[Dovecot] Installing Dovecot on Gentoo
Hi,
I have an already working dovecot server on Ubuntu 10.04 with self-created packages version 2.1.13. This setup is working prefect. Now that I do not wish to continue using Ubuntu (to much work for Upgrading), I decided to switch to Gentoo, as I had made best experiences in the past…
I have installed Dovecot on Gentoo and I copied over all my configs and certs and stuff. Also created a user vmail with identical uid/gid and also checked all permissions for the certificate stuff.
Dovecot starts. I also can connect to it. But when trying to login, I get errors:
telnet localhost 143 Trying ::1... Connected to localhost. Escape character is '^]'.
- OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=NTLM] Dovecot ready. . login croessner <hiddenpw> . NO [UNAVAILABLE] Temporary authentication failure. [mx0:2013-01-13 14:24:02]
In the logs it looks like this:
Jan 13 15:22:30 mx0 dovecot: master: Dovecot v2.1.13 starting up (core dumps disabled) Jan 13 15:23:11 mx0 dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth Jan 13 15:23:11 mx0 dovecot: auth: Debug: passwd-file /etc/dovecot/master-users: Read 1 users in 0 secs Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation_s Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_initial_request Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_new_connection 1 1 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_int_open_connection Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_connect_to_host: TCP db.roessner-net.de:389 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_new_socket: 17 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_prepare_socket: 17 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_connect_to_host: Trying 193.239.107.37:389 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_pvt_connect: fd: 17 tm: -1 async: 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_open_defconn: successful Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_server_request Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_result ld 0x35d6dd481c0 msgid 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg ld 0x35d6dd481c0 msgid 1 (infinite timeout) Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg continue ld 0x35d6dd481c0 msgid 1 all 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Connections: Jan 13 15:23:11 mx0 dovecot: auth: Error: * host: db.roessner-net.de port: 389 (default) Jan 13 15:23:11 mx0 dovecot: auth: Error: refcnt: 2 status: Connected Jan 13 15:23:11 mx0 dovecot: auth: Error: last used: Sun Jan 13 15:23:11 2013 Jan 13 15:23:11 mx0 dovecot: auth: Error: Jan 13 15:23:11 mx0 dovecot: auth: Error: Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Outstanding Requests: Jan 13 15:23:11 mx0 dovecot: auth: Error: * msgid 1, origid 1, status InProgress Jan 13 15:23:11 mx0 dovecot: auth: Error: outstanding referrals 0, parent count 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 request count 1 (abandoned 0) Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Response Queue: Jan 13 15:23:11 mx0 dovecot: auth: Error: Empty Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 response count 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList ld 0x35d6dd481c0 msgid 1 all 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList returns ld 0x35d6dd481c0 NULL Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_int_select Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 msgid 1 all 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 msgid 1 message type extended-result Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 0 new referrals Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: mark request completed, ld 0x35d6dd481c0 msgid 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: request done: ld 0x35d6dd481c0 msgid 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: res_errno: 0, res_error: <>, res_matched: <> Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_free_request (origid 1, msgid 1) Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_parse_extended_result Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_parse_result Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_msgfree
Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: could not use key file `/etc/ssl/private/mx0.roessner-net.de.key.pem'. Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: error:0200100D:system library:fopen:Permission denied bss_file.c:398 Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: error:20074002:BIO routines:FILE_CTRL:system lib bss_file.c:400 Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib ssl_rsa.c:648
Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_err2string Jan 13 15:23:11 mx0 dovecot: auth: Error: LDAP: ldap_start_tls_s() failed: Connect error Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation_s Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_initial_request Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_server_request Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_result ld 0x35d6dd481c0 msgid 2 Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg ld 0x35d6dd481c0 msgid 2 (infinite timeout) Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg continue ld 0x35d6dd481c0 msgid 2 all 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Connections: Jan 13 15:23:11 mx0 dovecot: auth: Error: * host: db.roessner-net.de port: 389 (default) Jan 13 15:23:11 mx0 dovecot: auth: Error: refcnt: 2 status: Connected Jan 13 15:23:11 mx0 dovecot: auth: Error: last used: Sun Jan 13 15:23:11 2013 Jan 13 15:23:11 mx0 dovecot: auth: Error: Jan 13 15:23:11 mx0 dovecot: auth: Error: Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Outstanding Requests: Jan 13 15:23:11 mx0 dovecot: auth: Error: * msgid 2, origid 2, status InProgress Jan 13 15:23:11 mx0 dovecot: auth: Error: outstanding referrals 0, parent count 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 request count 1 (abandoned 0) Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Response Queue: Jan 13 15:23:11 mx0 dovecot: auth: Error: Empty Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 response count 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList ld 0x35d6dd481c0 msgid 2 all 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList returns ld 0x35d6dd481c0 NULL Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_int_select Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 msgid 2 all 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_err2string Jan 13 15:23:11 mx0 dovecot: auth: Error: LDAP: ldap_start_tls_s() failed: Can't contact LDAP server Jan 13 15:23:11 mx0 dovecot: auth: Debug: auth client connected (pid=24045) Jan 13 15:24:00 mx0 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=YAanRyzTOAAAAAAAAAAAAAAAAAAAAAAB#011lip=::1#011rip=::1#011lport=143#011rport=59960#011resp=<hidden> Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_extended_operation_s Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_extended_operation Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_send_initial_request Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_send_server_request Jan 13 15:24:00 mx0 dovecot: auth: Error: ldap_err2string Jan 13 15:24:00 mx0 dovecot: auth: Error: LDAP: ldap_start_tls_s() failed: Can't contact LDAP server Jan 13 15:24:02 mx0 dovecot: auth: Debug: client passdb out: FAIL#0111#011user=croessner#011temp Jan 13 15:26:11 mx0 dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 131 secs): user=<croessner>, method=PLAIN, rip=::1, lip=::1, secured, session=<YAanRyzTOAAAAAAAAAAAAAAAAAAAAAAB> Jan 13 15:27:11 mx0 dovecot: auth: Error: ldap_unbind Jan 13 15:27:11 mx0 dovecot: auth: Error: ldap_free_request (origid 2, msgid 2) Jan 13 15:27:11 mx0 dovecot: auth: Error: ldap_free_connection 1 1 Jan 13 15:27:11 mx0 dovecot: auth: Error: ldap_free_connection: actually freed
I checked if Dovecot would even try to access the key:
inotifywait -m -r --format '%:e %f' /etc/ssl Setting up watches. Beware: since -r was given, this may take a while! Watches established. OPEN mail.roessner-net.de.pem ACCESS mail.roessner-net.de.pem CLOSE_NOWRITE:CLOSE mail.roessner-net.de.pem OPEN mail.roessner-net.de.key.pem ACCESS mail.roessner-net.de.key.pem CLOSE_NOWRITE:CLOSE mail.roessner-net.de.key.pem OPEN SSL123_CA_Bundle.pem ACCESS SSL123_CA_Bundle.pem CLOSE_NOWRITE:CLOSE SSL123_CA_Bundle.pem OPEN mail.roessner-net.de.pem ACCESS mail.roessner-net.de.pem ACCESS mail.roessner-net.de.pem ACCESS mail.roessner-net.de.pem ACCESS mail.roessner-net.de.pem ACCESS mail.roessner-net.de.pem CLOSE_NOWRITE:CLOSE mail.roessner-net.de.pem OPEN mail.roessner-net.de.key.pem ACCESS mail.roessner-net.de.key.pem ACCESS mail.roessner-net.de.key.pem CLOSE_NOWRITE:CLOSE mail.roessner-net.de.key.pem OPEN SSL123_CA_Bundle.pem ACCESS SSL123_CA_Bundle.pem ACCESS SSL123_CA_Bundle.pem ACCESS SSL123_CA_Bundle.pem ACCESS SSL123_CA_Bundle.pem CLOSE_NOWRITE:CLOSE SSL123_CA_Bundle.pem OPEN ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt ACCESS ca-certificates.crt CLOSE_NOWRITE:CLOSE ca-certificates.crt OPEN mx0.roessner-net.de.pem ACCESS mx0.roessner-net.de.pem CLOSE_NOWRITE:CLOSE mx0.roessner-net.de.pem OPEN openssl.cnf ACCESS openssl.cnf ACCESS openssl.cnf ACCESS openssl.cnf CLOSE_NOWRITE:CLOSE openssl.cnf OPEN openssl.cnf ACCESS openssl.cnf ACCESS openssl.cnf ACCESS openssl.cnf CLOSE_NOWRITE:CLOSE openssl.cnf
