Hi, i have a problem. I sent test e-mail. It is in folder "Sent", but it was not delivered (folder "Inbox" is empty). /var/log/dovecot: ......... lda(mail@example.com): Error: User initialization failed: mail_crypt_plugin: mail_crypt_global_public_key: Couldn't parse public key: Unknown key format .........
Try RSA and EC: https://wiki2.dovecot.org/Plugins/MailCrypt#RSA_key https://wiki2.dovecot.org/Plugins/MailCrypt#EC_key
Why "Unknown key format"?
RSA pubkey: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4hfgRDlMJtN9rcV2VGa8gOF1g xiXHwokRkKmKfr64ZbqAhXzLzP8fSLo8ZEtRzfS3f/EyLRvYL9LHxlxYuSnq2LTW lbvSj8jcg3ucpA431Pbnq/OVI8WsXhXhZdipGcBDyzWHZw5Dp3I/am+FB96VlfPW maHO/oKGphXXhXSOXwIDAQAB -----END PUBLIC KEY-----
EC pubkey: -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEw96p6hvv/BJi9njHyXq05ZrKA3RR BNFOslljkgv6YUb4de1pln6hTUN69CjMBEB5P3YI7KP8hooozwM8iN/wLQ== -----END PUBLIC KEY-----
# 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.4.39-std-def-alt0.M80P.1 x86_64 ALT 8.1 Server auth_debug = yes auth_debug_passwords = yes auth_default_realm = example.com auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes auth_verbose_passwords = plain base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot disable_plaintext_auth = no first_valid_gid = 502 first_valid_uid = 502 last_valid_gid = 502 last_valid_uid = 502 log_path = /var/log/dovecot login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_access_groups = vmail mail_debug = yes mail_gid = 502 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = mail_crypt mail_privileged_group = vmail mail_uid = 502 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify mbox_write_locks = fcntl namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { inbox = yes location = prefix = separator = / type = private } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_crypt_curve = prime256v1 mail_crypt_global_private_key = </etc/dovecot/eckey/ecprivkey.pem mail_crypt_global_public_key = </etc/dovecot/eckey/ecpubkey.pem mail_crypt_save_version = 2 recipient_delimiter = + sieve = /etc/dovecot/sieves/default.sieve sieve_default = /etc/dovecot/sieves/default.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags sieve_max_redirects = 8 } protocols = imap pop3 lmtp sieve service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service imap { process_limit = 1024 vsz_limit = 256 M } service lmtp { unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } vsz_limit = 64 M } service pop3-login { inet_listener pop3 { port = 110 } } service pop3 { process_limit = 1024 } ssl_ca = /var/lib/ssl/cert.pem ssl_cert = </etc/dovecot/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-ldap-user.conf.ext driver = ldap } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = mail_crypt sieve } protocol lda { mail_plugins = mail_crypt sieve quota plugin { quota = dict:user::file:/var/vmail/glu_vrem/%n/.quotausage } } protocol imap { mail_plugins = mail_crypt autocreate quota imap_quota plugin { autocreate = INBOX autocreate2 = Sent autocreate3 = Trash autocreate4 = Drafts autocreate5 = Junk autosubscribe = INBOX autosubscribe2 = Sent autosubscribe3 = Trash autosubscribe4 = Drafts autosubscribe5 = Junk quota = dict:user::file:/var/vmail/glu_vrem/%n/.quotausage } } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv }
-- WBR, BaseALT/ALTLinux Team
We tried these rights:
[root@mail44 dovecot]# ls -la итого 80 drwxr-xr-x 8 root root 4096 янв 13 13:17 . drwxr-xr-x 98 root root 12288 янв 11 11:47 .. drwxrwxrwx 2 root root 4096 янв 10 15:58 eckey drwxr-xr-x 2 root root 4096 янв 13 12:42 eckey2 drwxr-xr-x 2 vmail vmail 4096 янв 11 09:14 RSAkey
[root@mail44 dovecot]# cd eckey2 [root@mail44 eckey2]# ls -la итого 16 drwxr-xr-x 2 root root 4096 янв 13 12:42 . drwxr-xr-x 8 root root 4096 янв 13 13:17 .. -rw-r--r-- 1 root root 316 янв 13 12:41 ecprivkey.pem -rw-r--r-- 1 root root 232 янв 13 12:42 ecpubkey.pem
----- Исходное сообщение -----
От: "Aki Tuomi" <aki.tuomi@dovecot.fi> Кому: "dovecot" <dovecot@dovecot.org> Отправленные: Пятница, 13 Январь 2017 г 14:18:55 Тема: Re: Plugin "mail_crypt" does not work
On 13.01.2017 12:21, Evgeniy Korneechev wrote:
mail_crypt_global_public_key = </etc/dovecot/eckey/ecpubkey.pem
Is this world-wide readable file? Is LDA able to access this?
