
>> https://support.google.com/mail/?p=BadCredentials
>> n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
>>
>> relayhost = [smtp.gmail.com]:587
>> smtp_sasl_auth_enable = yes
>> smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
>> smtp_sasl_security_options = noanonymous
>> smtp_tls_CAfile = /etc/postfix/cacert.pem
>> smtp_use_tls = yes
>>
>> /etc/postfix/sasl_passwd
>> [smtp.gmail.com]:587 USERNAME@gmail.com:PASSWORD
>> postmap /etc/postfix/sasl_passwd
>> /etc/init.d/postfix restart
>>
>> The user and password are correct.
>
> I think I know what the problem is - but I do not use postfix and can't
> confirm it on my side:
>
> Since mid 2022 Google requires 2FA to allow login into their server. Until
> then it used to be the case you could select in their security settings to
> "Allow Less Secure Apps", generate an application specific password hash using
> their GUI and use this in your mail client. For a year now you won't be able
> to do this, unless you first provide a mobile phone number to Google.
>
> If you *must* use Google, they you'll have to login into their Google account
> security panel, set 2FA, attempt to connect with your postfix client, create
> an application pass code hash for your postfix via their GUI and use that as
> your password in your postfix settings. If you change your IP address, or
> your PC/client, or anything else Google are using to fingerprint and profile
> your device, then you'll have to login again in their GUI to confirm you are
> who you are and your client is a legitimate device owned by you.
>
> They have many relevant help pages to explain all this, so you should search
> for specific guidance, or find another email provider with less onerous user
> profiling demands. ;-)
>
> HTH

Thank you Michael for detail explanation.

So it seems to me that what I want to do will not work.
I have a static IP with Telus on a remote location (trying to save $10) and whenever
IP on the remote location changes I would run a script that would send me an email with a new IP address of the remote system.
But from what you are describing, it will not work.

"...If you change your IP address, or your PC/client, or anything else Google are using
to fingerprint and profile your device, then you'll have to login again in their GUI to confirm you are
who you are and your client is a legitimate device owned by you."

So if the remote IP will change I have to re-initiate the fingerprint profile via
Google GUI. So much for trying to save $10.00 Any better solution for me, to get a remote system new IP address.

Telus has a tendency of changing the static IP without any warning, it happened to me in the middle of ssh connection with the remote system.

On Tue, 2023-06-20 at 12:09 -0600, thelma@sys-concept.com wrote:
> Any better solution for me, to get a remote system new IP address.
>
> Telus has a tendency of changing the static IP without any warning, it happened to me in the middle of ssh connection with the remote system.

Dynamic DNS is what you want. Example: I have a subdomain set up
(whatever-i-feel-like.mydomain.tech) and some software to update it.
Of course, this is dependent on a combination of 1) software and 2)
service that is supported by the software. In my case, I use OpnSense
and their dynamic client updating my DNS on Namecheap using an API key.

Perhaps someone has a more simple/elegant solution, but mine required
no change of software or service and it is extremely reliable.

On 6/20/23 02:30, Michael wrote:
> On Tuesday, 20 June 2023 06:29:52 BST thelma@sys-concept.com wrote:
>> Trying to send email via Google SMTP and postfix but getting authentication
>> failed.
>>
>> white postfix/smtp[32223]: 62E5618008F: to=<user@google.com>,
>> relay=smtp.gmail.com[173.194.203.109]:587, delay=2390,
>> delays=2390/0.01/0.29/0, dsn=4.7.8, status=deferred (SASL authentication
>> failed; server smtp.gmail.com[173.194.203.109] said: 535-5.7.8 Username and
>> Password not accepted. Learn more at?535 5.7.8
>> https://support.google.com/mail/?p=BadCredentials
>> n3-20020aa78a43000000b00663b712bfbdsm4668932pfa.57 - gsmtp)
>>
>> relayhost = [smtp.gmail.com]:587
>> smtp_sasl_auth_enable = yes
>> smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
>> smtp_sasl_security_options = noanonymous
>> smtp_tls_CAfile = /etc/postfix/cacert.pem
>> smtp_use_tls = yes
>>
>> /etc/postfix/sasl_passwd
>> [smtp.gmail.com]:587 USERNAME@gmail.com:PASSWORD
>> postmap /etc/postfix/sasl_passwd
>> /etc/init.d/postfix restart
>>
>> The user and password are correct.
>
> I think I know what the problem is - but I do not use postfix and can't
> confirm it on my side:
>
> Since mid 2022 Google requires 2FA to allow login into their server. Until
> then it used to be the case you could select in their security settings to
> "Allow Less Secure Apps", generate an application specific password hash using
> their GUI and use this in your mail client. For a year now you won't be able
> to do this, unless you first provide a mobile phone number to Google.
>
> If you *must* use Google, they you'll have to login into their Google account
> security panel, set 2FA, attempt to connect with your postfix client, create
> an application pass code hash for your postfix via their GUI and use that as
> your password in your postfix settings. If you change your IP address, or
> your PC/client, or anything else Google are using to fingerprint and profile
> your device, then you'll have to login again in their GUI to confirm you are
> who you are and your client is a legitimate device owned by you.
>
> They have many relevant help pages to explain all this, so you should search
> for specific guidance, or find another email provider with less onerous user
> profiling demands. ;-)
>
> HTH

I setup a Twilio trial account with bash-scrip to send me SMS if the remote IP changes (on a cron job every hr.) and it works, but I'm not sure how log
the account will be free.

