Elaborate on OSSEC alert instructions

Addresses #788 
Need to make edits to install.md to account for new document
@dolanjs I tested it and it worked for me, both with or without spaces.
Garrett did mention you had an issue.
On Dec 14, 2014 4:18 PM, "dolanjs" <notifications@github.com> wrote:

> In docs/ossec_alerts.md
> <https://github.com/freedomofpress/securedrop/pull/807#discussion-diff-21799519>
> :
>
> > +
> > +    openssl s_client -connect smtp.gmail.com:587 -starttls smtp < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin | cut -d'=' -f2
> > +
> > +The output of the command above should look like the following:
> > +
> > +    9C:0A:CC:93:1D:E7:51:37:90:61:6B:A1:18:28:67:95:54:C5:69:A8
> > +	
> > +Finally, enter the result as `smtp_relay_fingerprint`. Save `prod-specific.yml`, exit the editor and [proceed with the installation](install.md#prepare-to-install-securedrop) by running the playbooks.
> > +
> > +### Using Gmail for OSSEC alerts
> > +
> > +It's easy to get SecureDrop to use Google's servers to deliver the alerts, but it's not ideal from a security perspective. This option should be regarded as a backup plan. Keep in mind that you're leaking metadata about the timing of alerts to a third party — the alerts are encrypted and only readable to you, however that timing may prove useful to an attacker.
> > +
> > +First you should [sign up for a new account](https://accounts.google.com/SignUp?service=mail). You may use an existing Gmail account, but it's best to compartmentalize these alerts from any of your other activities. Choose a strong and random passphrase. Skip the creation of a Google+ profile and continue straight to Gmail. Once the account is created you can log out and provide the values for `sasl_username` as your new Gmail username (without the domain), `sasl_domain`, which is typically gmail.com (or your custom Google Apps domain), and `sasl_passwd` for the password. The `smtp_relay` is smtp.gmail.com, `smtp_relay_port` is 587 and `smtp_relay_fingerprint` is noted in the example above.
> > +
> > +We do not recommend enabling Google's 2-Step Verification if you're using a new Gmail account that is dedicated to sending the alert emails. On an existing account with 2-Step Verification enabled, you must navigate (using the settings in the top right) to Account > Signing in > App passwords, and generate a new App password which you will use as the `sasl_passwd`.
>
> We should test this again to see if it changed but 6 months ago gmail
> wouldn't accept app specific password for sasl authentication.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/freedomofpress/securedrop/pull/807/files#r21799519>.
>