Re: Getting message "SASL Could not open /etc/sasl2/sasldb2" when trying to create a mailbox
"Alexandru N. Barloiu" <[email protected]> Sun, 27 Nov 2022 09:44:00 +0200
| Newsgroups | gmane.comp.security.cyrus.sasl |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_EFF32D7A-8CDE-4E27-8CC6-017A3F97AB5D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 This happened to me too, on gentoo. Seems there=E2=80=99s a regression when= cyrus-imapd/cyrus-sasl is linked against db-4. For me it was simple, I jus= t masked db-4 and linked them against db-5 or db-6 and it works just fine. = But in your case of a binary distro, you prolly need to post a bug report o= n your distro bugzilla. I didn=E2=80=99t investigate further. Sorry. I just= thought I would save you some time=E2=80=A6 it=E2=80=99s not in perms and/= or config files.=20 > On 27 Nov 2022, at 09:29, [email protected] wrote: >=20 > We have a server which, among other things, runs an email service for our= company. This server runs RHEL 7.9, Cyrus and Sendmail. >=20 > Now we are replacing the hardware of this server and I am configuring the= new server with RHEL 9 and the correspondingly new versions of cyrus-imapd= (3.4.1-7.el9), cyrus-sasl (2.1.27-20.el9) and sendmail (8.16.1-10-el9). I= am not copying over configuration files but editing the new files to repli= cate the function of the production server. >=20 > I have encountered difficulties with getting the Cyrus IMAP service worki= ng. There are a number of messages in /var/log/maillog which hint that Cyr= us cannot access the SASL password database (/etc/sdsl2/sasldb2) but I am v= ery confused about this sequence of symptoms and cannot pose a coherent que= stion to you. >=20 > A simpler problem, which may turn out to be primary, is that I cannot cre= ate an IMAP mailbox for any user. My steps are: >=20 > 1) "cyradm -u cyrus localhost" > 2) Enter password for cyrus account (previously created with saslpasswd2= and verified with sasldblistusers2) > 3) "cm user/dale" > 4) Output on terminal "createmailbox: System I/O error" > 5) Output in /var/log/maillog > Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL transitioning user cyrus > Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL SASL error opening passw= ord file. Do you have write permissions?#012Have you performed the migratio= n from db2 using cyrusbdb2current? > Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL Could not open /etc/sasl= 2/sasldb2 > Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL setpass failed for cyrus > Nov 24 14:24:05 localhost cyrus/imap[2989]: login: localhost [::1] cyrus = LOGIN User logged in SESSIONID=3D<cyrus-1669328623-2989-1-18343421046283723= 159> > Nov 24 14:25:38 localhost cyrus/imap[2989]: IOERROR: creating directory /= home/imap/d: Permission denied > Nov 24 14:25:38 localhost cyrus/imap[2989]: IOERROR: mkdir failed: fname= =3D</home/imap/d/user/dale/cyrus.index> syserror=3D<Permission denied> func= =3D<mailbox_create> >=20 > There seems to be two problems here, a failure to access the SASL databas= e and a failure to create the mailbox caused by "Permission denied". In ot= her tests I changed the permission on /home/imap to allow anyone to write b= ut still I get "Permission denied". I have also changed the permission on = /etc/sasl2/sasldb2 to allow anyone to read. In either test the failure pers= ists. >=20 > I have done a lot of searching the Red Hat Knowledge as well as general G= oogle searchs. I have found some sites where people are asking about these= particular log entries, but I have not seen one with a useful response. G= enerally there is simply no reply. >=20 > Below I have "sasl_pwcheck_method: saslauthd". I have also tried "auxpro= p" but authentication continued to fail. >=20 > Your help would be appreciated. >=20 > Both the Cyrus and SASL daemons are running. >=20 > The status of /home/imap is > [root@localhost etc]# ls -ld /home/imap > drwx------. 