Getting message "SASL Could not open /etc/sasl2/sasldb2" when trying to create a mailbox
[email protected] Sun, 27 Nov 2022 02:29:13 -0500
| Newsgroups | gmane.comp.security.cyrus.sasl |
|---|---|
| Message-ID | <[email protected]> |
--16695341531.df6697fe.87985
Date: Sun, 27 Nov 2022 02:29:13 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
We have a server which, among other things, runs an email service for our c=
ompany. This server runs RHEL 7.9, Cyrus and Sendmail.
Now we are replacing the hardware of this server and I am configuring the n=
ew server with RHEL 9 and the correspondingly new versions of cyrus-imapd (=
3.4.1-7.el9), cyrus-sasl (2.1.27-20.el9) and sendmail (8.16.1-10-el9).=C2=
=A0 I am not copying over configuration files but editing the new files to =
replicate the function of the production server.
I have encountered difficulties with getting the Cyrus IMAP service working=
.=C2=A0 There are a number of messages in /var/log/maillog which hint that =
Cyrus cannot access the SASL password database (/etc/sdsl2/sasldb2) but I a=
m very confused about this sequence of symptoms and cannot pose a coherent =
question to you.
A simpler problem, which may turn out to be primary, is that I cannot creat=
e an IMAP mailbox for any user.=C2=A0 My steps are:
1) "cyradm -u cyrus localhost"
2) Enter password for cyrus account=C2=A0 (previously created with saslpass=
wd2 and verified with sasldblistusers2)
3) "cm user/dale"
4) Output on terminal "createmailbox: System I/O error"
5) Output in /var/log/maillog
Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL transitioning user cyrus
Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL SASL error opening passwor=
d file. Do you have write permissions?#012Have you performed the migration =
from db2 using cyrusbdb2current?
Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL Could not open /etc/sasl2/=
sasldb2
Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL setpass failed for cyrus
Nov 24 14:24:05 localhost cyrus/imap[2989]: login: localhost [::1] cyrus LO=
GIN User logged in SESSIONID=3D<cyrus-1669328623-2989-1-1834342104628372315=
9>
Nov 24 14:25:38 localhost cyrus/imap[2989]: IOERROR: creating directory /ho=
me/imap/d: Permission denied
Nov 24 14:25:38 localhost cyrus/imap[2989]: IOERROR: mkdir failed: fname=3D=
</home/imap/d/user/dale/cyrus.index> syserror=3D<Permission denied> func=3D=
<mailbox_create>
There seems to be two problems here, a failure to access the SASL database =
and a failure to create the mailbox caused by "Permission denied".=C2=A0 In=
other tests I changed the permission on /home/imap to allow anyone to writ=
e but still I get "Permission denied".=C2=A0 I have also changed the permis=
sion on /etc/sasl2/sasldb2 to allow anyone to read. In either test the fail=
ure persists.
I have done a lot of searching the Red Hat Knowledge as well as general Goo=
gle searchs.=C2=A0 I have found some sites where people are asking about th=
ese particular log entries, but I have not seen one with a useful response.=
=C2=A0 Generally there is simply no reply.
Below I have "sasl_pwcheck_method: saslauthd".=C2=A0 I have also tried "aux=
prop" but authentication continued to fail.
Your help would be appreciated.
Both the Cyrus and SASL daemons are running.