Aki
-- WBR, BaseALT/ALTLinux Team
Hi, guys. Also, currently a problem (with http://wiki2.dovecot.org/Plugins/MailCrypt#EC_key):
# dovecot mailbox cryptokey generate -u name@example.com -UR doveadm(name@example.com): Error: mail_crypt_user_get_public_key(name@example.com) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled
Something is wrong in the settings? Or bug?
The same error in log when sending emails (with http://wiki2.dovecot.org/Plugins/MailCrypt#Base64_encoded_keys):
Error: sieve: msgid=<57720a813eb7817c80ff67b21718ae42@example.com>: failed to store into mailbox 'INBOX': get_public_key(INBOX) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled
Any ideas?
----- Исходное сообщение -----
От: "Evgeniy Korneechev" <ekorneechev@altlinux.org> Кому: "dovecot" <dovecot@dovecot.org> Отправленные: Понедельник, 16 Январь 2017 г 18:17:44 Тема: Re: Plugin "mail_crypt" does not work
We tried these rights:
[root@mail44 dovecot]# ls -la итого 80 drwxr-xr-x 8 root root 4096 янв 13 13:17 . drwxr-xr-x 98 root root 12288 янв 11 11:47 .. drwxrwxrwx 2 root root 4096 янв 10 15:58 eckey drwxr-xr-x 2 root root 4096 янв 13 12:42 eckey2 drwxr-xr-x 2 vmail vmail 4096 янв 11 09:14 RSAkey
[root@mail44 dovecot]# cd eckey2 [root@mail44 eckey2]# ls -la итого 16 drwxr-xr-x 2 root root 4096 янв 13 12:42 . drwxr-xr-x 8 root root 4096 янв 13 13:17 .. -rw-r--r-- 1 root root 316 янв 13 12:41 ecprivkey.pem -rw-r--r-- 1 root root 232 янв 13 12:42 ecpubkey.pem
----- Исходное сообщение -----
От: "Aki Tuomi" <aki.tuomi@dovecot.fi> Кому: "dovecot" <dovecot@dovecot.org> Отправленные: Пятница, 13 Январь 2017 г 14:18:55 Тема: Re: Plugin "mail_crypt" does not work
On 13.01.2017 12:21, Evgeniy Korneechev wrote:
mail_crypt_global_public_key = </etc/dovecot/eckey/ecpubkey.pem
Is this world-wide readable file? Is LDA able to access this?
Aki
-- WBR, BaseALT/ALTLinux Team
-- WBR, BaseALT/ALTLinux Team
mail_attribute_dict = file:%h/Maildir/dovecot-attributes > dovecot.conf
Apparently so?))
----- Исходное сообщение -----
От: "Evgeniy Korneechev" <ekorneechev@altlinux.org> Кому: "dovecot" <dovecot@dovecot.org> Отправленные: Вторник, 17 Январь 2017 г 17:32:38 Тема: Re: Plugin "mail_crypt" does not work
Hi, guys. Also, currently a problem (with http://wiki2.dovecot.org/Plugins/MailCrypt#EC_key):
# dovecot mailbox cryptokey generate -u name@example.com -UR doveadm(name@example.com): Error: mail_crypt_user_get_public_key(name@example.com) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled
Something is wrong in the settings? Or bug?
The same error in log when sending emails (with http://wiki2.dovecot.org/Plugins/MailCrypt#Base64_encoded_keys):
Error: sieve: msgid=<57720a813eb7817c80ff67b21718ae42@example.com>: failed to store into mailbox 'INBOX': get_public_key(INBOX) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled
Any ideas?
----- Исходное сообщение -----
От: "Evgeniy Korneechev" <ekorneechev@altlinux.org> Кому: "dovecot" <dovecot@dovecot.org> Отправленные: Понедельник, 16 Январь 2017 г 18:17:44 Тема: Re: Plugin "mail_crypt" does not work
We tried these rights:
[root@mail44 dovecot]# ls -la итого 80 drwxr-xr-x 8 root root 4096 янв 13 13:17 . drwxr-xr-x 98 root root 12288 янв 11 11:47 .. drwxrwxrwx 2 root root 4096 янв 10 15:58 eckey drwxr-xr-x 2 root root 4096 янв 13 12:42 eckey2 drwxr-xr-x 2 vmail vmail 4096 янв 11 09:14 RSAkey
[root@mail44 dovecot]# cd eckey2 [root@mail44 eckey2]# ls -la итого 16 drwxr-xr-x 2 root root 4096 янв 13 12:42 . drwxr-xr-x 8 root root 4096 янв 13 13:17 .. -rw-r--r-- 1 root root 316 янв 13 12:41 ecprivkey.pem -rw-r--r-- 1 root root 232 янв 13 12:42 ecpubkey.pem
----- Исходное сообщение -----
От: "Aki Tuomi" <aki.tuomi@dovecot.fi> Кому: "dovecot" <dovecot@dovecot.org> Отправленные: Пятница, 13 Январь 2017 г 14:18:55 Тема: Re: Plugin "mail_crypt" does not work
On 13.01.2017 12:21, Evgeniy Korneechev wrote:
mail_crypt_global_public_key = </etc/dovecot/eckey/ecpubkey.pem
Is this world-wide readable file? Is LDA able to access this?