# Twilio credentials
TWILIO_ACCOUNT_SID="xxxxxxxxxxxxxxxxxxxxxxxxxxx"
TWILIO_AUTH_TOKEN="xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
TWILIO_PHONE_NUMBER="+xxxxxxxxx"
TO_PHONE_NUMBER="+xxxxxxxxxxxx"

# File to store the last known IP address
IP_FILE="/home/user/ip_address.txt"

# Read the last known IP address from the file
OLD_IP=$(cat "$IP_FILE")

# Query the "what is my ip" service to get the current IP address
NEW_IP=$(curl -s https://api.ipify.org)

# Compare the new IP address with the old one
if [[ "$NEW_IP" != "$OLD_IP" ]]; then
echo "Your IP address has changed to $NEW_IP"

# Send a Twilio message with the new IP address
MESSAGE="New IP address: $NEW_IP"
curl -X POST "https://api.twilio.com/2010-04-01/Accounts/$TWILIO_ACCOUNT_SID/Messages.json" \
--data-urlencode "To=$TO_PHONE_NUMBER" \
--data-urlencode "From=$TWILIO_PHONE_NUMBER" \
--data-urlencode "Body=$MESSAGE" \
-u "$TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN"

# Update the IP file with the new IP address
echo "$NEW_IP" > "$IP_FILE"
else
echo "Your IP address is still $OLD_IP"
fi

On Tuesday, 20 June 2023 09:55:10 BST William Kenworthy wrote:
> getmail can facilitate getting googlemail into postfix. In my case, it
> fetches an mail then invokes sendemail to forward into postfix. The
> docs for the google side of the equation are quite good.

Coming to this after a while, can you point me to the one that helps, please?
I've had a look round but I haven't found anything helpful. Thanks.

--
Regards,
Peter.

On Sat, 14 Oct 2023 06:02:21 +0100, Peter Humphrey wrote:

> On Tuesday, 20 June 2023 09:55:10 BST William Kenworthy wrote:
> > getmail can facilitate getting googlemail into postfix. In my case,
> > it fetches an mail then invokes sendemail to forward into postfix.
> > The docs for the google side of the equation are quite good.
>
> Coming to this after a while, can you point me to the one that helps,
> please? I've had a look round but I haven't found anything helpful.
> Thanks.

I use this getmail config for GMail. It uses procmail to deliver to
Docecot, but it should work as a starting point for you.

[retriever]
type = SimpleIMAPSSLRetriever
server = imap.gmail.com
username = neil.bothwick@gmail.com
password = thisisnotmyrealpassword
mailboxes = ('Inbox',)

[destination]
type = MDA_external
path = /usr/bin/procmail

[options]
verbose = 0
read_all = false
delete = true


--
Neil Bothwick

Drink varnish and you'll have a lovely finish.

On Saturday, 14 October 2023 08:04:27 BST Neil Bothwick wrote:

> I use this getmail config for GMail. It uses procmail to deliver to
> Docecot, but it should work as a starting point for you.

---<8

Thanks for the help, Neil.

Until now I've been using fetchmail, but I can't find any help in using it, and
this entry in /etc/fetchmailrc fails with a permission error:

poll pop.gmail.com proto pop3, user "<me>.gmail.com",
with password "<mypass>", is "prh" here, ssl, dropdelivered, fetchall,
no keep;

I also tried setting up a gmail IMAP source in KMail, and that worked so I
assume the permissions are right at their end. (I removed the account when
KMail kept resurrecting scores of mails I'd already deleted, even though
access on my mobile showed an absence of mails.)

Perhaps I should switch to getmail...

--
Regards,
Peter.

On Saturday, 14 October 2023 12:26:29 BST I wrote:

> Perhaps I should switch to getmail...

On the other hand, I'd prefer to stick with fetchmail for my Zen POP3 account,
since it's working well. Then I could use getmail to fetch my gmail mail.
Would that be safe?

If it works I could move Zen mail to getmail later, at my leisure. (That's the
only sort of time I have these days... :( )

--
Regards,
Peter.

