Configuration problem for secure virtual server
Hello,
i want to configure a virtual mailsystem on an debian server with exim and dovecot. Because it is running on a V-Server, i want to store everythink in a LUKS encrypted contrainer. So i created a group crypt with the members Debian-exim (107), dovecot, (other users with encrypted content)
All mails should be stored in /mail in the mounted container. Dovecot has this configuration:
passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf }
userdb { driver = static args = uid=Debian-exim gid=mail home=/mountpoint/mail/%d/%n }
mail_uid = Debian-exim
first_valid_uid = 107 last_valid_uid = 107
first_valid_gid = 8 last_valid_gid = 9
mail_location = maildir:/mountpoint/mail/%d/%n
The /mountpoint has the following rights: drwxrwx--- 5 root crypt 4,0K Dez 13 19:05 mountpoint
The subdirectories are all owned by Debian-exim: drwxrwx--- 4 Debian-exim mail 4,0K Okt 23 17:05 mail
The group mail has id 8 and the group crypt has id 9
The Problem is that dovecot will not go into the directory with group crypt! I always get the following error message:
Dec 15 18:03:25 pop3(karsten@server): Error: user karsten@server: Initialization failed: Initializing mail storage from mail_location setting failed: stat(/mountpoint/mail/server/karsten) failed: Permission denied (euid=107(Debian-exim) egid=8(mail) missing +x perm: /mnt, we're not in group 9(crypt), dir owned by 0:9 mode=0770) Dec 15 18:03:25 pop3(karsten@server): Error: Invalid user settings. Refer to server log for more information.
But dovecot is definitely in the group crypt!
What i am doing wrong?
Regards Karsten
On Qui, 15 Dez 2016, Karsten Malcher wrote:
Hello,
mail_uid = Debian-exim This will be important later
Dec 15 18:03:25 pop3(karsten@server): Error: user karsten@server:
Initialization failed: Initializing mail storage from mail_location setting failed: stat(/mountpoint/mail/server/karsten)
failed: Permission denied (euid=107(Debian-exim) egid=8(mail) missing +x perm: /mnt, we're not in group 9(crypt), dir
owned by 0:9 mode=0770) Dec 15 18:03:25 pop3(karsten@server): Error: Invalid user settings.
Refer to server log for more information.But dovecot is definitely in the group crypt!
dovecot may be, but the process is not trying to access as user
dovecot, but as Debian-exim (as shown in the log). And this happens
because of the mail_uid line in your config.
-- Eduardo M KALINOWSKI eduardo@kalinowski.com.br
Am 15.12.2016 um 18:22 schrieb Eduardo M KALINOWSKI:
On Qui, 15 Dez 2016, Karsten Malcher wrote:
Hello,
mail_uid = Debian-exim This will be important later
It does not run when i comment this out.
Dovecot was running before i moved the mail-path from a non encrypted one to the encrypted path.
Dec 15 18:03:25 pop3(karsten@server): Error: user karsten@server: Initialization failed: Initializing mail storage from mail_location setting failed: stat(/mountpoint/mail/server/karsten) failed: Permission denied (euid=107(Debian-exim) egid=8(mail) missing +x perm: /mnt, we're not in group 9(crypt), dir owned by 0:9 mode=0770) Dec 15 18:03:25 pop3(karsten@server): Error: Invalid user settings. Refer to server log for more information.
But dovecot is definitely in the group crypt!
dovecot may be, but the process is not trying to access as user dovecot, but as Debian-exim (as shown in the log). And this happens because of the mail_uid line in your config.
Yes - the error message say it - but Debian-exim is in the group crypt too. Dovecot is rejecting the path of the mountpoint! Why?
I can only login when i alter the group to crypt. But then dovecot has the problem that it is not in group mail:
Dec 15 18:33:39 imap(karsten@server): Error: fchown(/mountpoint/mail/server/karsten/dovecot-uidlist.tmp, group=8(mail)) failed: Operation not permitted (egid=9(crypt), group based on /mountpoint/mail/server/karsten - see http://wiki2.dovecot.org/Errors/ChgrpNoPerm)
So dovecot will not handle different groups in the path !?
participants (2)
-
Eduardo M KALINOWSKI
-
Karsten Malcher