电子邮件发送错误在弹性警报。SMTPSenderRefused：(530，'5.5.1所需的认证)

Question

我收到了gmail认证错误。我的配置和错误消息如下，我已经允许较不安全的应用程序在gmail。

Config.yaml文件电子邮件部分，如下所示：

 name: frequency_rule
 type: frequency
 index: security
 num_events: 50

 timeframe:
   days: 1

 filter:
   - term:
       host.keyword : "azure-2"
 alert:
   - email
 email:
   "to_address@gmail.com"

 smtp_host: "smtp.gmail.com"
 smtp_port: "465"
 smtp_ssl: true
 from_addr: "from_address@gmail.com"
 user: "from_address@gmail.com"
 password: "password"

错误消息如下所示：

PS C:\Users\smiforce-2ndPC\Downloads\Compressed\elastalert-master\elastalert-master> python -m elastalert.elastalert --verbose --config ./config.yaml --rule ./alert_rules/frequency4.yaml
INFO:elastalert:Starting up
INFO:elastalert:Queried rule frequency_rule4 from 2017-11-20 09:48 Central Standard Time to 2017-11-21 09:48 Central Standard Time: 24 / 24 hits
ERROR:root:Traceback (most recent call last):
File "C:\Users\smiforce-2ndPC\Downloads\Compressed\elastalert-master\elastalert-master\elastalert\elastalert.py", line 1246, in alert
return self.send_alert(matches, rule, alert_time=alert_time, retried=retried)
File "C:\Users\smiforce-2ndPC\Downloads\Compressed\elastalert-master\elastalert-master\elastalert\elastalert.py", line 1326, in send_alert
alert.alert(matches)
File "elastalert\alerts.py", line 451, in alert
self.smtp.sendmail(self.from_addr, to_addr, email_msg.as_string())
File "C:\Python27\lib\smtplib.py", line 737, in sendmail
raise SMTPSenderRefused(code, resp, from_addr)
SMTPSenderRefused: (530, '5.5.1 Authentication Required. Learn more at\n5.5.1 https://support.google.com/mail/?p=WantAuthError l4sm636961ioc.69 - gsmtp', 'from_address@gmail.com')

ERROR:root:Uncaught exception running rule frequency_rule4: (530, '5.5.1 Authentication Required. Learn more at\n5.5.1 https://support.google.com/mail/?p=WantAuthError l4sm636961ioc.69 - gsmt

Answer 1

user和password字段不应该存储在同一个config.yaml文件中，而应该存储在在config.yaml中引用的另一个文件中。

例如，创建另一个名为auth.yaml的文件，并将user和password配置添加到其中：

user: "from_address@gmail.com"
password: "password"

然后，在config.yaml中，可以使用以下设置引用该文件：

smtp_auth_file: "/path/to/auth.yaml"