The status of /home/imap is
[root@localhost etc]# ls -ld /home/imap
drwx------. 2 cyrus mail 6 Nov 24 00:42 /home/imap
[root@localhost etc]# ls -l /home/imap
total 0
The status of /etc/sasl2
[root@localhost etc]# ls -ld /etc/sasl2/
drwxr-xr-x. 2 root root 42 Nov 22 00:40 /etc/sasl2/
[root@localhost etc]# ls -l /etc/sasl2/
total 20
-rw-------. 1 root root 16384 Nov 19 00:02 sasldb2
-rw-r--r--. 1 root root=C2=A0=C2=A0=C2=A0 25 Aug 10=C2=A0 2021 Sendmail.conf
Contents of /etc/imapd.conf
admins: cyrus
unixhierarchysep: on
configdirectory: /var/lib/imap
proc_path: /run/cyrus/proc
mboxname_lockpath: /run/cyrus/lock
duplicate_db_path: /run/cyrus/db/deliver.db
ptscache_db_path:=C2=A0 /run/cyrus/db/ptscache.db
statuscache_db_path: /run/cyrus/db/statuscache.db
tls_sessions_db_path: /run/cyrus/db/tls_sessions.db
defaultpartition: default
partition-default: /home/imap
sievedir: /var/lib/imap/sieve
lmtpsocket: /run/cyrus/socket/lmtp
idlesocket: /run/cyrus/socket/idle
notifysocket: /run/cyrus/socket/notify
syslog_prefix: cyrus
httpmodules: caldav carddav domainkey freebusy ischedule rss webdav
hashimapspool: true
virtdomains: userid
popminpoll: 1
conversations: 1
conversations_db: twoskip
specialusealways: 1
allowplaintext: yes
sasl_pwcheck_method: saslauthd
sasl_auto_transition: yes
tls_server_cert: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_server_key: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_client_ca_file: /etc/ssl/certs/ca-bundle.crt
tls_client_ca_dir: /etc/ssl/certs
tls_sessiontimeout: 1440
Contents of /etc/cyrus.conf
# standard standalone server implementation, with preforked processes
START {
=C2=A0 # do not delete this entry!
=C2=A0 recover=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"ctl_cyrusdb -r"
}
# UNIX sockets start with a slash and are put into /run/cyrus/socket
SERVICES {
=C2=A0 # add or remove based on preferences
=C2=A0 imap=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"im=
apd" listen=3D"imap" prefork=3D5
=C2=A0 imaps=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"imapd -=
s" listen=3D"imaps" prefork=3D1
#=C2=A0 pop3=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"p=
op3d" listen=3D"pop3" prefork=3D3
#=C2=A0 pop3s=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"pop3d =
-s" listen=3D"pop3s" prefork=3D1
=C2=A0 sieve=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"timsiev=
ed" listen=3D"sieve" prefork=3D0
=C2=A0 # these are only necessary if receiving/exporting usenet via NNTP
#=C2=A0 nntp=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"n=
ntpd" listen=3D"nntp" prefork=3D3
#=C2=A0 nntps=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"nntpd =
-s" listen=3D"nntps" prefork=3D1
=C2=A0 # these are only necessary if using HTTP for CalDAV, CardDAV, or RSS
#=C2=A0 http=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"h=
ttpd" listen=3D"http" prefork=3D3
#=C2=A0 https=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"httpd =
-s" listen=3D"https" prefork=3D1
=C2=A0 # at least one LMTP is required for delivery
#=C2=A0 lmtp=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"l=
mtpd" listen=3D"lmtp" prefork=3D0
=C2=A0 lmtpunix=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"lmtpd" listen=3D"/run/=
cyrus/socket/lmtp" prefork=3D1
=C2=A0 # this is requied if using socketmap
#=C2=A0 smmap=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"smmapd=
" listen=3D"/run/cyrus/socket/smmap" prefork=3D1
=C2=A0 # this is only necessary if using notifications
#=C2=A0 notify=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"notifyd" li=
sten=3D"/run/cyrus/socket/notify" proto=3D"udp" prefork=3D1
}
EVENTS {
=C2=A0 # this is required
=C2=A0 checkpoint=C2=A0=C2=A0=C2=A0 cmd=3D"ctl_cyrusdb -c" period=3D30
=C2=A0 # this is only necessary if using duplicate delivery suppression,
=C2=A0 # Sieve or NNTP
=C2=A0 delprune=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"cyr_expire -E 3" at=3D=
0400
=C2=A0 # Expire data older than 28 days.
