dovecot - Mar 2018 - Dovecot (doveadm, ssl, sync) - SSL error

Hello!

 

dsync SSL still doesn't work for replication, so I've disabled it and
tried
to sync without.

But I have a problem with temp directory.

 

Is it possible to change path to temp folder?

I don't want to set permissions but change temporary folder for replication.

Thanks in advance.

 

 

dovecot: doveadm: Error: safe_mkstemp(/tmp/dovecot.doveadm.) failed:
Permission denied

 

 

Arkadiusz Majewski

 

From: Arkadiusz Majewski <majewsa at gmail.com> 
Sent: Sunday, December 3, 2017 7:38 PM
To: 'dovecot at dovecot.org' <dovecot at dovecot.org>
Subject: Dovecot (doveadm, ssl, sync) - SSL error

 

Hello!

I've got a problem to run syncing between both dovecot services on the
separate servers.
The error indicates to the problem with SSL.

Directly using openssl command to connect from one server to other and vice
versa is passed without any errors.

 

OS: FreeBSD 11.1-RELEASE-p4

Dovecot: 2.2.33.2_2 and the older one dovecot-2.2.32.1_1 (or similar) -
build by ports.

OpenSSL: 1.0.2k-freebsd 26 Jan 2017

 

dovecot: doveadm(10.18.1.15): Error: doveadm client disconnected before
handshake: SSL_accept() failed: error:140760FC:SSL
routines:SSL23_GET_CLIENT_HELLO:unknown protocol

 

dovecot.conf (on both servers):

 

mail_plugins = $mail_plugins notify replication

 

service replicator {

  process_min_avail = 1

}

 

service aggregator {

  fifo_listener replication-notify-fifo {

    user = dovecot

  }

  unix_listener replication-notify {

    user = dovecot

  }

}

 

service replicator {

  unix_listener replicator-doveadm {

    mode = 0600

  }

}

 

replication_max_conns = 10

 

service doveadm {

  inet_listener {

    port = 12130

        ssl = yes

  }

}

 

ssl = required
ssl_protocols = SSLv3 TLSv1 TLSv1.1 TLSv1.2
ssl_cert = </usr/local/etc/dovecot/ssl/cert.crt
ssl_key = </usr/local/etc/dovecot/ssl/cert.key
ssl_client_ca_file = </usr/local/etc/dovecot/ssl/ca.pem
ssl_client_ca_dir = /usr/local/etc/dovecot/ssl

 

 

Thank you in advance for any help.

 

Kind Regards,

Arkadiusz Majewski

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20180303/471c982e/attachment-0001.html>

Zitat von Arkadiusz Majewski <majewsa at gmail.com>:
> Hello!
>
>
>
> dsync SSL still doesn't work for replication, so I've disabled it
and tried
> to sync without.
>
> But I have a problem with temp directory.
>
>
>
> Is it possible to change path to temp folder?
>
> I don't want to set permissions but change temporary folder for
replication.
>
> Thanks in advance.
>
>
>
>
>
> dovecot: doveadm: Error: safe_mkstemp(/tmp/dovecot.doveadm.) failed:
> Permission denied
>
>
>
>
>
> Arkadiusz Majewski
>
>
>
> From: Arkadiusz Majewski <majewsa at gmail.com>
> Sent: Sunday, December 3, 2017 7:38 PM
> To: 'dovecot at dovecot.org' <dovecot at dovecot.org>
> Subject: Dovecot (doveadm, ssl, sync) - SSL error
>
>
>
> Hello!
>
> I've got a problem to run syncing between both dovecot services on the
> separate servers.
> The error indicates to the problem with SSL.
>
> Directly using openssl command to connect from one server to other and vice
> versa is passed without any errors.
>
>
>
> OS: FreeBSD 11.1-RELEASE-p4
>
> Dovecot: 2.2.33.2_2 and the older one dovecot-2.2.32.1_1 (or similar) -
> build by ports.
>
> OpenSSL: 1.0.2k-freebsd 26 Jan 2017
>
>
>
> dovecot: doveadm(10.18.1.15): Error: doveadm client disconnected before
> handshake: SSL_accept() failed: error:140760FC:SSL
> routines:SSL23_GET_CLIENT_HELLO:unknown protocol
I had the same error, some days ago, while testing replication.

For me with dovecot 2.2.36 the solution was, to change the  
mail_replica address from

mail_replica = tcp:HOSTNAME:PORT

to

mail_replica = tcps:HOSTNAME:PORT

Best regards

Philipp
>
>
>
> dovecot.conf (on both servers):
>
>
>
> mail_plugins = $mail_plugins notify replication
>
>
>
> service replicator {
>
>   process_min_avail = 1
>
> }
>
>
>
> service aggregator {
>
>   fifo_listener replication-notify-fifo {
>
>     user = dovecot
>
>   }
>
>   unix_listener replication-notify {
>
>     user = dovecot
>
>   }
>
> }
>
>
>
> service replicator {
>
>   unix_listener replicator-doveadm {
>
>     mode = 0600
>
>   }
>
> }
>
>
>
> replication_max_conns = 10
>
>
>
> service doveadm {
>
>   inet_listener {
>
>     port = 12130
>
>         ssl = yes
>
>   }
>
> }
>
>
>
> ssl = required
> ssl_protocols = SSLv3 TLSv1 TLSv1.1 TLSv1.2
> ssl_cert = </usr/local/etc/dovecot/ssl/cert.crt
> ssl_key = </usr/local/etc/dovecot/ssl/cert.key
> ssl_client_ca_file = </usr/local/etc/dovecot/ssl/ca.pem
> ssl_client_ca_dir = /usr/local/etc/dovecot/ssl
>
>
>
>
>
> Thank you in advance for any help.
>
>
>
> Kind Regards,
>
> Arkadiusz Majewski