I can not find any line talking about mx0.roessner-net.de.key.pem. The file exists and has proper permissions:
l /etc/ssl/private/ total 16 drwxr-s---+ 2 root ssl-cert 4096 Jan 12 19:29 ./ drwxr-xr-x 8 root root 4096 Jan 13 15:26 ../ -rw-r--r-- 1 root root 0 Dec 10 18:14 .keep_dev-libs_openssl-0 -r--r----- 1 root ssl-cert 1679 Jan 12 17:23 mail.roessner-net.de.key.pem -r--r-----+ 1 root ssl-cert 887 Jan 12 17:14 mx0.roessner-net.de.key.pem
getfacl /etc/ssl/private/ /etc/ssl/private/mx0.roessner-net.de.key.pem getfacl: Removing leading '/' from absolute path names # file: etc/ssl/private/ # owner: root # group: ssl-cert # flags: -s- user::rwx user:amavis:r-x group::--- mask::r-x other::---
# file: etc/ssl/private/mx0.roessner-net.de.key.pem # owner: root # group: ssl-cert user::r-- user:amavis:r-x #effective:r-- group::r-- mask::r-- other::---
Here is my doveconf -n:
# 2.1.13: /etc/dovecot/dovecot.conf # OS: Linux 3.7.0-hardened x86_64 Gentoo Base System release 2.1 auth_debug = yes auth_master_user_separator = * auth_mechanisms = plain login cram-md5 digest-md5 ntlm auth_verbose = yes hostname = mail.roessner-net.de lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_access_groups = vmail mail_attachment_dir = /var/mail/virtual/copymail/attachments mail_debug = yes mail_gid = vmail mail_location = mdbox:~/mdbox mail_plugins = autocreate quota acl fts fts_solr zlib mail_privileged_group = mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mdbox_rotate_size = 128 M namespace { list = children location = mdbox:%%h/mdbox prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk-E-Mail { special_use = \Junk } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox junkmail { special_use = \Junk } prefix = separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/mail/virtual/shared-mailboxes.db autocreate = Trash autocreate2 = Sent autocreate3 = Drafts autocreate4 = junkmail autosubscribe = Trash autosubscribe2 = Sent autosubscribe3 = Drafts autosubscribe4 = junkmail fts = solr fts_solr = break-imap-search url=http://localhost:8080/solr/ quota = dict:User quota::file:%h/mdbox/dovecot-quota quota_rule = *:storage=300M:messages=20000 quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp sieve service auth-worker { extra_groups = ssl-cert unix_listener auth-worker { mode = 0600 user = vmail } user = vmail } service auth { extra_groups = ssl-cert unix_listener auth-userdb { mode = 0600 user = vmail } user = vmail } service dict { unix_listener dict { mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/lmtp-dovecot { group = postfix mode = 0666 user = postfix } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } ssl_ca =
LDAP looks like this:
uris = ldap://db.roessner-net.de/ ldap://roessner1.roessner-net.de/ sasl_bind = yes sasl_mech = EXTERNAL tls = yes tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt tls_cert_file = /etc/ssl/certs/mx0.roessner-net.de.pem tls_key_file = /etc/ssl/private/mx0.roessner-net.de.key.pem tls_require_cert = hard debug_level = 7 base = ou=people,ou=it,dc=roessner-net,dc=de user_attrs = rnsMSQuota=quota_rule=*:storage=%$,rnsMSMailboxHome=home user_filter = (&(objectClass=rnsMSDovecotAccount)(|(rnsMSRecipientAddress=%u)(uniqueIdentifier=%u))) pass_attrs = rnsMSDeliverToAddress=user,userPassword=password pass_filter = (&(objectClass=rnsMSDovecotAccount)(|(rnsMSRecipientAddress=%u)(uniqueIdentifier=%u))(rnsMSEnableDovecot=TRUE)) iterate_attrs = rnsMSDovecotUser=user iterate_filter = (objectClass=rnsMSDovecotAccount) default_pass_scheme = PLAIN
Some portage information
[ebuild R ] net-nds/openldap-2.4.30 USE="berkdb crypt ipv6 minimal sasl ssl syslog tcpd -cxx -debug -experimental -gnutls -icu -iodbc -kerberos -odbc -overlays -perl -samba (-selinux) -slp -smbkrb5passwd" 0 kB [ebuild R ] dev-libs/cyrus-sasl-2.1.25-r3:2 USE="berkdb gdbm ldapdb openldap pam ssl urandom -authdaemond -java -kerberos -mysql -postgres -sample -sqlite -srp -static-libs" 0 kB [ebuild R ~] net-mail/dovecot-2.1.13::croessner USE="bzip2 caps imapc ipv6 ldap maildir managesieve mbox mdbox pam pop3c sdbox sieve solr sqlite ssl suid zlib -cydir -doc -kerberos -lucene -mysql -postgres (-selinux) -static-libs -vpopmail" 0 kB
As you can see, I have spent some time on this without luck and currently I have no idea, what the problem is.