2 cyrus mail 6 Nov 24 00:42 /home/imap > [root@localhost etc]# ls -l /home/imap > total 0 >=20 > The status of /etc/sasl2 > [root@localhost etc]# ls -ld /etc/sasl2/ > drwxr-xr-x. 2 root root 42 Nov 22 00:40 /etc/sasl2/ > [root@localhost etc]# ls -l /etc/sasl2/ > total 20 > -rw-------. 1 root root 16384 Nov 19 00:02 sasldb2 > -rw-r--r--. 1 root root 25 Aug 10 2021 Sendmail.conf >=20 > Contents of /etc/imapd.conf > admins: cyrus > unixhierarchysep: on > configdirectory: /var/lib/imap > proc_path: /run/cyrus/proc > mboxname_lockpath: /run/cyrus/lock > duplicate_db_path: /run/cyrus/db/deliver.db > ptscache_db_path: /run/cyrus/db/ptscache.db > statuscache_db_path: /run/cyrus/db/statuscache.db > tls_sessions_db_path: /run/cyrus/db/tls_sessions.db > defaultpartition: default > partition-default: /home/imap > sievedir: /var/lib/imap/sieve > lmtpsocket: /run/cyrus/socket/lmtp > idlesocket: /run/cyrus/socket/idle > notifysocket: /run/cyrus/socket/notify > syslog_prefix: cyrus > httpmodules: caldav carddav domainkey freebusy ischedule rss webdav > hashimapspool: true > virtdomains: userid > popminpoll: 1 > conversations: 1 > conversations_db: twoskip > specialusealways: 1 > allowplaintext: yes > sasl_pwcheck_method: saslauthd > sasl_auto_transition: yes > tls_server_cert: /etc/pki/cyrus-imapd/cyrus-imapd.pem > tls_server_key: /etc/pki/cyrus-imapd/cyrus-imapd.pem > tls_client_ca_file: /etc/ssl/certs/ca-bundle.crt > tls_client_ca_dir: /etc/ssl/certs > tls_sessiontimeout: 1440 >=20 > Contents of /etc/cyrus.conf > # standard standalone server implementation, with preforked processes >=20 > START { > # do not delete this entry! > recover cmd=3D"ctl_cyrusdb -r" > } >=20 > # UNIX sockets start with a slash and are put into /run/cyrus/socket > SERVICES { > # add or remove based on preferences > imap cmd=3D"imapd" listen=3D"imap" prefork=3D5 > imaps cmd=3D"imapd -s" listen=3D"imaps" prefork=3D1 > # pop3 cmd=3D"pop3d" listen=3D"pop3" prefork=3D3 > # pop3s cmd=3D"pop3d -s" listen=3D"pop3s" prefork=3D1 > sieve cmd=3D"timsieved" listen=3D"sieve" prefork=3D0 >=20 > # these are only necessary if receiving/exporting usenet via NNTP > # nntp cmd=3D"nntpd" listen=3D"nntp" prefork=3D3 > # nntps cmd=3D"nntpd -s" listen=3D"nntps" prefork=3D1 > # these are only necessary if using HTTP for CalDAV, CardDAV, or RSS > # http cmd=3D"httpd" listen=3D"http" prefork=3D3 > # https cmd=3D"httpd -s" listen=3D"https" prefork=3D1 > # at least one LMTP is required for delivery > # lmtp cmd=3D"lmtpd" listen=3D"lmtp" prefork=3D0 > lmtpunix cmd=3D"lmtpd" listen=3D"/run/cyrus/socket/lmtp" prefork= =3D1 >=20 > # this is requied if using socketmap > # smmap cmd=3D"smmapd" listen=3D"/run/cyrus/socket/smmap" prefor= k=3D1 > # this is only necessary if using notifications > # notify cmd=3D"notifyd" listen=3D"/run/cyrus/socket/notify" prot= o=3D"udp" prefork=3D1 > } >=20 > EVENTS { > # this is required > checkpoint cmd=3D"ctl_cyrusdb -c" period=3D30 >=20 > # this is only necessary if using duplicate delivery suppression, > # Sieve or NNTP > delprune cmd=3D"cyr_expire -E 3" at=3D0400 >=20 > # Expire data older than 28 days. > deleteprune cmd=3D"cyr_expire -E 4 -D 28" at=3D0430 > expungeprune cmd=3D"cyr_expire -E 4 -X 28" at=3D0445 >=20 > # this is only necessary if caching TLS sessions > tlsprune cmd=3D"tls_prune" at=3D0400 > } >=20 > DAEMON { > # this is