[Dovecot] File Permissions and delivery
Simon Brereton
simon.brereton at buongiorno.com
Fri Aug 26 20:10:59 EEST 2011
Hi
I'm very new to Dovecot (been using Courier for 5 years), but I've been persuaded of the merits of Dovecot and since the server needs upgrading that seems like the perfect time/excuse.
On a test server, I set up postfix and installed Dovecot (running 32-bit Debian Squeeze, installed from apt-get). I mirrored the mail store (Maildirs, for historical reasons located under /var/spool/mail/virtual/domain.com/user). Then I ran the courier migration perl script and everything was fine and dandy.
However, when I can to do the production migration, things weren't as smooth. The new server is 64-bit (not that I think it makes a difference, but if you're going to help me you should have all the information :)
Again, I installed Postfix and Dovecot
Took down the old server
Mirrored the Maildirs
Ran the migration script
Restarted everything
At this point everything looked like it was ok. Mail was being received and delivered to the Maildirs and the IMAP login was fine. However, I noticed errors in the logs when retreiving mail with the MUA along the lines of:
Aug 26 16:59:48 mail dovecot: IMAP(simon at lydiard.net): open(/var/spool/mail/virtual/domain.net/simon/cur/1314328966.V801I166601bM756462.mail.net,S=2461:2,) failed: Permission denied (euid=999(mailsystem) egid=115(mailsystem) missing +r perm: /var/spool/mail/virtual/domain.net/simon/cur/1314328966.V801I166601bM756462.mail.net,S=2461:2,)
After messing around with the chown and chmod (even though these were exactly the same as the test server) I finally discovered the issue.
mail:~# ls /var/spool/mail/virtual/domain.net/simon/new/
-rwxrwx--- 1 postfix mailsystem 2.5K Aug 26 03:33 1314326000.V801I1666018M803015.mail.net,S=2461:2,
-rwxrwx--- 1 postfix mailsystem 2.5K Aug 26 03:36 1314326209.V801I1666019M447273.mail.net,S=2460:2,
-rw-rw---- 1 postfix mailsystem 2.5K Aug 26 04:00 1314327630.V801I166601aM308173.mail.net,S=2477:2,
-rw------- 1 postfix mailsystem 2.5K Aug 26 04:22 1314328966.V801I166601bM756462.mail.net,S=2461:2,
-rw------- 1 postfix mailsystem 1.1K Aug 26 16:28 1314372534.V801I166601cM615258.mail.net,S=1097:2,
-rw------- 1 postfix mailsystem 1.1K Aug 26 16:31 1314372685.V801I166601dM264242.mail.net,S=1097:2,
Mails are being delivered with 0600 permissions and not 0660 (the mails from courier seem to have all been 0770 as you can see). If I manually change the permission (to 0660) then I can see the mail in the MUA.
After thinking for a while it occurred to me that this is covered in the LDA section. But making changes to the config file (either permissions or UID/GID) doesn't seem to make a difference. (Yes, I did restart postfix and dovecot after the changes).
Anyway, here is my dovecot -n:
mail:~# dovecot -n
# 1.2.15: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 ext3
log_timestamp: %Y-%m-%d %H:%M:%S
protocols: imap imaps pop3 pop3s
ssl_ca_file: /etc/ssl/keys/ca.crt
ssl_cert_file: /etc/ssl/keys/mail.net.crt
ssl_key_file: /etc/ssl/private/mail.net.key
disable_plaintext_auth: no
login_dir: /var/run/dovecot/login
login_executable(default): /usr/lib/dovecot/imap-login
login_executable(imap): /usr/lib/dovecot/imap-login
login_executable(pop3): /usr/lib/dovecot/pop3-login
mail_privileged_group: mailsystem
mail_location: maildir:/var/spool/mail/virtual/%d/%n
maildir_very_dirty_syncs: yes
mbox_write_locks: fcntl dotlock
mail_executable(default): /usr/lib/dovecot/imap
mail_executable(imap): /usr/lib/dovecot/imap
mail_executable(pop3): /usr/lib/dovecot/pop3
mail_plugins(default): quota imap_quota
mail_plugins(imap): quota imap_quota
mail_plugins(pop3): quota
mail_plugin_dir(default): /usr/lib/dovecot/modules/imap
mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap
mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3
imap_client_workarounds(default): outlook-idle delay-newmail
imap_client_workarounds(imap): outlook-idle delay-newmail
imap_client_workarounds(pop3):
pop3_client_workarounds(default):
pop3_client_workarounds(imap):
pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh
lda:
postmaster_address: postmaster at net
mail_plugins: quota
log_path:
info_log_path:
deliver_log_format: msgid=%m: %f: %$
auth default:
mechanisms: plain login
user: mailsystem
verbose: yes
passdb:
driver: sql
args: /etc/dovecot/dovecot-sql.conf
userdb:
driver: prefetch
userdb:
driver: static
args: uid=999 gid=115 home=/var/spool/mail/virtual/%d/%n allow_all_users=yes
socket:
type: listen
client:
path: /var/spool/postfix/private/auth
mode: 432
user: postfix
group: mailsystem
master:
path: /var/run/dovecot/auth-master
mode: 432
user: mailsystem
group: mailsystem
plugin:
quota: maildir
As you can see, I tried to go 0660 in both client and master.
The portion of my master.cf
81 # SPB - Attempt to deliver with Dovecot LDA
82 dovecot unix - n n - - pipe
83 flags=DRhu user=mailsystem argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop}
Is there anything else I should include?
I'm pretty sure it's an error on my part. I'm just not clued up enough to know where.
My second problem is that I thought I had things back to where they were before I messed with chown and chmod, but now I get this in the logs
dovecot: dovecot: Fatal: chdir(/var/spool/mail/virtual/domain.net/simon//) failed: Permission denied (euid=999(mailsystem) egid=115(mailsystem) missing +x perm: /var/spool/mail/virtual)
But the ls on that is exactly the same as on the test server:
ls /var/spool/mail/virtual/
total 44K
drwxrwS--- 11 postfix mailsystem 4.0K Aug 25 23:07 ./
drwxrwsr-x 5 amavis mailsystem 4.0K Oct 19 2009 ../
drwxrws--- 5 mailsystem mailsystem 4.0K Aug 26 02:33 domain.net/
So, now I'm stumped. I hope someone can spot the simple thing I've missed!
Thanks.
Simon
More information about the dovecot
mailing list