Security-concerns about Django email-host-data in settings.py - django

I've set up my e-mail settings for my Gmail-account like it's described in the django-documentation:
settings.py:
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
EMAIL_HOST = 'smtp.gmail.com'
EMAIL_USE_TLS = True
EMAIL_PORT = 587
EMAIL_HOST_USER = 'me#gmail.com'
EMAIL_HOST_PASSWORD = 'password'
So, maybe I'm to concerned about this, but I have some doubts due security while writing this kind of sensitve data into my settings.py-file.
So, is there a more secure way to set that up?

The proper way of doing this is providing sensitive data like this via environment variables. You can manually set environment variables or via .env files. There are many python packages for setting environment variables (like this) from env files. Then get these variables using os.environ.
For example you set EMAIL_HOST_USER environment variable and you can define in settings like this.
EMAIL_HOST_USER = os.environ.get('EMAIL_HOST_USER')

Related

How to configure Django and G Suite for SMTP

When the user is registering on my website an E-Mail is sent to the user to confirm his/her E-Mail.
It works with this settings:
EMAIL_USE_TLS = True
EMAIL_HOST = 'smtp.gmail.com'
EMAIL_HOST_USER = 'myemail#gmail.com'
EMAIL_HOST_PASSWORD = 'abcdefghiklmnopq'
EMAIL_PORT = 587
Now I want to switch to noreply#mydomain.com.
I created an account on G Suite and made the following configurations:
Comprehensive mail storage (Locally applied) Ensure that a copy of all
sent and received mail is stored in associated users' mailboxes: ON
SMTP relay service (Locally applied) ms_mail Allowed senders: Only
addresses in my domains Only accept mail from the specified IP
addresses: No Require SMTP Authentication: Yes Require TLS encryption:
Yes
Less secure apps (Locally applied) Allow Users to manage their access to less secure apps
Less Secure Apps
Allow less secure apps: ON
Than I created an App Password an tried a lot of configurations like this:
EMAIL_USE_TLS = True
EMAIL_HOST = 'smtp-relay.gmail.com'
EMAIL_HOST_USER = 'noreply#mydomain.com'
EMAIL_HOST_PASSWORD = 'abcdefghiklmnopq'
DEFAULT_FROM_EMAIL = 'noreply#mydomain.com'
SERVER_EMAIL = 'noreply#mydomain.com'
EMAIL_PORT = 465
I can't find a good documentation on Google or Django how to configure the settings. Does anybody now a good resource? Is the App Password/Less secure Apps the right way to do it? Because Google has some security warnings. Noreply is a group but I created the app password for my.name#mydomain.com. Is this a problem when I am part of the group? I also tried several options with my.name#mydomain.com instead of noreply#mydomain.com but I always get the error
smtplib.SMTPServerDisconnected: Connection unexpectedly closed
Use this in your settings.py
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
EMAIL_USE_TLS = True
EMAIL_HOST = 'smtp.gmail.com'
EMAIL_HOST_USER = 'noreply#mydomain.com'
EMAIL_HOST_PASSWORD = '#########'
EMAIL_PORT = 587

How can I send e-mail from django using the google smtp server?

I'm looking at https://docs.djangoproject.com/en/dev/topics/email/
My question is, is there way I can use smtp.google.com without authentication or without having to put my auth information into settings.py or as a parameter in the django.core.mail.send_mail function?
At this point I'm looking for best practices for using smtp.google.com on django, I understand there are better solutions such as http://sendgrid.com/
You cannot use smpt.gmail.com without providing your auth_information i.e your gmail password.
However you can put your auth information in a local_settings.py and do not add this local_settings in version control so no one except you would see this file. Include this local_settings in your settings.py.
settings.py
...
EMAIL_HOST = 'smtp.gmail.com'
EMAIL_PORT = 587
EMAIL_USE_TLS = True
...
...
from local_settings import *
local_settings.py
EMAIL_HOST_USER = 'user#gmail.com'
EMAIL_HOST_PASSWORD = 'yourpassword'
try including this in settings.py:
# Email configuration.
EMAIL_HOST = 'smtp.gmail.com'
EMAIL_PORT = 587
EMAIL_HOST_USER = 'user#domain.com'
EMAIL_HOST_PASSWORD = 'yourpassword'
EMAIL_USE_TLS = True
DEFAULT_FROM_EMAIL = 'user#domain.com'
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
If you have a web domain provider (like namecheap, godady, etc) you can associate you domain (mycompany.com) with Gmail. For that feature ask help in your domain provider or look info in Internet:
http://www.namecheap.com/support/knowledgebase/article.aspx/1244/78/
http://help.squarespace.com/customer/portal/articles/581494-how-do-i-set-up-google-apps-for-my-domain-
Hope it helps,
cheers.

