December 2023 - dovecot

Username used by dovecot to access database certificate and key files
by John Fawcett 08 Dec '23

08 Dec '23

Hi does anyone happen to know the username under which dovecot accesses the certificate and key files when connecting to a mariadb database with ssl? I can't seem to get dovecot to read the files without a "other" readable bit set. I have dovecot users in mysql with the following connect string in dovecot-sql.conf.ext connect = host=x.x.x host=y.y.y host=z.z.z dbname=maildb user=mailuser password=xxxxxx \ ssl_ca=/etc/ssl/mysql/ca-cert.pem \ ssl_cert=/etc/ssl/mysql/client-cert.pem \ ssl_key=/etc/ssl/mysql/client-key.pem \ ssl_verify_server_cert=yes The certificate and key files in /etc/ssl/mysql/ are owned by root with group users: ls -l /etc/ssl/mysql total 12 -r--r--r--. 1 root root 2041 Jun 22 15:32 ca-cert.pem -r--r--r--. 1 root users 1907 Jun 22 15:32 client-cert.pem -r--r--r--. 1 root users 3272 Jun 22 15:32 client-key.pem For my test dovecot, dovenull and vmail are all members of group users: grep users /etc/group users:x:100:postfix,dovecot,dovenull,vmail If I remove the "other" readable attribute on the certificate and key files, dovecot complains it can't connect to the db server: auth: Error: mysql(x.x.x): Connect failed to database (maildb): TLS/SSL error: Permission denied (13) - waiting for 1 seconds before retry I realize it only adds marginal security to not have these files world readable, but still it is puzzling why dovecot cannot read them in that case. Can anyone see what I am missing? Thanks John

3 5

Unlocking Entertainment Excellence: Explore jGuru's Latest Netflix Series Guide
by Angelique Medina 08 Dec '23

08 Dec '23

Discover a digital haven at jgurucom, where entertainment expertise meets insightful curation. JGuru, a premier online destination, stands as a beacon for enthusiasts seeking the latest trends and in-depth knowledge. As a dynamic platform, jGuru transcends conventional boundaries, offering a plethora of resources for tech aficionados, gamers, and pop culture enthusiasts alike. Navigate through jGuru's diverse content to unearth gems like their comprehensive guide to the most anticipated Netflix series of 2022. Delve into the intricacies of storytelling, cinematography, and exclusive insights that make each series a must-watch. JGuru's commitment to excellence shines through in its meticulous coverage, establishing it as a go-to hub for all things entertainment. For an unparalleled experience, visit http://www.jguru.com/the-most-anticipated-netflix-series-2022/ – where entertainment aficionados converge to elevate their viewing journey. JGuru: Your Gateway to Entertainment Brilliance.

1 0

Compiler error
by Goetz Schultz 06 Dec '23

06 Dec '23

Hi, I have upgraded my system to FreeBSD14 and tried to recompile dovecot. The following error is thrown now (It did compile on FBSD13): <quote> test-mail-index-transaction-update.c:650:36: error: incompatible pointer to integer conversion passing 'char *(*)(int, int)' to parameter of type 'time_t' (aka 'long') [-Wint-conversion] mail_index_update_day_headers(t, tests[i].now + timezone); ^~~~~~~~~~~~~~~~~~~~~~~ </quote> (t, tests[i].now + timezone); ^~~~~~~~~~~~~~~~~~~~~~~ Is there a patch or something like that to compensate? -- Thanks and regards Goetz R Schultz ---------------->8---------------- Quis custodiet ipsos custodes? /"\ \ / ASCII Ribbon Campaign X against HTML e-mail / \ ----------------8<---------------- ---------------------------->8------------------------------ /"\ \ / ASCII Ribbon Campaign X against HTML e-mail / \ This message is transmitted on 100% recycled electrons. ---------------------------->8------------------------------ Unsigned message - no responsibillity that content is not altered

4 9

replicator: Panic: data stack: Out of memory when allocating 268435496 bytes
by Gerben Wierda 06 Dec '23

06 Dec '23

One step further in my quest to create a replacement mail server. I now have my old mail server (2.3.19.1, macOS + MacPorts) and my new (2.3.20, Alpine Linux, Docker, apk package). When I turn on replication it works, but, after a while I see: Jan 06 00:50:31 replicator: Panic: data stack: Out of memory when allocating 268435496 bytes Jan 06 00:50:32 replicator: Fatal: master: service(replicator): child 133 killed with signal 6 (core dumped) Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Sync failure: Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Remote sent invalid input: - I've removed synchronous operation for now (found a message on the net suggesting that) but is this known and what does it mean? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

6 15

Enhance Your Website Content: Logicsofts' Expert Tips
by Angelique Medina 04 Dec '23

04 Dec '23

Logicsofts, a leading web development company, is dedicated to empowering businesses through cutting-edge solutions. With a proven track record of creating visually appealing and functionally robust websites, Logicsofts stands out in the digital landscape. Their commitment to excellence extends to providing valuable insights through their blog. In a recent post https://www.logicsofts.co.uk/blog/how-to-write-website-content-rules-to-fol… , Logicsofts unravels the art of crafting compelling website content. The blog delves into essential rules for creating impactful content that resonates with your audience. Logicsofts emphasizes the significance of engaging and user-centric content to boost online presence and drive conversions. For businesses seeking to elevate their online game, Logicsofts' blog is a goldmine of practical advice. Implement the strategies outlined in the post to transform your website content and leave a lasting impression on your visitors. Explore the full article for a deep dive into the nuances of content creation - an invaluable resource for businesses striving to stay ahead in the digital realm.

1 0

auth_mechanisms per listener or local_name?
by Kees van Vloten 01 Dec '23

01 Dec '23

Hi all, I would like to use kerberos authentication on the local network but not for connections from internet, which are forwarded by haproxy. So both types of login can be distinguished by a different inet_listener and also a different by local_name. Is there a way to set auth_mechanisms such the it will impossible to use kerberos via haproxy connections or by filtering on local_name? - Kees.

1 0