[dovecot] Re: Trouble setting up dovecot

[Tim Snider]

Thanks Timo, turns out I'm more of a rookie at sysconfiguring than I
thought, so perhaps this helps identify stuff that a rookie wouldn't
already know...<G>


On Thu, 2003-02-20 at 19:46, Timo Sirainen wrote:
> 
> > I've not configured up LDAP on my server yet, so it's just plain PAM for
> > now. I'm able to login fine with all my other apps, so I doubt it's a
> > problem with PAM, but not impossible. I haven't done anything with PAM
> > on this machine yet as it's live. I've been testing things out on
> > another machine(NON-SMP/RH8), which I'll try tomorrow if I get a
> > chance.)
> 
> You have to have it configured in /etc/pam.d/imap. For example:
> 
> auth    required        pam_unix.so nullok
> account required        pam_unix.so

Thanks this makes more sense than the options you provide in
doc/auth.txt, so you may wish to change that. On both RH7.3 and a RH8.0
box here, I don't have pwdfile, it's apparently been replaced by other
functionality.
> 
> > each imap-login is waiting at a read(7,
> 
> That's the problem then. It really shouldn't be blocking there. Could
> you get the backtrace to see where it's hanging? ie. run as root:
> 
> gdb /usr/local/libexec/dovecot/imap-login <pid of the imap-login>
> 
> and "bt" in it.

It's hung up in SSL_CTX_use_PrivateKey() in ssl-proxy-openssl.c, which
as you correctly surmised below, is due to a password protected key. 

I've located and used mkcert.sh. As a note the only docs for
doc/mkcert.sh are halfway through the NEWS file and rapidly receeding as
you add new releases, (congrats on the fast progress by the way!),
however you might consider adding a short note about it to the
doc/auth.txt or doc/configuration.txt file for those new to dovecot.

> > > I do call fflush() after each write to log. Killing with SIGTERM will do
> > > clean exit which may log more things, maybe it's just that? Also killing
> > > child processes makes master process log their exits.
> > 
> > I usually note the messages log (watched by a tail -f) show up after I
> > kill the dovecot master process.(Kill -9)
> 
> Depends on what the messages are I guess. But if you're kill -9ing the
> master process, it's quite likely that the child processes will complain
> about losing it.

After playing a bit, I think that those messages were due to the kill
-9, SIGTERM is nicer. I still end up with little in the way of verbose
debugging messages, by my standards. Usually all I see is login and
logout messages. Otherwise, I get the occasional lockfile message, which
is something that I need to sort out with Exim, and completely on my
end.

> > dovecot: Feb 20 18:11:51 Info: Dovecot starting up
> > imap-login: Dec 31 16:00:00 Fatal: Can't load private key file
> > /usr/local/ssl/private/cedarintkey.pem: error:0906406D:PEM
> > routines:DEF_CALLBACK:problems getting password
> 
> Err, isn't this the reason why your SSL doesn't work? :) Or was that
> just an example? If your private key is crypted with some password,
> Dovecot can't use it at least currently..

Correct! Doh! I have been able to use imaps, since I built a
non-passworded private key. I was using passworded keys that I'd built
for Apache, and would eventually like to have one set of keys that I can
reference for each virtual domain. Were you planning on something like
the Apache startssl option?

I can live with the constraint of one 'connection' key for now. Have you
considered allowing each virtual domain to have it's own keys? Kind of
difficult as the secure pipe to the server is already in place by the
time the login name is seen... Kinda makes it tough for a true virtual
presence without explicit assigned IP's. Hmmm, any plans for at least a
different keys/identity per IP? If I understand the configuration file
for now, it seems to be designed for one cert per machine.

Thanks for the help, I've just got to sort out the lockfile differences
between Exim and Dovecot and I should then be functional. After that
I'll start using LDAP.

TJ