only necessary if using idled for IMAP IDLE > idled cmd=3D"idled" > } > Cyrus <https://cyrus.topicbox.com/latest> / SASL / see discussions <https= ://cyrus.topicbox.com/groups/sasl> + participants <https://cyrus.topicbox.c= om/groups/sasl/members> + delivery=C2=A0options <https://cyrus.topicbox.com= /groups/sasl/subscription>Permalink <https://cyrus.topicbox.com/groups/sasl= /Tc234f166b512980e-M53c72887be7b931cd2cd3319> ------------------------------------------ Cyrus: SASL Permalink: https://cyrus.topicbox.com/groups/sasl/Tc234f166b512980e-Mcabc83= 0c7b8e2576e4fc74e2 Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription --Apple-Mail=_EFF32D7A-8CDE-4E27-8CC6-017A3F97AB5D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=UTF-8 <html><html><html><head><meta content=3D"text/html; charset=3Dutf-8" http-e= quiv=3D"content-type" /></head><body style=3D"overflow-wrap: break-word; -w= ebkit-nbsp-mode: space; line-break: after-white-space;">This happened to me= too, on gentoo. Seems there’s a regression when cyrus-imapd/cyrus-sa= sl is linked against db-4. For me it was simple, I just masked db-4 and lin= ked them against db-5 or db-6 and it works just fine. But in your case of a= binary distro, you prolly need to post a bug report on your distro bugzill= a. I didn’t investigate further. Sorry. I just thought I would save y= ou some time… it’s not in perms and/or config files. <br = /><div><br /><blockquote type=3D"cite"><div>On 27 Nov 2022, at 09:29, dale@= gsdassociates.com wrote:</div><br class=3D"Apple-interchange-newline" /><di= v><div><div>We have a server which, among other things, runs an email servi= ce for our company. This server runs RHEL 7.9, Cyrus and Sendmail.<br /></d= iv><div><br /></div><div>Now we are replacing the hardware of this server a= nd I am configuring the new server with RHEL 9 and the correspondingly new = versions of cyrus-imapd (3.4.1-7.el9), cyrus-sasl (2.1.27-20.el9) and sendm= ail (8.16.1-10-el9). I am not copying over configuration files but ed= iting the new files to replicate the function of the production server.<br = /></div><div><br /></div><div>I have encountered difficulties with getting = the Cyrus IMAP service working. There are a number of messages in /va= r/log/maillog which hint that Cyrus cannot access the SASL password databas= e (/etc/sdsl2/sasldb2) but I am very confused about this sequence of sympto= ms and cannot pose a coherent question to you.<br /></div><div><br /></div>= <div>A simpler problem, which may turn out to be primary, is that I cannot = create an IMAP mailbox for any user. My steps are:<br /></div><div><b= r /></div><div>1) "cyradm -u cyrus localhost"<br /></div><div>2) = Enter password for cyrus account (previously created with saslpasswd2= and verified with sasldblistusers2)<br /></div><div>3) "cm user/dale&= quot;<br /></div><div>4) Output on terminal "createmailbox: System I/O= error"<br /></div><div>5) Output in /var/log/maillog<br /></div><div>= Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL transitioning user cyrus<b= r /></div><div>Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL SASL error = opening password file. Do you have write permissions?#012Have you performed= the migration from db2 using cyrusbdb2current?