Any ideas on that?
Thanks in advance
-Christian Rößner
-- [*] sys4 AG
http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Joerg Heidrich
In the logs it looks like this:
Jan 13 15:22:30 mx0 dovecot: master: Dovecot v2.1.13 starting up (core dumps disabled) Jan 13 15:23:11 mx0 dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth Jan 13 15:23:11 mx0 dovecot: auth: Debug: passwd-file /etc/dovecot/master-users: Read 1 users in 0 secs Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation_s Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_extended_operation Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_initial_request Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_new_connection 1 1 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_int_open_connection Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_connect_to_host: TCP db.roessner-net.de:389 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_new_socket: 17 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_prepare_socket: 17 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_connect_to_host: Trying 193.239.107.37:389 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_pvt_connect: fd: 17 tm: -1 async: 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_open_defconn: successful Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_send_server_request Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_result ld 0x35d6dd481c0 msgid 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg ld 0x35d6dd481c0 msgid 1 (infinite timeout) Jan 13 15:23:11 mx0 dovecot: auth: Error: wait4msg continue ld 0x35d6dd481c0 msgid 1 all 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Connections: Jan 13 15:23:11 mx0 dovecot: auth: Error: * host: db.roessner-net.de port: 389 (default) Jan 13 15:23:11 mx0 dovecot: auth: Error: refcnt: 2 status: Connected Jan 13 15:23:11 mx0 dovecot: auth: Error: last used: Sun Jan 13 15:23:11 2013 Jan 13 15:23:11 mx0 dovecot: auth: Error: Jan 13 15:23:11 mx0 dovecot: auth: Error: Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Outstanding Requests: Jan 13 15:23:11 mx0 dovecot: auth: Error: * msgid 1, origid 1, status InProgress Jan 13 15:23:11 mx0 dovecot: auth: Error: outstanding referrals 0, parent count 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 request count 1 (abandoned 0) Jan 13 15:23:11 mx0 dovecot: auth: Error: ** ld 0x35d6dd481c0 Response Queue: Jan 13 15:23:11 mx0 dovecot: auth: Error: Empty Jan 13 15:23:11 mx0 dovecot: auth: Error: ld 0x35d6dd481c0 response count 0 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList ld 0x35d6dd481c0 msgid 1 all 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_chkResponseList returns ld 0x35d6dd481c0 NULL Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_int_select Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 msgid 1 all 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 msgid 1 message type extended-result Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: ld 0x35d6dd481c0 0 new referrals Jan 13 15:23:11 mx0 dovecot: auth: Error: read1msg: mark request completed, ld 0x35d6dd481c0 msgid 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: request done: ld 0x35d6dd481c0 msgid 1 Jan 13 15:23:11 mx0 dovecot: auth: Error: res_errno: 0, res_error: <>, res_matched: <> Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_free_request (origid 1, msgid 1) Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_parse_extended_result Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_parse_result Jan 13 15:23:11 mx0 dovecot: auth: Error: ldap_msgfree
Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: could not use key file `/etc/ssl/private/mx0.roessner-net.de.key.pem'. Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: error:0200100D:system library:fopen:Permission denied bss_file.c:398 Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: error:20074002:BIO routines:FILE_CTRL:system lib bss_file.c:400 Jan 13 15:23:11 mx0 dovecot: auth: Error: TLS: error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib ssl_rsa.c:648
strace shows also the permission problem:
6536 1020 munmap(0x769b665ae000, 4096) = 0
6537 1020 open("/etc/ssl/private/mx0.roessner-net.de.key.pem", O_RDONLY) = -1 EACCES (Permission denied)
6538 1020 write(2, "TLS: could not use key file `/et"..., 76) = 76
6539 991 <... epoll_wait resumed> {{EPOLLIN, {u32=2782493808, u64=17315795663984}}}, 27, -1) = 1
6540 1020 write(2, "TLS: error:0200100D:system libra"..., 74
Is there any some Linux command, where I could find out which user tries to open the cert file?
