<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 24.06.2019 8:21, Aki Tuomi wrote:<br>
</div>
<blockquote type="cite"
cite="mid:5ba1cedc-c6e2-1943-b5cc-3c86d8f6fed4@open-xchange.com">
<pre class="moz-quote-pre" wrap="">
On 22.6.2019 22.00, Reio Remma via dovecot wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Hello!
I finally took the time and spent two days to set up replication for
my server and now I have a question or two.
I initially set noreplicate userdb field to 1 for all but a test user,
but I could still see in the logs that all mailboxes were trying to
connect to the other server via SSH. Is that normal?
Jun 22 16:55:22 host dovecot: dsync-local(<a class="moz-txt-link-abbreviated" href="mailto:user@host.ee">user@host.ee</a>)<>: Error:
Remote command returned error 84: ssh -i /home/vmail/.ssh/vmail.pem -l
vmail backup.host.ee doveadm dsync-server -D -u <a class="moz-txt-link-abbreviated" href="mailto:user@host.ee">user@host.ee</a>
Then I ended up setting mail_replica in userdb for only my test user,
but I could still see in the logs that it was trying to sync the
others as well, despite mail_replica being 0 for the rest.
Jun 22 20:52:59 host dovecot: doveadm(<a class="moz-txt-link-abbreviated" href="mailto:user@host.ee">user@host.ee</a>): Fatal: -N
parameter requires syncing with remote host
I also notice (and read from recent posts) that sieve script
replication doesn't work at all.
Dovecot v2.3.6 and Pigeonhole from the official Dovecot CentOS repo.
Thanks,
Reio
PS: Getting SSH for Dovecot to work with SELinux on CentOS 7 was fun
as usual. :)
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Hi!
We are fixing this is 2.3.7, noreplicate works but causes errors. You
can try
<a class="moz-txt-link-freetext" href="https://github.com/dovecot/core/compare/6d5b4b5%5E..93945ec.patch">https://github.com/dovecot/core/compare/6d5b4b5%5E..93945ec.patch</a> if you
are compiling yourself.
Dovecot under selinux works, as long as you do it the way the policy
writer intended, see <a class="moz-txt-link-freetext" href="https://linux.die.net/man/8/dovecot_selinux">https://linux.die.net/man/8/dovecot_selinux</a>
Aki
</pre>
</blockquote>
<br>
For replication over SSH I had to add the following module:<br>
<br>
<pre>module selinux-dovecot-replication-ssh 1.0;
require {
type ssh_exec_t;
type ssh_home_t;
type dovecot_t;
class file { open read execute execute_no_trans };
class dir { getattr search };
}
#============= dovecot_t ==============
allow dovecot_t ssh_exec_t:file { open read execute execute_no_trans };
allow dovecot_t ssh_home_t:dir { getattr search };
allow dovecot_t ssh_home_t:file { open read };
</pre>
<br>
ssh_exec_t to allow Dovecot to use ssh executable in the first place
and ssh_home_t:dir + ssh_home_t:file for it to be able to read
known_hosts from /root/.ssh<br>
<br>
Reio<br>
</body>
</html>