Package: dovecot-sieve Version: 1:2.4.5+dfsg1-4 Severity: important There is still a serious bug in dovecot 2.4.4 with the ssl_key_file. If e.g. sievec is invoked.
→ doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 76: key_file: open(/etc/ssl/private/XXXXXX.key.pem) failed: Permission denied The same occurs in for every mail deliverd to any user account using mailsieve and a lot of error mails are produced degrading the mail-service for the users. The problem is upstream discussed in https://dovecot.org/mailman3/archives/list/[email protected]/thread/KT7LWWQWEMLKKLKXICBGPG7OGOQIJWEV/ There is also a weird configuration hack mentioned to mitigate the dovecot bug. The bug is that the key_file isn't read before the privileges are dropped e.g. for the sieve processing. This bug was solved in dovecot 2.4.5. I mitigated the problem here with a no-change forky backport for the moment. Please upgrade the trixie version from 2.4.4 to 2.4.5 to solve the problem for other users. -- Package-specific info: dovecot configuration --------------------- # 2.4.5 (0cbb641e3e): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.5 (742bb892) # OS: Linux 7.2.6+deb13-amd64 x86_64 Debian 13.7 # Hostname: nermal.server.computer42.org # 37 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_cache_negative_ttl = 6 hour auth_cache_size = 10M auth_debug = yes auth_username_format = %{user|username|lower} default_vsz_limit = 512M dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes imap_capability { SPECIAL-USE = yes } imap_client_workarounds { tb-extra-mailbox-sep = yes } imap_hibernate_timeout = 30s imap_literal_minus = yes lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To ldap_auth_dn = cn=admin,dc=computer42,dc=org ldap_auth_dn_password = # hidden, use -P to show it ldap_base = ou=People,dc=computer42,dc=org ldap_uris = ldapi:/// mail_access_groups = mailuser mail_control_path = ~/mail/control mail_driver = mbox mail_home = /srv/mail-c42/%{user | username} mail_index_path = ~/mail/index mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size from subject vsize flags mail_log_prefix = %{service}(%{user}): mail_path = ~/mail/mailboxes mail_plugins { notify = yes mail_log = yes } mail_privileged_group = mail mailbox_directory_name = mailboxData protocols { imap = yes lmtp = yes sieve = yes } sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes editheader = yes } verbose_proctitle = yes passdb ldap { driver = ldap fields { password = %{ldap:userPassword} user = %{ldap:uid} userdb_gid = %{ldap:gidNumber} userdb_home = /srv/mail-c42/%{ldap:uid} userdb_uid = %{ldap:uidNumber} } filter = (&(objectClass=posixAccount)(uid=%{user})) } userdb prefetch { driver = prefetch } userdb ldap { driver = ldap fields { gid = mailuser uid = %{ldap:uidNumber} user = %{ldap:uid} gid = %{ldap:gidNumber} home = /srv/mail-c42/%{ldap:uid} uid = %{ldap:uidNumber} } filter = (&(objectClass=posixAccount)(uid=%{user})) iterate_fields { user = %{ldap:uid} } iterate_filter = (objectClass=posixAccount) } passdb passwd-file { auth_username_format = %{user|username} default_password_scheme = SHA512-CRYPT driver = passwd-file passwd_file_path = /etc/dovecot/auth.d/%{user|domain}.passwd } userdb passwd-file { auth_username_format = %{user|username} passwd_file_path = /etc/dovecot/auth.d/%{user|domain}.passwd driver = passwd-file fields { gid = vmail home = /srv/vmail/%{user|domain}/%{user|username} uid = vmail } } namespace inbox { inbox = yes mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { auto = subscribe autoexpunge = 30d special_use = "\\Junk" } mailbox Trash { auto = subscribe autoexpunge = 30d special_use = "\\Trash" } mailbox Archive { auto = subscribe special_use = "\\Archive" } mailbox Templates { auto = subscribe } mailbox Sent { auto = subscribe special_use = "\\Sent" } } service imap-login { process_min_avail = 4 restart_request_count = 100 vsz_limit = 512M inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { client_limit = 1 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } inet_listener lmtp { port = 42024 listen = nermal.server.computer42.org nermal.dmz.computer42.org } } service imap { extra_groups = $SET:default_internal_group process_limit = 512 vsz_limit = 2G unix_listener imap-master { user = $SET:default_internal_user } } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } inet_listener auth { port = 42659 } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { ca_file = /etc/ssl/certs/c42-srv-ca.crt cert_file = /etc/ssl/c42/c42-client.cert.pem dh_file = /etc/dovecot/dh.pem key_file = # hidden, use -P to show it } protocol lda { mail_plugins { sieve = yes } } service imap-hibernate { unix_listener imap-hibernate { group = $SET:default_internal_group mode = 0660 } } protocol imap { mail_max_userip_connections = 35 } protocol lmtp { mail_plugins { sieve = yes } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } sieve_script personal { driver = file path = ~/sieve } sieve_script default { driver = file path = /etc/c42CfgRepos/roles/mail_schiller/data/dovecot/default.sieve type = default } sieve_script global { driver = file path = /etc/c42CfgRepos/roles/mail_schiller/data/dovecot/sieve_global_dir type = global } sieve_editheader_header X-Verified { forbid_add = yes forbid_delete = yes } sieve_editheader_header X-Seen { forbid_delete = yes } -- System Information: Debian Release: 13.7 APT prefers stable-updates APT policy: (600, 'stable-updates'), (600, 'stable-security'), (600, 'stable'), (500, 'oldstable-updates'), (500, 'oldstable-security'), (200, 'testing'), (99, 'oldstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 7.2.6+deb13-amd64 (SMP w/4 CPU threads; PREEMPT) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE:de:en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) Versions of packages dovecot-sieve depends on: ii dovecot-core 1:2.4.5+dfsg1-4 ii libc6 2.41-12+deb13u4 ii libldap2 2.6.10+dfsg-1 ii ucf 3.0052 dovecot-sieve recommends no packages. dovecot-sieve suggests no packages. Versions of packages dovecot-sieve is related to: pn dovecot-auth-lua <none> ii dovecot-core [dovecot-common] 1:2.4.5+dfsg1-4 ii dovecot-dev 1:2.4.5+dfsg1-4-c42-bpo-1 pn dovecot-flatcurve <none> pn dovecot-gssapi <none> ii dovecot-imapd 1:2.4.5+dfsg1-4 ii dovecot-ldap 1:2.4.5+dfsg1-4 ii dovecot-lmtpd 1:2.4.5+dfsg1-4 ii dovecot-managesieved 1:2.4.5+dfsg1-4 pn dovecot-mysql <none> pn dovecot-pgsql <none> pn dovecot-pop3d <none> ii dovecot-sieve 1:2.4.5+dfsg1-4 pn dovecot-solr <none> pn dovecot-sqlite <none> pn dovecot-submissiond <none> -- no debconf information