-Christian Rößner
-- [*] sys4 AG
http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Joerg Heidrich
Am 13.01.2013 um 18:13 schrieb Christian Rößner cr@sys4.de:
6537 1020 open("/etc/ssl/private/mx0.roessner-net.de.key.pem", O_RDONLY) = -1 EACCES (Permission denied)
I had messed up ACLs for this file. After creating private and key again with correct setfacl command, everything works as expected. Sorry for the noice, but this was really hard to find out.
Wrong:
getfacl private/ # file: private # owner: root # group: ssl-cert # flags: -s- user::rwx user:amavis:r-x group::--- mask::r-x other::---
Right:
getfacl private/ # file: private/ # owner: root # group: ssl-cert user::rwx user:amavis:r-x group::r-x mask::r-x other::---
So as you can see the group settings got lost…
Thanks
-Christian Rößner
-- [*] sys4 AG
http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Joerg Heidrich
On Sun, 13 Jan 2013 18:34:27 +0100 Christian Rößner cr@sys4.de wrote:
Am 13.01.2013 um 18:13 schrieb Christian Rößner cr@sys4.de:
6537 1020 open("/etc/ssl/private/mx0.roessner-net.de.key.pem", O_RDONLY) = -1 EACCES (Permission denied)
I had messed up ACLs for this file. After creating private and key again with correct setfacl command, everything works as expected. Sorry for the noice, but this was really hard to find out.
Wrong:
getfacl private/ # file: private # owner: root # group: ssl-cert # flags: -s- user::rwx user:amavis:r-x group::--- mask::r-x other::---
Right:
getfacl private/ # file: private/ # owner: root # group: ssl-cert user::rwx user:amavis:r-x group::r-x mask::r-x other::---
So as you can see the group settings got lost…
Thanks
Slightly off-topic from my side, but wanted to mention it since I've worked with POSIX ACLs a bit.
Personally, I've had very bad experiences with POSIX ACLs. They can act in quite an unintuitive way when you start combining them with different umask's, originating directory/file permissions (in case of copying), sticky bits, and chmod's on files/directories where you've already set-up the permissions (not to mention that some stuff seems to outright ignore it, like mod_php5/php).
Unfortunately, due to a couple of very bad design decisions, the POSIX ACL (at least for me) turned out to be quite unusable in most cases (like sharing files via Samba, even though Samba itself had enough problems of its own). I've also attempted using it at some point for some LAMP apps I've deployed, and ended-up abandoning them in favour of group sticky bits on directories (wanted to administer the web app with regular account, while still letting the Apache access files using umask 0007).
So, personally, I'd avoid using them.
Best regards
P.S. Sorry for off-topic or if you were already aware of this, but wanted to post it just in case :)
-- Branko Majic Jabber: branko@majic.rs Please use only Free formats when sending attachments to me.
Бранко Мајић Џабер: branko@majic.rs Молим вас да додатке шаљете искључиво у слободним форматима.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 01/13/2013 02:41 PM, Branko Majic wrote:
Slightly off-topic from my side, but wanted to mention it since I've worked with POSIX ACLs a bit.
Personally, I've had very bad experiences with POSIX ACLs. They can act in quite an unintuitive way when you start combining them with different umask's, originating directory/file permissions (in case of copying), sticky bits, and chmod's on files/directories where you've already set-up the permissions (not to mention that some stuff seems to outright ignore it, like mod_php5/php).
Most of the problem is that the utilities don't support it, and the tooling isn't there to make it easy to fix things when they get messed up.
GNU tar, cp, and mkdir for example claim to support ACLs, but then do it only half way: if you copy a non-ACL file into a directory with a default ACL, cp will preserve the group bits -- which are now the ACL mask -- making your ACLs useless.
