Elaborate on OSSEC alert instructions

Addresses #788 
Need to make edits to install.md to account for new document
Garrett was against recommending it for new accounts cause he thinks it
adds another layer of complexity. I'm fine with it however.
On Dec 14, 2014 4:23 PM, "dolanjs" <notifications@github.com> wrote:

> In docs/ossec_alerts.md
> <https://github.com/freedomofpress/securedrop/pull/807#discussion-diff-21799593>
> :
>
> > +
> > +    openssl s_client -connect smtp.gmail.com:587 -starttls smtp < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin | cut -d'=' -f2
> > +
> > +The output of the command above should look like the following:
> > +
> > +    9C:0A:CC:93:1D:E7:51:37:90:61:6B:A1:18:28:67:95:54:C5:69:A8
> > +	
> > +Finally, enter the result as `smtp_relay_fingerprint`. Save `prod-specific.yml`, exit the editor and [proceed with the installation](install.md#prepare-to-install-securedrop) by running the playbooks.
> > +
> > +### Using Gmail for OSSEC alerts
> > +
> > +It's easy to get SecureDrop to use Google's servers to deliver the alerts, but it's not ideal from a security perspective. This option should be regarded as a backup plan. Keep in mind that you're leaking metadata about the timing of alerts to a third party — the alerts are encrypted and only readable to you, however that timing may prove useful to an attacker.
> > +
> > +First you should [sign up for a new account](https://accounts.google.com/SignUp?service=mail). You may use an existing Gmail account, but it's best to compartmentalize these alerts from any of your other activities. Choose a strong and random passphrase. Skip the creation of a Google+ profile and continue straight to Gmail. Once the account is created you can log out and provide the values for `sasl_username` as your new Gmail username (without the domain), `sasl_domain`, which is typically gmail.com (or your custom Google Apps domain), and `sasl_passwd` for the password. The `smtp_relay` is smtp.gmail.com, `smtp_relay_port` is 587 and `smtp_relay_fingerprint` is noted in the example above.
> > +
> > +We do not recommend enabling Google's 2-Step Verification if you're using a new Gmail account that is dedicated to sending the alert emails. On an existing account with 2-Step Verification enabled, you must navigate (using the settings in the top right) to Account > Signing in > App passwords, and generate a new App password which you will use as the `sasl_passwd`.
>
> cool if it works now then why are we stil recommending not to enable 2fa
> on that account? Was there any other reason? I think the app specific
> password part was the only blocker for that and if that is resolved think
> we should be recommending it.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/freedomofpress/securedrop/pull/807/files#r21799593>.
>