=C2=A0 deleteprune=C2=A0=C2=A0 cmd=3D"cyr_expire -E 4 -D 28" at=3D0430
=C2=A0 expungeprune=C2=A0 cmd=3D"cyr_expire -E 4 -X 28" at=3D0445
=C2=A0 # this is only necessary if caching TLS sessions
=C2=A0 tlsprune=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"tls_prune" at=3D0400
}
DAEMON {
=C2=A0 # this is only necessary if using idled for IMAP IDLE
=C2=A0 idled=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cmd=3D"idled"
}
------------------------------------------
Cyrus: SASL
Permalink: https://cyrus.topicbox.com/groups/sasl/Tc234f166b512980e-M53c728=
87be7b931cd2cd3319
Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription
--16695341531.df6697fe.87985
Date: Sun, 27 Nov 2022 02:29:13 -0500
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html>
<html><html><html><body><div>We have a server which, among other things, ru=
ns an email service for our company. This server runs RHEL 7.9, Cyrus and S=
endmail.<br /></div><div><br /></div><div>Now we are replacing the hardware=
of this server and I am configuring the new server with RHEL 9 and the cor=
respondingly new versions of cyrus-imapd (3.4.1-7.el9), cyrus-sasl (2.1.27-=
20.el9) and sendmail (8.16.1-10-el9). I am not copying over configura=
tion files but editing the new files to replicate the function of the produ=
ction server.<br /></div><div><br /></div><div>I have encountered difficult=
ies with getting the Cyrus IMAP service working. There are a number o=
f messages in /var/log/maillog which hint that Cyrus cannot access the SASL=
password database (/etc/sdsl2/sasldb2) but I am very confused about this s=
equence of symptoms and cannot pose a coherent question to you.<br /></div>=
<div><br /></div><div>A simpler problem, which may turn out to be primary, =
is that I cannot create an IMAP mailbox for any user. My steps are:<b=
r /></div><div><br /></div><div>1) "cyradm -u cyrus localhost"<br=
/></div><div>2) Enter password for cyrus account (previously created=
with saslpasswd2 and verified with sasldblistusers2)<br /></div><div>3) &q=
uot;cm user/dale"<br /></div><div>4) Output on terminal "createma=
ilbox: System I/O error"<br /></div><div>5) Output in /var/log/maillog=
<br /></div><div>Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL transitio=
ning user cyrus<br /></div><div>Nov 24 14:24:05 localhost cyrus/imap[2989]:=
SASL SASL error opening password file. Do you have write permissions?#012H=
ave you performed the migration from db2 using cyrusbdb2current?<br /></div=
><div>Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL Could not open /etc/=
sasl2/sasldb2<br /></div><div>Nov 24 14:24:05 localhost cyrus/imap[2989]: S=
ASL setpass failed for cyrus<br /></div><div>Nov 24 14:24:05 localhost cyru=
s/imap[2989]: login: localhost [::1] cyrus LOGIN User logged in SESSIONID=
=3D<cyrus-1669328623-2989-1-18343421046283723159><br /></div><div>Nov=
24 14:25:38 localhost cyrus/imap[2989]: IOERROR: creating directory /home/=
imap/d: Permission denied<br /></div><div>Nov 24 14:25:38 localhost cyrus/i=
map[2989]: IOERROR: mkdir failed: fname=3D</home/imap/d/user/dale/cyrus.=
index> syserror=3D<Permission denied> func=3D<mailbox_create>=
;<br /></div><div><br /></div><div>There seems to be two problems here, a f=
ailure to access the SASL database and a failure to create the mailbox caus=
ed by "Permission denied". In other tests I changed the per=