Aki
-- WBR, BaseALT/ALTLinux Team
-- WBR, BaseALT/ALTLinux Team
-- WBR, BaseALT/ALTLinux Team
Hi!
Some replies:
- the problem with mail_crypt_global_public_key, there is a bug that we are fixing where file inputs under plugin { } section do not get aboard.
workaround 1: You can base64 encode the PEM key (yes, again), and put it in one line such as
plugin { mail_crypt_global_public_key = LS0tLS1C..... }
workaround 2: Return the key from userdb, you can use same format.
- The mail_attribute_dict thing requires that setting you discovered, but be advised that in this mode it will create a keypair for each user, and keypair per folder.
For security and performance reasons, we recommend using ECDSA keys instead of RSA keys.
Aki Tuomi Dovecot oy
On January 17, 2017 at 4:40 PM Evgeniy Korneechev <ekorneechev@altlinux.org> wrote:
mail_attribute_dict = file:%h/Maildir/dovecot-attributes > dovecot.conf
Apparently so?))
----- Исходное сообщение -----
От: "Evgeniy Korneechev" <ekorneechev@altlinux.org> Кому: "dovecot" <dovecot@dovecot.org> Отправленные: Вторник, 17 Январь 2017 г 17:32:38 Тема: Re: Plugin "mail_crypt" does not work
Hi, guys. Also, currently a problem (with http://wiki2.dovecot.org/Plugins/MailCrypt#EC_key):
# dovecot mailbox cryptokey generate -u name@example.com -UR doveadm(name@example.com): Error: mail_crypt_user_get_public_key(name@example.com) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled
Something is wrong in the settings? Or bug?
The same error in log when sending emails (with http://wiki2.dovecot.org/Plugins/MailCrypt#Base64_encoded_keys):
Error: sieve: msgid=<57720a813eb7817c80ff67b21718ae42@example.com>: failed to store into mailbox 'INBOX': get_public_key(INBOX) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled
Any ideas?
----- Исходное сообщение -----
От: "Evgeniy Korneechev" <ekorneechev@altlinux.org> Кому: "dovecot" <dovecot@dovecot.org> Отправленные: Понедельник, 16 Январь 2017 г 18:17:44 Тема: Re: Plugin "mail_crypt" does not work
We tried these rights:
[root@mail44 dovecot]# ls -la итого 80 drwxr-xr-x 8 root root 4096 янв 13 13:17 . drwxr-xr-x 98 root root 12288 янв 11 11:47 .. drwxrwxrwx 2 root root 4096 янв 10 15:58 eckey drwxr-xr-x 2 root root 4096 янв 13 12:42 eckey2 drwxr-xr-x 2 vmail vmail 4096 янв 11 09:14 RSAkey
[root@mail44 dovecot]# cd eckey2 [root@mail44 eckey2]# ls -la итого 16 drwxr-xr-x 2 root root 4096 янв 13 12:42 . drwxr-xr-x 8 root root 4096 янв 13 13:17 .. -rw-r--r-- 1 root root 316 янв 13 12:41 ecprivkey.pem -rw-r--r-- 1 root root 232 янв 13 12:42 ecpubkey.pem
----- Исходное сообщение -----
От: "Aki Tuomi" <aki.tuomi@dovecot.fi> Кому: "dovecot" <dovecot@dovecot.org> Отправленные: Пятница, 13 Январь 2017 г 14:18:55 Тема: Re: Plugin "mail_crypt" does not work
On 13.01.2017 12:21, Evgeniy Korneechev wrote:
mail_crypt_global_public_key = </etc/dovecot/eckey/ecpubkey.pem
Is this world-wide readable file? Is LDA able to access this?
Aki
-- WBR, BaseALT/ALTLinux Team
-- WBR, BaseALT/ALTLinux Team
-- WBR, BaseALT/ALTLinux Team
Hi, Aki!
- the problem with mail_crypt_global_public_key, there is a bug that we are fixing where file inputs under plugin { } section do not get aboard.
workaround 1: You can base64 encode the PEM key (yes, again), and put it in one line such as
plugin { mail_crypt_global_public_key = LS0tLS1C.....
Its work!!! Thank you!
- The mail_attribute_dict thing requires that setting you discovered, but be advised that in this mode it will create a keypair for each user, and keypair per folder.
Its work, too! (with "$mail_attribute_dict" -> dovecot.conf)
PS
there is a bug that we are fixing Already there is a patch? Or waiting for new release?
-- WBR, BaseALT/ALTLinux Team
participants (2)
-
Aki Tuomi
-
Evgeniy Korneechev