What is the best way to prevent developers from accessing the email SMTP information for an account we'd like to use for sending emails to customers?
I am thinking of using the native mail() function in PHP, and setup the credentials outside the code, in the php.ini file where the developers have no access.
The problem now is that the sysadmin can see the password. I am wondering if there's such thing as SMTP authentication using the OAuth tokens or something similar.
Related
After reading this article, it looks like basic SMTP auth will be disabled for emails. How will this effect laravel applications that use SMTP with a username/password to authenticate? How can we prepare for this, and change our email authentication methods? I have a few projects that use SMTP with outlook emails, and I am worried they will break once this change takes place.
Thanks.
Context
Recently, I have decided to activate 2FA to my outlook email.
However, due to this 2FA implementation, IMAP cannot access the mail server directly and this incur an error in my PHP script.
As of now the code that I have written to access my outlook with IMAP is simply $mbox = imap_open("{localhost:143}INBOX", "user_id", "password");
Question
Is there any way to bypass this such that when IMAP is reading from the mail server, it does not have to go through any authentication?
Apparently, outlook allows the users to create a password for those applications that do not support 2FA. You can find the reference link here.
However, this means that the site is still not fully secured.
I understand SMTP is often used to send mail to client addresses, because the host may be considered spam and blocked. In this case, suppose I have a website with a few contact forms, that sends an email to the administrator's email account (eg. gmail). Because the email is sent to the admin, does SMTP have any benefits in reliability or security? Additionally, if the host sends email directly, does the host server need an 'email account'?
There is nothing particularly wrong with this approach. Many large frameworks and CMS systems use email as a way of contacting the admins for internal messages (software updates needed) or for contact form submissions from users.
If your framework has built-in API calls for transactional mailers, check those out - eg: Laravel recommends a couple of mail providers that already have API calls baked into the framework.
If you are using pure PHP, I can strongly recommend the excellent PHPMailer library over the built-in mail() function - PHPMailer is far easier to set up for SMTP.
The admin will need an account to send mail from, but if this is purely for site -> admin communication you can use the same gmail account for both the sending and receiving.
Note about gmail:
If you are going to use a gmail account to send, the account needs to have access for less secure apps enabled. You will also need to ensure that you don't annoy the Google admins with the volume of mail. Things like spam detection can be ignored since all the mail is going to one account and that account can simply whitelist the sending address.
Note about SMTP:
SMTP is generally secure enough for this sort of thing, as long as you use SMTP over SSL/TLS. Do not send mail to an SMTP server unencrypted as the password will also travel unencrypted and your account will be hacked quickly. Do not use port 25.
Ok, I'm using PHPMailer to send email.
So in the php code I add my SMTP username, which is my gmail account
and the SMTP password, which is my gmail account password.
So my GMAIL ACCOUNT ACCESS is EXPOSED in php CODE, although the server
discards the php after it's been interpreted so nobody can see it, my question
is, is this reliable?
Should I leave my gmail access in the code or should I save it in my database?
Thanks in advance
Any developer with access to your code will be able to access your credentials. Saving these in a database may make it a little tougher to gain access to the details, but only slightly.
If you are truly concerned about the credentials used, create an account dedicated to your site and do not use a personal account.
I want to implement an alternative method for logging in (for #mother_company.xyz type e-mails) and impose it.
The reason is leaving the e-mail provider (in this case Exchange) handle password recovery, password storage to prevent password theft and leave the mail server administrator the job of passing accounts arround (also, mail address owner verification is eliminated and the account can be auto-created on first login).
I have looked at Zend_Mail and Pear Net::SMTP they don't seem to allow just SMTP auth, they require sending an e-mail.
Does (preferably standalone, preferably maintained) a PHP SMTP class exist, which can do all SMTP auth types + all encryption methods (SSL, TLS, StartTLS, etc.) and does not require modification for the presented purpose (it also must return usefull codes to determine if login succeeded or failed)?
It would be nice if such a class could autoconfigure the SMTP connection data trough trials (based solely on the domain name), and then return the config for caching/storage.
There is Swiftmailer mailing tool for php5. It consists of several components. One of this components is Swift_SmtpTransport. It extends Swift_Transport_EsmtpTransport that is highly configurable class. U can use start() method of this class just to check if AUTH request was successful
require_once("lib/swift_required.php");
$swiftMailerSMTP=Swift_SmtpTransport::newInstance("smtp.gmail.com", 587, "tls")
->setUsername("john.doe#domain.tld")
->setPassword("iforgotmypassword")
;
//throws Swift_TransportException on auth failure
$swiftMailerSMTP->start();
//end the connection, just in case the current script is going to run for a long while
$swiftMailerSMTP->stop();
$swiftMailerSMTP=null;
Not sure exactly how you want to handle this. SMTP AUTH is simply a command sent by a mail client to a mail server which authenticates the client against a database of some kind. Im guessing your idea is to somehow have a "fake" php mail client that can go through the motions of authentication, then return with whether the AUTH command was successful.
I can think of ways that MIGHT work, but i dont know of a maintained class, and i doubt you will find one as it is a bit of a "hacky" way of doing things.
If its an exchange your authenticating against, why not use LDAP authentication. Its fairly easy to do, the php LDAP module is maintained for you and your implementing authentication properly (which is always a good thing)