mission on /home/imap to allow anyone to write but still I get "Permis=
sion denied". I have also changed the permission on /etc/sasl2/s=
asldb2 to allow anyone to read. In either test the failure persists.<br /><=
/div><div><br /></div><div>I have done a lot of searching the Red Hat Knowl=
edge as well as general Google searchs. I have found some sites where=
people are asking about these particular log entries, but I have not seen =
one with a useful response. Generally there is simply no reply.<br />=
</div><div><br /></div><div>Below I have "sasl_pwcheck_method: saslaut=
hd". I have also tried "auxprop" but authentication co=
ntinued to fail.<br /></div><div><br /></div><div>Your help would be apprec=
iated.<br /></div><div><br /></div><div>Both the Cyrus and SASL daemons are=
running.<br /></div><div><br /></div><div>The status of /home/imap is<br /=
></div><div>[root@localhost etc]# ls -ld /home/imap<br /></div><div>drwx---=
---. 2 cyrus mail 6 Nov 24 00:42 /home/imap<br /></div><div>[root@localhost=
etc]# ls -l /home/imap<br /></div><div>total 0<br /></div><div><br /></div=
><div>The status of /etc/sasl2<br /></div><div>[root@localhost etc]# ls -ld=
/etc/sasl2/<br /></div><div>drwxr-xr-x. 2 root root 42 Nov 22 00:40 /etc/s=
asl2/<br /></div><div>[root@localhost etc]# ls -l /etc/sasl2/<br /></div><d=
iv>total 20<br /></div><div>-rw-------. 1 root root 16384 Nov 19 00:02 sasl=
db2<br /></div><div>-rw-r--r--. 1 root root 25 Aug 10&nbs=
p; 2021 Sendmail.conf<br /></div><div><br /></div><div>Contents of /etc/ima=
pd.conf<br /></div><div>admins: cyrus<br /></div><div>unixhierarchysep: on<=
br /></div><div>configdirectory: /var/lib/imap<br /></div><div>proc_path: /=
run/cyrus/proc<br /></div><div>mboxname_lockpath: /run/cyrus/lock<br /></di=
v><div>duplicate_db_path: /run/cyrus/db/deliver.db<br /></div><div>ptscache=
_db_path: /run/cyrus/db/ptscache.db<br /></div><div>statuscache_db_pa=
th: /run/cyrus/db/statuscache.db<br /></div><div>tls_sessions_db_path: /run=
/cyrus/db/tls_sessions.db<br /></div><div>defaultpartition: default<br /></=
div><div>partition-default: /home/imap<br /></div><div>sievedir: /var/lib/i=
map/sieve<br /></div><div>lmtpsocket: /run/cyrus/socket/lmtp<br /></div><di=
v>idlesocket: /run/cyrus/socket/idle<br /></div><div>notifysocket: /run/cyr=
us/socket/notify<br /></div><div>syslog_prefix: cyrus<br /></div><div>httpm=
odules: caldav carddav domainkey freebusy ischedule rss webdav<br /></div><=
div>hashimapspool: true<br /></div><div>virtdomains: userid<br /></div><div=
>popminpoll: 1<br /></div><div>conversations: 1<br /></div><div>conversatio=
ns_db: twoskip<br /></div><div>specialusealways: 1<br /></div><div>allowpla=
intext: yes<br /></div><div>sasl_pwcheck_method: saslauthd<br /></div><div>=
sasl_auto_transition: yes<br /></div><div>tls_server_cert: /etc/pki/cyrus-i=
mapd/cyrus-imapd.pem<br /></div><div>tls_server_key: /etc/pki/cyrus-imapd/c=
yrus-imapd.pem<br /></div><div>tls_client_ca_file: /etc/ssl/certs/ca-bundle=
.crt<br /></div><div>tls_client_ca_dir: /etc/ssl/certs<br /></div><div>tls_=
sessiontimeout: 1440<br /></div><div><br /></div><div>Contents of /etc/cyru=
s.conf<br /></div><div># standard standalone server implementation, with pr=
eforked processes<br /></div><div><br /></div><div>START {<br /></div><div>=
# do not delete this entry!<br /></div><div> recover &nbs=
p; cmd=3D"ctl_cyrusdb -r"<br /></div><div=
