[Dovecot] Installing Dovecot on Gentoo
Christian Rößner
cr at sys4.de
Sun Jan 13 16:46:54 EET 2013
Hi,
I have an already working dovecot server on Ubuntu 10.04 with self-created packages version 2.1.13. This setup is working prefect. Now that I do not wish to continue using Ubuntu (to much work for Upgrading), I decided to switch to Gentoo, as I had made best experiences in the past…
I have installed Dovecot on Gentoo and I copied over all my configs and certs and stuff. Also created a user vmail with identical uid/gid and also checked all permissions for the certificate stuff.
Dovecot starts. I also can connect to it. But when trying to login, I get errors:
-------------------------------------------------------
telnet localhost 143
Trying ::1...
Connected to localhost.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=NTLM] Dovecot ready.
. login croessner <hiddenpw>
. NO [UNAVAILABLE] Temporary authentication failure. [mx0:2013-01-13 14:24:02]
-------------------------------------------------------
In the logs it looks like this:
-------------------------------------------------------
Jan 13 15:22:30 mx0 dovecot: master: Dovecot v2.1.13 starting up (core dumps disabled)
Jan 13 15:23:11 mx0 dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth
Jan 13 15:23:11 mx0 dovecot: auth: Debug: passwd-file /etc/dovecot/master-users: Read 1 users in 0 secs
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation_s
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_initial_request
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_new_connection 1 1 0
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_int_open_connection
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_connect_to_host: TCP db.roessner-net.de:389
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_new_socket: 17
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_prepare_socket: 17
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_connect_to_host: Trying 193.239.107.37:389
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_pvt_connect: fd: 17 tm: -1 async: 0
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_open_defconn: successful
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_server_request
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_result ld 0x35d6dd481c0 msgid 1
Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg ld 0x35d6dd481c0 msgid 1 (infinite timeout)
Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg continue ld 0x35d6dd481c0 msgid 1 all 1
Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Connections:
Jan 13 15:23:11 mx0 dovecot: auth: Error: * host: db.roessner-net.de port: 389 (default)
Jan 13 15:23:11 mx0 dovecot: auth: Error: refcnt: 2 status: Connected
Jan 13 15:23:11 mx0 dovecot: auth: Error: last used: Sun Jan 13 15:23:11 2013
Jan 13 15:23:11 mx0 dovecot: auth: Error:
Jan 13 15:23:11 mx0 dovecot: auth: Error:
Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Outstanding Requests:
Jan 13 15:23:11 mx0 dovecot: auth: Error: * msgid 1, origid 1, status InProgress
Jan 13 15:23:11 mx0 dovecot: auth: Error: outstanding referrals 0, parent count 0
Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 request count 1 (abandoned 0)
Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Response Queue:
Jan 13 15:23:11 mx0 dovecot: auth: Error: Empty
Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 response count 0
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList ld 0x35d6dd481c0 msgid 1 all 1
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList returns ld 0x35d6dd481c0 NULL
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_int_select
Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 msgid 1 all 1
Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 msgid 1 message type extended-result
Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 0 new referrals
Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: mark request completed, ld 0x35d6dd481c0 msgid 1
Jan 13 15:23:11 mx0 dovecot: auth: Error: request done: ld 0x35d6dd481c0 msgid 1
Jan 13 15:23:11 mx0 dovecot: auth: Error: res_errno: 0, res_error: <>, res_matched: <>
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_free_request (origid 1, msgid 1)
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_parse_extended_result
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_parse_result
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_msgfree
Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: could not use key file `/etc/ssl/private/mx0.roessner-net.de.key.pem'.
Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: error:0200100D:system library:fopen:Permission denied bss_file.c:398
Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: error:20074002:BIO routines:FILE_CTRL:system lib bss_file.c:400
Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib ssl_rsa.c:648
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_err2string
Jan 13 15:23:11 mx0 dovecot: auth: Error: LDAP: ldap_start_tls_s() failed: Connect error
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation_s
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_initial_request
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_server_request
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_result ld 0x35d6dd481c0 msgid 2
Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg ld 0x35d6dd481c0 msgid 2 (infinite timeout)
Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg continue ld 0x35d6dd481c0 msgid 2 all 1
Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Connections:
Jan 13 15:23:11 mx0 dovecot: auth: Error: * host: db.roessner-net.de port: 389 (default)
Jan 13 15:23:11 mx0 dovecot: auth: Error: refcnt: 2 status: Connected
Jan 13 15:23:11 mx0 dovecot: auth: Error: last used: Sun Jan 13 15:23:11 2013
Jan 13 15:23:11 mx0 dovecot: auth: Error:
Jan 13 15:23:11 mx0 dovecot: auth: Error:
Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Outstanding Requests:
Jan 13 15:23:11 mx0 dovecot: auth: Error: * msgid 2, origid 2, status InProgress
Jan 13 15:23:11 mx0 dovecot: auth: Error: outstanding referrals 0, parent count 0
Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 request count 1 (abandoned 0)
Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Response Queue:
Jan 13 15:23:11 mx0 dovecot: auth: Error: Empty
Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 response count 0
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList ld 0x35d6dd481c0 msgid 2 all 1
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList returns ld 0x35d6dd481c0 NULL
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_int_select
Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 msgid 2 all 1
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_err2string
Jan 13 15:23:11 mx0 dovecot: auth: Error: LDAP: ldap_start_tls_s() failed: Can't contact LDAP server
Jan 13 15:23:11 mx0 dovecot: auth: Debug: auth client connected (pid=24045)
Jan 13 15:24:00 mx0 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=YAanRyzTOAAAAAAAAAAAAAAAAAAAAAAB#011lip=::1#011rip=::1#011lport=143#011rport=59960#011resp=<hidden>
Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_extended_operation_s
Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_extended_operation
Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_send_initial_request
Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_send_server_request
Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_err2string
Jan 13 15:24:00 mx0 dovecot: auth: Error: LDAP: ldap_start_tls_s() failed: Can't contact LDAP server
Jan 13 15:24:02 mx0 dovecot: auth: Debug: client passdb out: FAIL#0111#011user=croessner#011temp
Jan 13 15:26:11 mx0 dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 131 secs): user=<croessner>, method=PLAIN, rip=::1, lip=::1, secured, session=<YAanRyzTOAAAAAAAAAAAAAAAAAAAAAAB>
Jan 13 15:27:11 mx0 dovecot: auth: Error: ldap_unbind
Jan 13 15:27:11 mx0 dovecot: auth: Error: ldap_free_request (origid 2, msgid 2)
Jan 13 15:27:11 mx0 dovecot: auth: Error: ldap_free_connection 1 1
Jan 13 15:27:11 mx0 dovecot: auth: Error: ldap_free_connection: actually freed
-------------------------------------------------------
I checked if Dovecot would even try to access the key:
-------------------------------------------------------
inotifywait -m -r --format '%:e %f' /etc/ssl
Setting up watches. Beware: since -r was given, this may take a while!