<br /></div><div>Nov 24 14:2= 4:05 localhost cyrus/imap[2989]: SASL Could not open /etc/sasl2/sasldb2<br = /></div><div>Nov 24 14:24:05 localhost cyrus/imap[2989]: SASL setpass faile= d for cyrus<br /></div><div>Nov 24 14:24:05 localhost cyrus/imap[2989]: log= in: localhost [::1] cyrus LOGIN User logged in SESSIONID=3D<cyrus-166932= 8623-2989-1-18343421046283723159><br /></div><div>Nov 24 14:25:38 localh= ost cyrus/imap[2989]: IOERROR: creating directory /home/imap/d: Permission = denied<br /></div><div>Nov 24 14:25:38 localhost cyrus/imap[2989]: IOERROR:= mkdir failed: fname=3D</home/imap/d/user/dale/cyrus.index> syserror= =3D<Permission denied> func=3D<mailbox_create><br /></div><div>= <br /></div><div>There seems to be two problems here, a failure to access t= he SASL database and a failure to create the mailbox caused by "Permis= sion denied". In other tests I changed the permission on /home/i= map to allow anyone to write but still I get "Permission denied".= I have also changed the permission on /etc/sasl2/sasldb2 to allow an= yone to read. In either test the failure persists.<br /></div><div><br /></= div><div>I have done a lot of searching the Red Hat Knowledge as well as ge= neral Google searchs. I have found some sites where people are asking= about these particular log entries, but I have not seen one with a useful = response. Generally there is simply no reply.<br /></div><div><br /><= /div><div>Below I have "sasl_pwcheck_method: saslauthd". I = have also tried "auxprop" but authentication continued to fail.<b= r /></div><div><br /></div><div>Your help would be appreciated.<br /></div>= <div><br /></div><div>Both the Cyrus and SASL daemons are running.<br /></d= iv><div><br /></div><div>The status of /home/imap is<br /></div><div>[root@= localhost etc]# ls -ld /home/imap<br /></div><div>drwx------. 2 cyrus mail = 6 Nov 24 00:42 /home/imap<br /></div><div>[root@localhost etc]# ls -l /home= /imap<br /></div><div>total 0<br /></div><div><br /></div><div>The status o= f /etc/sasl2<br /></div><div>[root@localhost etc]# ls -ld /etc/sasl2/<br />= </div><div>drwxr-xr-x. 2 root root 42 Nov 22 00:40 /etc/sasl2/<br /></div><= div>[root@localhost etc]# ls -l /etc/sasl2/<br /></div><div>total 20<br /><= /div><div>-rw-------. 1 root root 16384 Nov 19 00:02 sasldb2<br /></div><di= v>-rw-r--r--. 1 root root 25 Aug 10 2021 Sendmail.c= onf<br /></div><div><br /></div><div>Contents of /etc/imapd.conf<br /></div= ><div>admins: cyrus<br /></div><div>unixhierarchysep: on<br /></div><div>co= nfigdirectory: /var/lib/imap<br /></div><div>proc_path: /run/cyrus/proc<br = /></div><div>mboxname_lockpath: /run/cyrus/lock<br /></div><div>duplicate_d= b_path: /run/cyrus/db/deliver.db<br /></div><div>ptscache_db_path: /r= un/cyrus/db/ptscache.db<br /></div><div>statuscache_db_path: /run/cyrus/db/= statuscache.db<br /></div><div>tls_sessions_db_path: /run/cyrus/db/tls_sess= ions.db<br /></div><div>defaultpartition: default<br /></div><div>partition= -default: /home/imap<br /></div><div>sievedir: /var/lib/imap/sieve<br /></d= iv><div>lmtpsocket: /run/cyrus/socket/lmtp<br /></div><div>idlesocket: /run= /cyrus/socket/idle<br /></div><div>notifysocket: /run/cyrus/socket/notify<b= r /></div><div>syslog_prefix: cyrus<br /></div><div>httpmodules: caldav car= ddav domainkey freebusy ischedule rss webdav<br /></div><div>hashimapspool:= true<br /></div><div>virtdomains: userid<br /></div><div>popminpoll: 1<br = /></div><div>conversations: 1<br /></div><div>conversations_db: twoskip<br = /></div><div>specialusealways: 1<br /></div><div>allowplaintext: yes<br /><= /div><div>sasl_pwcheck_method: saslauthd<br /></div><div>sasl_auto_transiti= on: yes<br /></div><div>tls_server_cert: /etc/pki/cyrus-imapd/cyrus-imapd.p= em<br /></div><div>tls_server_key: /etc/pki/cyrus-imapd/cyrus-imapd.pem<br = /></div><div>tls_client_ca_file: /etc/ssl/certs/ca-bundle.crt<br /></div><d= iv>tls_client_ca_dir: /etc/ssl/certs<br /></div><div>tls_sessiontimeout: 14= 40<br /></div><div><br /></div><div>Contents of /etc/cyrus.conf<br /></div>= <div># standard standalone server implementation, with preforked processes<= br /></div><div><br /></div><div>START {<br /></div><div> # do not de= lete this entry!