>}<br /></div><div><br /></div><div># UNIX sockets start with a slash and a=
re put into /run/cyrus/socket<br /></div><div>SERVICES {<br /></div><div>&n=
bsp; # add or remove based on preferences<br /></div><div> imap =
cmd=3D"imapd" li=
sten=3D"imap" prefork=3D5<br /></div><div> imaps  =
; cmd=3D"imapd -s" listen=3D&=
quot;imaps" prefork=3D1<br /></div><div># pop3 =
cmd=3D"pop3d" listen=3D"=
;pop3" prefork=3D3<br /></div><div># pop3s &nbs=
p; cmd=3D"pop3d -s" listen=3D"pop3s&=
quot; prefork=3D1<br /></div><div> sieve  =
; cmd=3D"timsieved" listen=3D"sieve" =
prefork=3D0<br /></div><div><br /></div><div> # these are only necess=
ary if receiving/exporting usenet via NNTP<br /></div><div># nntp&nbs=
p; cmd=3D"nntpd" =
listen=3D"nntp" prefork=3D3<br /></div><div># nntps &n=
bsp; cmd=3D"nntpd -s" listen=
=3D"nntps" prefork=3D1<br /></div><div><br /></div><div> # =
these are only necessary if using HTTP for CalDAV, CardDAV, or RSS<br /></d=
iv><div># http =
cmd=3D"httpd" listen=3D"http" prefork=3D3<br /></div><d=
iv># https cmd=3D&quo=
t;httpd -s" listen=3D"https" prefork=3D1<br /></div><div><br=
/></div><div> # at least one LMTP is required for delivery<br /></di=
v><div># lmtp c=
md=3D"lmtpd" listen=3D"lmtp" prefork=3D0<br /></div><di=
v> lmtpunix cmd=3D"lmtpd" lis=
ten=3D"/run/cyrus/socket/lmtp" prefork=3D1<br /></div><div><br />=
</div><div> # this is requied if using socketmap<br /></div><div>#&nb=
sp; smmap cmd=3D"smmap=
d" listen=3D"/run/cyrus/socket/smmap" prefork=3D1<br /></div=
><div><br /></div><div> # this is only necessary if using notificatio=
ns<br /></div><div># notify =
cmd=3D"notifyd" listen=3D"/run/cyrus/socket/notify" pr=
oto=3D"udp" prefork=3D1<br /></div><div>}<br /></div><div><br /><=
/div><div>EVENTS {<br /></div><div> # this is required<br /></div><di=
v> checkpoint cmd=3D"ctl_cyrusdb -c" peri=
od=3D30<br /></div><div><br /></div><div> # this is only necessary if=
using duplicate delivery suppression,<br /></div><div> # Sieve or NN=
TP<br /></div><div> delprune cmd=3D&quo=
t;cyr_expire -E 3" at=3D0400<br /></div><div><br /></div><div> #=
Expire data older than 28 days.<br /></div><div> deleteprune &n=
bsp; cmd=3D"cyr_expire -E 4 -D 28" at=3D0430<br /></div><div>&nbs=
p; expungeprune cmd=3D"cyr_expire -E 4 -X 28" at=3D0445<br =
/></div><div><br /></div><div> # this is only necessary if caching TL=
S sessions<br /></div><div> tlsprune cm=
d=3D"tls_prune" at=3D0400<br /></div><div>}<br /></div><div><br /=
></div><div>DAEMON {<br /></div><div> # this is only necessary if usi=
ng idled for IMAP IDLE<br /></div><div> idled =
cmd=3D"idled"<br /></div><div>}<br /></d=
iv><div id=3D"topicbox-footer" style=3D"margin:10px 0 0;border-top:1px soli=
d #ddd;border-color:rgba(0,0,0,.15);padding:7px 0;">
<strong><a href=3D"https://cyrus.topicbox.com/latest" style=3D"color:inheri=
t;text-decoration:none">Cyrus</a></strong>
/ SASL / see
<a href=3D"https://cyrus.topicbox.com/groups/sasl">discussions</a>
+
<a href=3D"https://cyrus.topicbox.com/groups/sasl/members">participants</a>
+
<a href=3D"https://cyrus.topicbox.com/groups/sasl/subscription">delivery&nb=
sp;options</a>
<a href=3D"https://cyrus.topicbox.com/groups/sasl/Tc234f166b512980e-M53c728=
87be7b931cd2cd3319" style=3D"float:right">Permalink</a>
</div>
</body></html></html></html>=
--16695341531.df6697fe.87985--