On Sat, 14 Oct 2023 14:28:53 +0100, Peter Humphrey wrote:

> On the other hand, I'd prefer to stick with fetchmail for my Zen POP3
> account, since it's working well. Then I could use getmail to fetch my
> gmail mail. Would that be safe?
>
> If it works I could move Zen mail to getmail later, at my leisure.
> (That's the only sort of time I have these days... :( )

Here's my getmail config for Zen

[retriever]
type = SimplePOP3Retriever
server = mailhost.zen.co.uk
username = zen123456
password = yeahyeahyeah

[destination]
type = MDA_external
path = /usr/bin/procmail

[options]
verbose = 0
read_all = false



--
Neil Bothwick

You do not need a parachute to skydive. You only need a parachute to
skydive twice.

On 14/10/23 21:28, Peter Humphrey wrote:
> On Saturday, 14 October 2023 12:26:29 BST I wrote:
>
>> Perhaps I should switch to getmail...
> On the other hand, I'd prefer to stick with fetchmail for my Zen POP3
> account,
> since it's working well. Then I could use getmail to fetch my gmail mail.
> Would that be safe?
>
> If it works I could move Zen mail to getmail later, at my leisure.
> (That's the
> only sort of time I have these days... :( )
>
getmail works fine with gmail - just follow their instructions to configure.

getmail itself is a bit flakey - using it with hydroxide as a proton
bridge it keeps going to sleep(need to restart getmail every hour), and
on 3 accounts with my ISP I get random crashes with no indication why. 
But with gmail and ventraip.mail its quite stable. On the plus side imap
getmail IDLE works ... I had problems with fetchmail so moved to getmail.

BillK

On Saturday, 14 October 2023 12:26:29 BST Peter Humphrey wrote:

> I also tried setting up a gmail IMAP source in KMail, and that worked so I
> assume the permissions are right at their end. (I removed the account when
> KMail kept resurrecting scores of mails I'd already deleted, even though
> access on my mobile showed an absence of mails.)

A bit O/T, but since you mention it I have observed the same behavior here
with Kmail. Different users, different email accounts (inc. Gmail). At
times, emails which have been deleted and even emptied from the Bin/Trash
folder reappear. Deleted again, only to reappear. This can carry on for a
while until the user gets so annoyed as to close Kmail.

I am not sure what causes this, but I suspect Kmail/akonadi does not like
multiple user inputs in close succession, while it is still synchronising
previous local changes to the remote IMAP folder(s). For example, I have
observed if a number of messages are selected and deleted, then without
waiting for Kmail progress bar to finish you move to a different folder and
delete a message, you are most likely to trigger this problem. The more
impatient a user is and the more accounts they have configured, the more often
deleted messages tend to reappear in their Kmail. A variation of the same
problem is when new messages are shown in the Folder List, but none appears
when you select the folder to look at its contents. Pressing F5 or Update
This Folder/Subfolders does not help.

The workarounds I have devised are:

1. Close Kmail, restart it and keep an eye on the progress bar to confirm it
has finished synchronizing all folders with remote IMAP servers, before I
click on anything else.

2. If the above does not succeed I close Kmail and run 'akonadictl stop',
before I restart it.

3. If the problem is not resolved, I repeat step 2 above and proceed to run:

akonadictl start
akonadictl fsck (wait for it to finish)
akonadi vacuum (wait for it to finish)

then relaunch Kmail.

4. A last resort is to launch akonadiconsole, go to the Browser tab and delete
any messages there.

I anyone knows of a better solution, other than trying alternative mail
clients, please post back.

On Sunday, 15 October 2023 10:45:45 BST Michael wrote:

> The workarounds I have devised are:
>
> 1. Close Kmail, restart it and keep an eye on the progress bar to confirm it
> has finished synchronizing all folders with remote IMAP servers, before I
> click on anything else.
>
> 2. If the above does not succeed I close Kmail and run 'akonadictl stop',
> before I restart it.
>
> 3. If the problem is not resolved, I repeat step 2 above and proceed to run:

Yes, I did allow plenty of time for synchronising - hours, in fact.

> akonadictl start
> akonadictl fsck (wait for it to finish)
> akonadi vacuum (wait for it to finish)

I didn't think of that.

> then relaunch Kmail.
>
> 4. A last resort is to launch akonadiconsole, go to the Browser tab and
> delete any messages there.
>
> I anyone knows of a better solution, other than trying alternative mail
> clients, please post back.

--
Regards,
Peter.

On Sunday, 15 October 2023 03:43:00 BST William Kenworthy wrote:
> On 14/10/23 21:28, Peter Humphrey wrote:
> > On Saturday, 14 October 2023 12:26:29 BST I wrote:
> >> Perhaps I should switch to getmail...
> >
> > On the other hand, I'd prefer to stick with fetchmail for my Zen POP3
> > account, since it's working well. Then I could use getmail to fetch my
> > gmail mail. Would that be safe?
> >
> > If it works I could move Zen mail to getmail later, at my leisure.
> > (That's the only sort of time I have these days... :( )
>
> getmail works fine with gmail - just follow their instructions to configure.

I'm sure it does - just not for me. I've followed Google's instructions to the
letter, but still no joy.

--
Regards,
Peter.