FMS + G Suite - Will the new announcement from Google mean FMS can't send emails?

[TwistedHelixis]

Google announced the following

 

Access to LSAs will be turned off in two stages:

 

• June 15, 2020 - Users who try to connect to an LSA for the first time will no longer be able to do so. This includes third-party apps that allow password-only access to Google calendars, contacts, and email via protocols such as CalDAV, CardDAV and IMAP. Users who have connected to LSAs prior to this date will be able to continue using them until usage of all LSAs is turned off.
   
  
• February 15, 2021 - Access to LSAs will be turned off for all G Suite accounts.
   
   
  What do I need to do?
  To continue using a specific app with your G Suite accounts, users in your organization must switch to a more secure type of access called OAuth. This connection method allows apps to access accounts with a digital key instead of requiring a user to reveal their username and password. We recommend that you share the user instructions (included below) with individuals in your organization to help them make the necessary changes. Alternatively, if your organization is using custom tools, you can ask the developer of the tool to update it to use OAuth. Developer instructions are also included below.
  

 

I seem to remember we have disabled IMAP anyway, but just wanted to double check if this will effect FMS being able to send emails.

[localzuk]

Yup, looks like it. Same with our other kit that uses their smtp relays.

 

I would suggest looking at SendGrid as an alternative when this happens.

[TwistedHelixis]

I would suggest looking at SendGrid as an alternative when this happens.

 

Cheers for that. Looks like their free version will be fine for us. Suppose I could also sign up for 365 and use that.

[Primus]

Unless I've missed something SMTP is sticking around:

 

Legacy office devices

 

Examples: scanners and multifunctional printers that send email

 

Continue using legacy office devices with SMTP. Other protocols (such as POP3 and IMAP) will be blocked unless they use OAuth.

[Arthur]

Looks like their free version will be fine for us.

Btw, if you sign up for the free version of SendGrid through the Azure Portal you can send 25,000 emails per month compared to the paltry 100 emails per day SendGrid offer if you sign up through them.

 

Edited December 17, 2019 by Arthur

[jthompson]

I've just been looking at this whole issue. It looks as though app-specific passwords can be used (https://support.google.com/accounts/answer/185833?hl=en) instead of using the "Less secure apps" option. We have a postfix server on site that we use as an SMTP relay up to Gmail. Previously using an account with LSA turned on, but I've now enabled 2FA on that account and successfully configured postfix to use an app-specific password. Since 2FA has to be enabled in order to set up any app-specific passwords, I'm cautiously optimistic that this option is not about to disappear on us when Google kill of the LSA option.

 

The notifications from Google about LSA don't mention anything about app-specific passwords. Does anyone know for certain whether they're sticking around?

Edited December 17, 2019 by jthompson

[Primus]

Unless I've missed something SMTP is sticking around:

 

Legacy office devices

 

Examples: scanners and multifunctional printers that send email

 

Continue using legacy office devices with SMTP. Other protocols (such as POP3 and IMAP) will be blocked unless they use OAuth.

[jthompson]

Unless I've missed something SMTP is sticking around:

 

Legacy office devices

 

Examples: scanners and multifunctional printers that send email

 

Continue using legacy office devices with SMTP. Other protocols (such as POP3 and IMAP) will be blocked unless they use OAuth.

 

In the case of Postfix, iirc SMTP auth with a Google SMTP relay service would fail if LSA wasn't enabled. Was a while ago but that's what my notes tell me.

[jthompson]

Same goes for EduLink when used with a Google SMTP relay service. SMTP auth fails without LSA enabled, but turn 2FA on and set up an app-specific password for EduLink to use, Gmail is happy.

[Primus]

Interesting as that isn't what the documentation says as far as I can see.

[jthompson]

If LSA is required for SMTP auth, maybe the option will not actually disappear after Feb 2021, but end up working only for SMTP auth and stop working for everything else like IMAP, etc. Edited December 17, 2019 by jthompson

[jthompson]

I've just been on with a Google support rep, who has confirmed that app passwords (https://support.google.com/accounts/answer/185833?hl=en-GB) will continue to work and not be affected by the shutting down of LSA access in Feb 2021.

 

So, if you've got Google account details plumbed into MFDs and the like, you'll be alright if you ocnfigure those accounts with 2FA and use app passwords rather than relying on LSA.

[the_quick]

Thanks @jthompson , just done it with EduLink, will check it with veeam as well, can't think why it wouldn't work. Edited January 29, 2020 by the_quick

[jthompson]

can't think why it would work.

 

It'll be because app passwords have a limited scope in terms of what APIs they can be used against, etc., whereas LSA is just a general access to all account data using the main account password, which is more likely to be a reused or phished password.

[the_quick]

sorry mate, made a typo - fixed now - supposed to say "can't think why it wouldn't work

[Arthur]

Less secure app turn-off suspended until further notice

 

Last December, we announced that we’d be turning off less secure app (LSA) access to G Suite accounts, and that you should migrate to OAuth authentication instead. The first phase of the LSA turn-down was scheduled for 15 June 2020. As many organizations deal with the impact of COVID-19 and are now focused on supporting a remote workforce, we want to minimize potential disruptions for customers unable to complete migrations in this timeframe.

 

As a result, we are suspending the LSA turn-off until further notice. All previously announced timeframes no longer apply.

[davidstallwood]

Hi, Please could you let me know in Layman's terms how to 'Enable 2FA on a GSuite account & configure postfix to us an app-specific password' as we have a few apps such as FMS & Go4Schools that still need LSA enabled. Thank You very much in advance.

[RLR]

Hi, Please could you let me know in Layman's terms how to 'Enable 2FA on a GSuite account & configure postfix to us an app-specific password' as we have a few apps such as FMS & Go4Schools that still need LSA enabled. Thank You very much in advance.

Go to myaccount.google.com and sign in using the account needed to setup 2fa.

 

Scroll down a little to 2-step verification and click on it.

 

This will prompt for your password again. Enter your password and follow the steps to setup 2 verification.

 

Once 2 step has been setup go back to myaccounts.google.com and just below the 2 step verification button you clicked, you will see App Passwords. Select this and enter your password once more. On the App Passwords page you can create a new app password. This is basically a 2 step password for a specific app. Use this password when setting up an app that requires authentication.

More Details here: https://support.google.com/mail/answer/185833?hl=en-GB

[davidstallwood]

Many Thanks for that. Would you happen to know if the same thing will need to be done for a GMail account setup in Outlook?

[RLR]

Many Thanks for that. Would you happen to know if the same thing will need to be done for a GMail account setup in Outlook?

 

We don't use outlook but more than likely yes unless there is something specifically built for outlook and gmail.

[davidstallwood]

All working well. Thanks again for your help