Watches established.
OPEN mail.roessner-net.de.pem
ACCESS mail.roessner-net.de.pem
CLOSE_NOWRITE:CLOSE mail.roessner-net.de.pem
OPEN mail.roessner-net.de.key.pem
ACCESS mail.roessner-net.de.key.pem
CLOSE_NOWRITE:CLOSE mail.roessner-net.de.key.pem
OPEN SSL123_CA_Bundle.pem
ACCESS SSL123_CA_Bundle.pem
CLOSE_NOWRITE:CLOSE SSL123_CA_Bundle.pem
OPEN mail.roessner-net.de.pem
ACCESS mail.roessner-net.de.pem
ACCESS mail.roessner-net.de.pem
ACCESS mail.roessner-net.de.pem
ACCESS mail.roessner-net.de.pem
ACCESS mail.roessner-net.de.pem
CLOSE_NOWRITE:CLOSE mail.roessner-net.de.pem
OPEN mail.roessner-net.de.key.pem
ACCESS mail.roessner-net.de.key.pem
ACCESS mail.roessner-net.de.key.pem
CLOSE_NOWRITE:CLOSE mail.roessner-net.de.key.pem
OPEN SSL123_CA_Bundle.pem
ACCESS SSL123_CA_Bundle.pem
ACCESS SSL123_CA_Bundle.pem
ACCESS SSL123_CA_Bundle.pem
ACCESS SSL123_CA_Bundle.pem
CLOSE_NOWRITE:CLOSE SSL123_CA_Bundle.pem
OPEN ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
ACCESS ca-certificates.crt
CLOSE_NOWRITE:CLOSE ca-certificates.crt
OPEN mx0.roessner-net.de.pem
ACCESS mx0.roessner-net.de.pem
CLOSE_NOWRITE:CLOSE mx0.roessner-net.de.pem
OPEN openssl.cnf
ACCESS openssl.cnf
ACCESS openssl.cnf
ACCESS openssl.cnf
CLOSE_NOWRITE:CLOSE openssl.cnf
OPEN openssl.cnf
ACCESS openssl.cnf
ACCESS openssl.cnf
ACCESS openssl.cnf
CLOSE_NOWRITE:CLOSE openssl.cnf
-------------------------------------------------------
I can not find any line talking about mx0.roessner-net.de.key.pem. The file exists and has proper permissions:
-------------------------------------------------------
l /etc/ssl/private/
total 16
drwxr-s---+ 2 root ssl-cert 4096 Jan 12 19:29 ./
drwxr-xr-x 8 root root 4096 Jan 13 15:26 ../
-rw-r--r-- 1 root root 0 Dec 10 18:14 .keep_dev-libs_openssl-0
-r--r----- 1 root ssl-cert 1679 Jan 12 17:23 mail.roessner-net.de.key.pem
-r--r-----+ 1 root ssl-cert 887 Jan 12 17:14 mx0.roessner-net.de.key.pem
getfacl /etc/ssl/private/ /etc/ssl/private/mx0.roessner-net.de.key.pem
getfacl: Removing leading '/' from absolute path names
# file: etc/ssl/private/
# owner: root
# group: ssl-cert
# flags: -s-
user::rwx
user:amavis:r-x
group::---
mask::r-x
other::---
# file: etc/ssl/private/mx0.roessner-net.de.key.pem
# owner: root
# group: ssl-cert
user::r--
user:amavis:r-x #effective:r--
group::r--
mask::r--
other::---
-------------------------------------------------------
Here is my doveconf -n:
-------------------------------------------------------
# 2.1.13: /etc/dovecot/dovecot.conf
# OS: Linux 3.7.0-hardened x86_64 Gentoo Base System release 2.1
auth_debug = yes
auth_master_user_separator = *
auth_mechanisms = plain login cram-md5 digest-md5 ntlm
auth_verbose = yes
hostname = mail.roessner-net.de
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
mail_access_groups = vmail
mail_attachment_dir = /var/mail/virtual/copymail/attachments
mail_debug = yes
mail_gid = vmail
mail_location = mdbox:~/mdbox
mail_plugins = autocreate quota acl fts fts_solr zlib
mail_privileged_group = mail
mail_uid = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
mdbox_rotate_size = 128 M
namespace {
list = children
location = mdbox:%%h/mdbox
prefix = shared/%%u/
separator = /
subscriptions = no
type = shared
}
namespace inbox {
inbox = yes
location =
mailbox "Deleted Messages" {
special_use = \Trash
}
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk-E-Mail {
special_use = \Junk
}
mailbox Junk {
special_use = \Junk
}
mailbox Sent {
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
mailbox junkmail {
special_use = \Junk
}
prefix =
separator = /
type = private
}
passdb {
args = /etc/dovecot/master-users
driver = passwd-file
master = yes
pass = yes
}
passdb {
args = /etc/dovecot/dovecot-ldap.conf.ext
driver = ldap
}
plugin {
acl = vfile
acl_shared_dict = file:/var/mail/virtual/shared-mailboxes.db
