0

Recently we want to connect GCP Compute Engine with Google suite email service. at this documentation told that

Google Compute Engine does not allow outbound connections on port 25. By default, outbound SMTP is blocked because of the large amount of abuse server-to-server SMTP is susceptible to. In addition, having a trusted third-party provider such as SendGrid, Mailgun, or Mailjet relieves Compute Engine and you from maintaining IP reputation with your receivers.

Our idea is we had php script and running on httpd/apache which had function mail to email our sales team as bellow

$mail = mail($siteOwnersEmail, $subject, $message, $headers);

and use sendmail to relay to smtp google service. Our compute engine running on Centos 7. We not considering other trusted third party as Google recommendation like SendGrid, MailGun, and MailJet because we already used Google Suite.

From another post, connecting Compute Engine and Google Suite are hard to do. We need your help to achieve this.

We had configure sendmail as bellow

divert(-1)dnl
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl
VERSIONID(`setup for linux')dnl
OSTYPE(`linux')dnl
dnl define(`confSMTP_LOGIN_MSG', `$j Sendmail; $b')dnl
dnl define(`confLOG_LEVEL', `9')dnl
dnl define(`SMART_HOST', `relay-smtp.gmail.com')dnl
define(`confDEF_USER_ID', ``8:12'')dnl
dnl define(`confAUTO_REBUILD')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST', `True')dnl
define(`confDONT_PROBE_INTERFACES', `True')dnl
define(`PROCMAIL_MAILER_PATH', `/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
define(`STATUS_FILE', `/var/log/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A')dnl
dnl define(`RELAY_MAILER_ARGS', `TCP $h 587′)dnl
dnl define(`ESMTP_MAILER_ARGS', `TCP $h 587′)dnl
dnl define(`confAUTH_OPTIONS', `A p')dnl
dnl TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
dnl define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
dnl define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl
dnl define(`confCACERT', `/etc/pki/tls/certs/ca-bundle.crt')dnl
dnl define(`confSERVER_CERT', `/etc/pki/tls/certs/sendmail.pem')dnl
dnl define(`confSERVER_KEY', `/etc/pki/tls/certs/sendmail.pem')dnl
dnl define(`confDONT_BLAME_SENDMAIL', `groupreadablekeyfile')dnl
dnl define(`confTO_QUEUEWARN', `4h')dnl
dnl define(`confTO_QUEUERETURN', `5d')dnl
dnl define(`confQUEUE_LA', `12')dnl
dnl define(`confREFUSE_LA', `18')dnl
define(`confTO_IDENT', `0')dnl
dnl define(`confINET_QOS', `AF11')dnl
dnl FEATURE(delay_checks)dnl
FEATURE(`no_default_msa', `dnl')dnl
FEATURE(`smrsh', `/usr/sbin/smrsh')dnl
FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable.db')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
dnl define(`confMAX_DAEMON_CHILDREN', `20')dnl
dnl define(`confCONNECTION_RATE_THROTTLE', `3')dnl
FEATURE(local_procmail, `', `procmail -t -Y -a $h -d $u')dnl
FEATURE(`access_db', `hash -T<TMPF> -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root')dnl
dnl define(`confLOCAL_MAILER', `cyrusv2')dnl
dnl define(`CYRUSV2_MAILER_ARGS', `FILE /var/lib/imap/socket/lmtp')dnl
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
dnl DAEMON_OPTIONS(`Port=submission, Name=MSA, M=Ea')dnl
dnl DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl
dnl DAEMON_OPTIONS(`port=smtp,Addr=::1, Name=MTA-v6, Family=inet6')dnl
dnl DAEMON_OPTIONS(`Name=MTA-v4, Family=inet, Name=MTA-v6, Family=inet6')
FEATURE(`accept_unresolvable_domains')dnl
dnl FEATURE(`relay_based_on_MX')dnl
LOCAL_DOMAIN(`localhost.localdomain')dnl
dnl MASQUERADE_AS(`qreatiq.com')dnl
dnl FEATURE(masquerade_envelope)dnl
dnl FEATURE(masquerade_entire_domain)dnl
dnl MASQUERADE_DOMAIN(localhost)dnl
dnl MASQUERADE_DOMAIN(localhost.localdomain)dnl
dnl MASQUERADE_DOMAIN(mydomainalias.com)dnl
dnl MASQUERADE_DOMAIN(mydomain.lan)dnl
MAILER(smtp)dnl
MAILER(procmail)dnl
dnl MAILER(cyrusv2)dnl

and already set SELinux as bellow

setsebool httpd_can_sendmail on 

Generating certificate

cd /etc/pki/tls/certs
make sendmail.pem

Create auth file to be used for auth on smtp.gmail.com

mkdir /etc/mail/auth
chmod 700 /etc/mail/auth 

create client info file

AuthInfo:smtp.gmail.com “U:smmsp” “I:gmail_address” “P:password” “M:PLAIN”
AuthInfo:smtp.gmail.com:587 “U:smmsp” “I:gmail_address” “P:password” “M:PLAIN”

and make

makemap -r hash client-info.db < client-info
chmod 600 client-info client-info.db

edit aliases

root:email_address

add apache user at trusted user and run newaliases

than i tried to send email using this code

echo ‘this is a test’| mail -s test_email system@qreatiq.com

And cek log at /var/log/maillog status deferred because connection timeout with aspmx2.googlemail.com here are complete stack trace

Aug 30 06:54:03 gcp***-***a sendmail[14979]: w7U6s31m014979: to=system@*****.com, ctladdr=a*****g_imannuel (1001/1002), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30234, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (w7U6s3QN014980 Message accepted for delivery)
Aug 30 06:59:03 gcp***-***a sendmail[14982]: w7U6s3QN014980: to=<system@*****.com>, ctladdr=<a*****g_imannuel@gcp***-***a.c.calm-ca***-XXX.internal> (1001/1002), delay=00:05:00, xdelay=00:05:00, mailer=esmtp, pri=120537, relay=aspmx2.googlemail.com. [173.194.66.26], dsn=4.0.0, stat=Deferred: Connection timed out with aspmx2.googlemail.com.

and log at /var/log/messages only session starting for ssh.

more over, here are SMTP Relay Service at our Google Suite

Allowed senders: Any addresses (not recommended)
Only accept mail from the specified IP addresses: Yes
Allowed IP addresses: www.****.com
Require SMTP Authentication: Yes
Require TLS encryption: No

Have check on Google Suite - gmail apps, and email never sends to sender. So sad. Anybody knows whats the problem?

0

Using sendmail here is massively over-complicating things (and will likely still want to use port 25 anyway). Just follow the instructions here: https://support.google.com/a/answer/2956491?hl=en for setting up GSuite for relaying email, use authentication, and use port 587 to send.

You also can't use the built-in PHP mail() function (and probably nobody should, ever). Use PEAR::Mail instead: http://pear.php.net/manual/en/package.mail.mail.php - that package allows you to configure the host/port etc.

  • I've followed support.google.com/a/answer/2956491?hl=en and really hard to do. I didn't know why google make it so complicated even though that only relaying email to their Google product as well (Google Suite) – Yohanes AI Sep 2 '18 at 16:19
  • It's hard to do because people set their systems up insecurely all the time and spammers find the hole and send spam through gmail all the time. This is expensive for Google to deal with, and they spend a lot of resources on it. It's money they have to spend with zero return. Spammers suck. They have made all of this email stuff harder for everyone. – Matt Sergeant Sep 2 '18 at 22:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.