Linux – Maximum number of groups in Linux

Mail submission to smtp.gmail.com:587 will fail if STARTTLS is not issued:

[palantir]-[/var/tmp]-[528] % nc smtp.gmail.com 587                        [2:16]
220 mx.google.com ESMTP b3sm14232728ibf.7
EHLO domain.com
250-mx.google.com at your service, [67.167.112.165]
250-SIZE 35651584
250-8BITMIME
250-STARTTLS
250 ENHANCEDSTATUSCODES
MAIL      
530 5.7.0 Must issue a STARTTLS command first. b3sm14232728ibf.7
STARTTLS
220 2.0.0 Ready to start TLS

For this use case, your credentials must be transmitted over TLS to be transmitted at all, so they are not being sent in the clear. Note however that while this is common behavior, this is not the required behavior -- it is quite possible that a server doesn't require TLS on the submission port, and also possible to similarly misconfigure your client.

As joschi mentioned, you can make sure it is encrypted with any tool that can capture packets off the wire, and I'd like to add tcpflow as a suggestion as well for that.

There are two basic techniques I'm aware of --

Method One: Microsoft's Identity Management for UNIX - This allows you to expose ActiveDirectory as a NIS server.
This works with pretty much any *NIX flavor out there (they all support NIS), and has all the benefit (and drawbacks) of NIS. It is also officially supported by Microsoft, which means you have someone to call if stuff breaks.

Method Two: pam_ldap/nss_ldap (or similar, newer systems).
This works with any modern *NIX flavor capable of authenticating against LDAP directories, and may be included by default with Ubuntu and CentOS these days. It is a bit more robust/modern than the NIS-like hackery in Method One, but less likely to be officially supported by Microsoft.

Both of these techniques require you to extend AD Users and Groups to be POSIX Users & Groups respectively so that there are usable POSIX UIDs and GIDs for your *NIX systems -- Microsoft provides this capability in Active Directory.
An added benefit to Method Two above is that you can further extend the users to enable you to use the OpenSSH LDAP Public Key patch, which lets you store SSH keys in LDAP and eliminates the task of synchronizing authorized_keys files around your network.