Django-Userena email backend

I am trying to set up Django-Userena.
I have added the following line to settings.py file:
EMAIL_BACKEND = 'django.core.mail.backends.dummy.EmailBackend'
Also tried with:
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
When trying to sign up for a new account, I get this error:
ImproperlyConfigured at /accounts/signup/
Module "django.core.mail.backends.smtp" does not define a "EmailBackEnd" class
I am pretty sure it's something obvious, but at this point, I can't figure out the problem.
Any help is much appreciated.
Try with following gmail settings in settings.py
EMAIL_HOST = 'smtp.gmail.com'
EMAIL_HOST_USER = 'your-username#gmail.com'
EMAIL_HOST_PASSWORD = 'your-password'
EMAIL_PORT = 587
EMAIL_USE_TLS = True
Make sure the above entries should be in your settings file
If you have your own mail server then first install sendmail
Instead of using smtp.gmail.com which imposes lot many limitations, you can have your own mail server.
you can do it by installing your own mailserver:
sudo apt-get install sendmail
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
EMAIL_HOST = "mail.mysmtpserver.somewhere"
#EMAIL_PORT = ""
EMAIL_HOST_USER = "my#login"
EMAIL_HOST_PASSWORD = "mypassword"
#EMAIL_USE_TLS = True
Add DEFAULT_FROM_EMAIL = 'your#mail.com' to your settings and it should work.

Pinax-theme-bootstrap editing

Pinax theme for Bootstrap on Django twitter lacks a clear guide. Like how it's supposed to send emails when you haven't specified the email_host and password. Changing the top bar to include other links like Home Contact etc.
I've tried to find the pages, other bootstrap themes from bootwatch also don't take effect. How do you change it?
Email settings will be the same as django's
Example:-
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
# Host for sending e-mail.
EMAIL_HOST = 'localhost'
# Port for sending e-mail.
EMAIL_PORT = 1025
# Optional SMTP authentication information for EMAIL_HOST.
EMAIL_HOST_USER = ''
EMAIL_HOST_PASSWORD = ''
EMAIL_USE_TLS = False
Or if you are using a remote mail server, something like this:-
EMAILS_ALLOWED = True
EMAIL_USE_TLS = True
EMAIL_HOST = 'smtp.gmail.com'
EMAIL_HOST_USER = 'no-replymysite.com'
EMAIL_HOST_PASSWORD = 'myspecialpass'
EMAIL_PORT = 587
EMAIL_SUBJECT_PREFIX = '[MySite.com]'
DEFAULT_FROM_EMAIL = 'MySite.com Auto Notification <no-reply#mysite.com>'
Regarding the 2nd question about changing the theme/look-and-feel, I have responded to a similar question here, just yesterday - How to change the pinax(0.9a2) template?

Setting up email with Sendgrid in Heroku for a Django App

I am deploying a Django app on Heroku, and using the Sendgrid addon to send out validation email when a user registers on the site.
I followed the instructions here and pasted the following into settings.py:
EMAIL_HOST = 'smtp.sendgrid.net'
EMAIL_HOST_USER = 'sendgrid_username'
EMAIL_HOST_PASSWORD = 'sendgrid_password'
EMAIL_PORT = 587
EMAIL_USE_TLS = True
However, my app is crashing after registration.
What exactly am I supposed to put for EMAIL_HOST_USER and EMAIL_HOST_PASSWORD?
Under the developer's tab in the sendgrid addon in heroku, it gives me the username app*******#heroku.com, and for password it just says "Your Password". Is the password my Heroku password?
Also, do I need to include DEFAULT_FROM_EMAIL in my settings.py file? And where do I tell Sendgrid what it is?
EDIT: I've set DEBUG = True, and it looks like the error is:
SMTPSenderRefused
(550, 'Cannot receive from specified address <info#myapp.com>: Unauthenticated senders not allowed', 'info#myapp.com')
it looks like the problem is happening before Sendgrid does its thing. Do I need to authenticate the email address with Heroku somehow?
Within your settings.py include:
import os
EMAIL_HOST_USER = os.environ['SENDGRID_USERNAME']
EMAIL_HOST= 'smtp.sendgrid.net'
EMAIL_PORT = 587
EMAIL_USE_TLS = True
EMAIL_HOST_PASSWORD = os.environ['SENDGRID_PASSWORD']
Edit: changed EMAIL_PASSWORD to EMAIL_HOST_PASSWORD as that's the correct spelling.
In the intervening 10 years, the above answer has become obsolete. Sendgrid now uses an API key.
https://docs.sendgrid.com/for-developers/sending-email/django
SENDGRID_API_KEY = os.getenv('SENDGRID_API_KEY')
EMAIL_HOST = 'smtp.sendgrid.net'
EMAIL_HOST_USER = 'apikey' # this is exactly the value 'apikey'
EMAIL_HOST_PASSWORD = SENDGRID_API_KEY
EMAIL_PORT = 587
EMAIL_USE_TLS = True