<br /></div><div> recover &nbs= p; cmd=3D"ctl_cyrusdb -r"<br /></div><div>}<br /></div><div= ><br /></div><div># UNIX sockets start with a slash and are put into /run/c= yrus/socket<br /></div><div>SERVICES {<br /></div><div> # add or remo= ve based on preferences<br /></div><div> imap = cmd=3D"imapd" listen=3D"imap&= quot; prefork=3D5<br /></div><div> imaps  = ; cmd=3D"imapd -s" listen=3D"imaps" p= refork=3D1<br /></div><div># pop3 = cmd=3D"pop3d" listen=3D"pop3" prefor= k=3D3<br /></div><div># pop3s &nbs= p; cmd=3D"pop3d -s" listen=3D"pop3s" prefork=3D1<= br /></div><div> sieve  = ; cmd=3D"timsieved" listen=3D"sieve" prefork=3D0<br /><= /div><div><br /></div><div> # these are only necessary if receiving/e= xporting usenet via NNTP<br /></div><div># nntp &nbs= p; cmd=3D"nntpd" listen=3D"nnt= p" prefork=3D3<br /></div><div># nntps &n= bsp; cmd=3D"nntpd -s" listen=3D"nntps"= ; prefork=3D1<br /></div><div><br /></div><div> # these are only nece= ssary if using HTTP for CalDAV, CardDAV, or RSS<br /></div><div># htt= p cmd=3D"httpd&q= uot; listen=3D"http" prefork=3D3<br /></div><div># https&nb= sp; cmd=3D"httpd -s" li= sten=3D"https" prefork=3D1<br /></div><div><br /></div><div> = ; # at least one LMTP is required for delivery<br /></div><div># lmtp= cmd=3D"lmtpd&qu= ot; listen=3D"lmtp" prefork=3D0<br /></div><div> lmtpunix&n= bsp; cmd=3D"lmtpd" listen=3D"/run/cy= rus/socket/lmtp" prefork=3D1<br /></div><div><br /></div><div> #= this is requied if using socketmap<br /></div><div># smmap &nbs= p; cmd=3D"smmapd" listen=3D&q= uot;/run/cyrus/socket/smmap" prefork=3D1<br /></div><div><br /></div><= div> # this is only necessary if using notifications<br /></div><div>= # notify cmd=3D"notify= d" listen=3D"/run/cyrus/socket/notify" proto=3D"udp&quo= t; prefork=3D1<br /></div><div>}<br /></div><div><br /></div><div>EVENTS {<= br /></div><div> # this is required<br /></div><div> checkpoint= cmd=3D"ctl_cyrusdb -c" period=3D30<br /></div>= <div><br /></div><div> # this is only necessary if using duplicate de= livery suppression,<br /></div><div> # Sieve or NNTP<br /></div><div>= delprune cmd=3D"cyr_expire -E 3&q= uot; at=3D0400<br /></div><div><br /></div><div> # Expire data older = than 28 days.<br /></div><div> deleteprune cmd=3D"cy= r_expire -E 4 -D 28" at=3D0430<br /></div><div> expungeprune&nbs= p; cmd=3D"cyr_expire -E 4 -X 28" at=3D0445<br /></div><div><br />= </div><div> # this is only necessary if caching TLS sessions<br /></d= iv><div> tlsprune cmd=3D"tls_prune= " at=3D0400<br /></div><div>}<br /></div><div><br /></div><div>DAEMON = {<br /></div><div> # this is only necessary if using idled for IMAP I= DLE<br /></div><div> idled &= nbsp; cmd=3D"idled"<br /></div><div>}<br /></div></div></div></bl= ockquote></div><br /><div id=3D"topicbox-footer" style=3D"margin:10px 0 0;b= order-top:1px solid #ddd;border-color:rgba(0,0,0,.15);padding:7px 0;"> <strong><a href=3D"https://cyrus.topicbox.com/latest" style=3D"color:inheri= t;text-decoration:none">Cyrus</a></strong> / SASL / see <a href=3D"https://cyrus.topicbox.com/groups/sasl">discussions</a> + <a href=3D"https://cyrus.topicbox.com/groups/sasl/members">participants</a> + <a href=3D"https://cyrus.topicbox.com/groups/sasl/subscription">delivery&nb= sp;options</a> <a href=3D"https://cyrus.topicbox.com/groups/sasl/Tc234f166b512980e-Mcabc83= 0c7b8e2576e4fc74e2" style=3D"float:right">Permalink</a> </div> </body></html></html></html>= --Apple-Mail=_EFF32D7A-8CDE-4E27-8CC6-017A3F97AB5D--