I've had very little success getting things fixed; most people just aren't interested.
I have a standalone utility called apply-default-acl (now in Gentoo)
that can reapply the default ACL on a file or tree, fixing most of
these issues after the fact. I've patched tar, cp, and mkdir to
reapply the default ACL after they're done screwing things up, but for
other utilities, you just have to call apply-default-acl -r on the
result.
I wrote some stuff about this problem at [1].
The other half of the problem is that there's no "just do what I want" command to set ACLs on a hierarchy. For this I've created scripts called set-ro-perms, set-rw-perms, etc. It's just find, xargs, and setfacl -- but it makes a world of difference. There is a recursive mode for apply-default-acl now which can mimic most of them; you just need to set a default ACL on '.' and run it.
I've also attempted using it at some point for some LAMP apps I've deployed, and ended-up abandoning them in favour of group sticky bits on directories (wanted to administer the web app with regular account, while still letting the Apache access files using umask 0007).
So, personally, I'd avoid using them.
Same use case here, except we have multiple groups and users who need differing levels of access, and each website runs as a different system user. I don't know of any other way to do it.
Eventually, NFSv4 ACLs[2] are supposed to supercede the POSIX ones. Hopefully, unlike POSIX, the NFS ACLs will get standardized and actually gain some traction and decent support. At that point it should be fairly simple to migrate, since there's an "easy" mapping from POSIX to NFSv4.
[1] http://michael.orlitzky.com/articles/problems_with_posix_acls_and_common_uti...
[2] http://wiki.linux-nfs.org/wiki/index.php/ACLs -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux)
iQIcBAEBAgAGBQJQ8zJ5AAoJEBxJck0inpOir+MP/1p///gBNmXO3qQVOZabAXDc iYUMgiZ48WSpg7SKHUus80nKrue1IQdHC69ORTo7QUFw8o2/8CYXQo6v1EaytyDJ f702Qx7nMnwvdjH5PZQbxVi3qd+L3I+vwmH4omx2g4cFzM4KWNNXcG+tgWALquAc 0xMn8IpODfqV4SqNx1vjHKH35MBuPtyN+0YxGTixlryxQjSjSaSITxFEfRdXvzLT xL2WQw++XT5yC1UOyET4F/HQ0BG1C5jIB1auxrkLYQo3a4u+fXFjNQ3r67rL6Jus t9Z3drj48LSHeyc3tRV0MsIiVhgXGTmGyG+XR7DREt9MbMv2SjHbOtP6YsQ7tVpN 54JndK7Rbcm6yaSExBxCC7eCqgXb5AR10J8AijPwnNj2I6CstHMlG4lLqWvj8Bdm YQBdid3zbnb8r8sbpwe67UUArwMZWzVReZpETYbW4BrBy7CTPaooizP0fOE/mNwn 78vc5L+1I3edQEOtD3DQhUOFKxPFjJh1x4EdDNzd0K5+a1ZgfBxYw/U6q8ItBJ12 leoNzWMvZklJb/U4gGx2fYSwlZM1wxDGfRp0P63YYvNSaEXloGcRuozVInIzpm3g QOA5I/1ux7WiisQoln74gJGkPPnbZuAOs45xEl0RUjrWJGzgSWpc8I8h5j755COV w80fwFF4c5SIYXf/luor =/6b8 -----END PGP SIGNATURE-----
Christian Rößner skrev den 2013-01-13 15:46:
l /etc/ssl/private/ total 16 drwxr-s---+ 2 root ssl-cert 4096 Jan 12 19:29 ./ drwxr-xr-x 8 root root 4096 Jan 13 15:26 ../ -rw-r--r-- 1 root root 0 Dec 10 18:14 .keep_dev-libs_openssl-0 -r--r----- 1 root ssl-cert 1679 Jan 12 17:23 mail.roessner-net.de.key.pem -r--r-----+ 1 root ssl-cert 887 Jan 12 17:14 mx0.roessner-net.de.key.pem
ssl-cert is not really private secure is it ?
in my gentoo server both owner and group is root, reason for this is that dovecot ssl start up as root and drops privlegde later so it does not really runs as root anyway
other then that i dont know mere to try
participants (4)
-
Benny Pedersen
-
Branko Majic
-
Christian Rößner
-
Michael Orlitzky