autocreate = Trash
autocreate2 = Sent
autocreate3 = Drafts
autocreate4 = junkmail
autosubscribe = Trash
autosubscribe2 = Sent
autosubscribe3 = Drafts
autosubscribe4 = junkmail
fts = solr
fts_solr = break-imap-search url=http://localhost:8080/solr/
quota = dict:User quota::file:%h/mdbox/dovecot-quota
quota_rule = *:storage=300M:messages=20000
quota_warning = storage=95%% quota-warning 95 %u
quota_warning2 = storage=80%% quota-warning 80 %u
sieve = ~/.dovecot.sieve
sieve_dir = ~/sieve
zlib_save = gz
zlib_save_level = 6
}
protocols = imap pop3 lmtp sieve
service auth-worker {
extra_groups = ssl-cert
unix_listener auth-worker {
mode = 0600
user = vmail
}
user = vmail
}
service auth {
extra_groups = ssl-cert
unix_listener auth-userdb {
mode = 0600
user = vmail
}
user = vmail
}
service dict {
unix_listener dict {
mode = 0600
user = vmail
}
}
service lmtp {
unix_listener /var/spool/postfix/private/lmtp-dovecot {
group = postfix
mode = 0666
user = postfix
}
}
service quota-warning {
executable = script /usr/local/bin/quota-warning.sh
unix_listener quota-warning {
user = vmail
}
user = dovecot
}
ssl_ca = </etc/ssl/certs/SSL123_CA_Bundle.pem
ssl_cert = </etc/ssl/certs/mail.roessner-net.de.pem
ssl_key = </etc/ssl/private/mail.roessner-net.de.key.pem
userdb {
args = /etc/dovecot/dovecot-ldap.conf.ext
driver = ldap
}
verbose_proctitle = yes
verbose_ssl = yes
protocol lmtp {
mail_plugins = autocreate quota acl fts fts_solr zlib sieve
}
protocol imap {
imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags
mail_max_userip_connections = 50
mail_plugins = autocreate quota acl fts fts_solr zlib imap_quota imap_acl imap_zlib
}
-------------------------------------------------------
LDAP looks like this:
-------------------------------------------------------
uris = ldap://db.roessner-net.de/ ldap://roessner1.roessner-net.de/
sasl_bind = yes
sasl_mech = EXTERNAL
tls = yes
tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt
tls_cert_file = /etc/ssl/certs/mx0.roessner-net.de.pem
tls_key_file = /etc/ssl/private/mx0.roessner-net.de.key.pem
tls_require_cert = hard
debug_level = 7
base = ou=people,ou=it,dc=roessner-net,dc=de
user_attrs = rnsMSQuota=quota_rule=*:storage=%$,rnsMSMailboxHome=home
user_filter = (&(objectClass=rnsMSDovecotAccount)(|(rnsMSRecipientAddress=%u)(uniqueIdentifier=%u)))
pass_attrs = rnsMSDeliverToAddress=user,userPassword=password
pass_filter = (&(objectClass=rnsMSDovecotAccount)(|(rnsMSRecipientAddress=%u)(uniqueIdentifier=%u))(rnsMSEnableDovecot=TRUE))
iterate_attrs = rnsMSDovecotUser=user
iterate_filter = (objectClass=rnsMSDovecotAccount)
default_pass_scheme = PLAIN
-------------------------------------------------------
Some portage information
-------------------------------------------------------
[ebuild R ] net-nds/openldap-2.4.30 USE="berkdb crypt ipv6 minimal sasl ssl syslog tcpd -cxx -debug -experimental -gnutls -icu -iodbc -kerberos -odbc -overlays -perl -samba (-selinux) -slp -smbkrb5passwd" 0 kB
[ebuild R ] dev-libs/cyrus-sasl-2.1.25-r3:2 USE="berkdb gdbm ldapdb openldap pam ssl urandom -authdaemond -java -kerberos -mysql -postgres -sample -sqlite -srp -static-libs" 0 kB
[ebuild R ~] net-mail/dovecot-2.1.13::croessner USE="bzip2 caps imapc ipv6 ldap maildir managesieve mbox mdbox pam pop3c sdbox sieve solr sqlite ssl suid zlib -cydir -doc -kerberos -lucene -mysql -postgres (-selinux) -static-libs -vpopmail" 0 kB
-------------------------------------------------------
As you can see, I have spent some time on this without luck and currently I have no idea, what the problem is.
Any ideas on that?
Thanks in advance
-Christian Rößner
--
[*] sys4 AG
http://sys4.de, +49 (89) 30 90 46 64
Franziskanerstraße 15, 81669 München
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer
Aufsichtsratsvorsitzender: Joerg Heidrich
More information about the dovecot
mailing list