Skip to content

config: ensure SASL socket file is not inside a volume mount#3125

Closed
DavyLandman wants to merge 3 commits intodocker-mailserver:masterfrom
DavyLandman:sasl-socket-move
Closed

config: ensure SASL socket file is not inside a volume mount#3125
DavyLandman wants to merge 3 commits intodocker-mailserver:masterfrom
DavyLandman:sasl-socket-move

Conversation

@DavyLandman
Copy link
Copy Markdown

@DavyLandman DavyLandman commented Feb 27, 2023

See #3110 for more details

Description

The sasl socket was on a path that would end up getting volume mounted (/var/mail-state) in some setups, this could cause issues. The socket is not actually state, so it doesn't need to end up there.

Fixes #3110

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (README.md or the documentation under docs/)
  • If necessary I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

note, I've marked it as Draft because:

  • not sure hot to test this locally
  • discussion is still open if we maybe should move to /dev/shm instead.

@georglauterbach
Copy link
Copy Markdown
Member

georglauterbach commented Feb 27, 2023

not sure hot to test this locally

We have a rather good documentation on how we run tests if that is something you are wondering about. If it is about the change itself, I'm not 100% certain either. I guess running it and seeing whether it produces errors is a good way to start :)


I will add some comments, but the changes as-is look quite good.

Comment thread target/dovecot/10-master.conf Outdated
Comment thread target/dovecot/10-master.conf Outdated
@georglauterbach georglauterbach changed the title Make sure the sasl socket file is not inside a volume mount config: ensure SASL socket file is not inside a volume mount Feb 27, 2023
Comment thread target/dovecot/10-master.conf Outdated
@DavyLandman
Copy link
Copy Markdown
Author

We have a rather good documentation on how we run tests if that is something you are wondering about.

FYI: running the test fails with:

   status : 1
   output (2 lines):
     Unable to find image 'mailserver-testing:ci' locally

so I ran make build (which is not in a that page). but that also fails:

❯ make build
[+] Building 0.3s (3/3) FINISHED
 => [internal] load build definition from Dockerfile                                                                                                                                                              0.0s
 => => transferring dockerfile: 12.40kB                                                                                                                                                                           0.0s
 => [internal] load .dockerignore                                                                                                                                                                                 0.0s
 => => transferring context: 59B                                                                                                                                                                                  0.0s
 => ERROR resolve image config for docker.io/docker/dockerfile:1                                                                                                                                                  0.3s
------
 > resolve image config for docker.io/docker/dockerfile:1:
------
failed to solve with frontend dockerfile.v0: failed to solve with frontend gateway.v0: rpc error: code = Unknown desc = error getting credentials - err: exit status 1, out: `Cannot autolaunch D-Bus without X11 $DISPLAY`
make: *** [Makefile:21: build] Error 1

If it is about the change itself, I'm not 100% certain either. I guess running it and seeing whether it produces errors is a good way to start :)

yeah, I was thinking, how to test in a single test. (without having setup lots of temp records)

@polarathene
Copy link
Copy Markdown
Member

If it is about the change itself, I'm not 100% certain either.

We don't have any known way to reproduce it. Best we can do is check logs for the same permission failures, but if we can't reproduce the conditions to fail reliably, I'd rather not.

There's this PR and the linked issue which has plenty of details behind the change / issue, if we need to revisit this after release.

@polarathene
Copy link
Copy Markdown
Member

so I ran make build (which is not in a that page). but that also fails:

Are you on a Linux host? What version is your Docker Engine?

@DavyLandman
Copy link
Copy Markdown
Author

Are you on a Linux host? What version is your Docker Engine?

U was running it on an unused vps somewhere:

davy@vps1 /tmp/docker-mailserver sasl-socket-move
❯ docker --version
Docker version 20.10.21, build baeda1f

davy@vps1 /tmp/docker-mailserver sasl-socket-move
❯ cat /etc/issue
Debian GNU/Linux 10 \n \l

@georglauterbach
Copy link
Copy Markdown
Member

georglauterbach commented Feb 27, 2023

so I ran make build (which is not in a that page)

Excuse me, but it is explicitly written in the docs: "You will first need to build the container image via make build".

@DavyLandman
Copy link
Copy Markdown
Author

so I ran make build (which is not in a that page)

Excuse me, but it is explicitly written in the docs: "You will first need to build the container image via make build".

🤦🏼 my bad

@georglauterbach
Copy link
Copy Markdown
Member

Could you try logging in via SSH with X-Forwarding? The errror "Cannot autolaunch D-Bus without X11 $DISPLAY" suggests DISPLAY is not set; I have no idea why this would be required though 🤣

@georglauterbach
Copy link
Copy Markdown
Member

georglauterbach commented Feb 27, 2023

Comment thread target/postfix/master.cf
-o smtpd_sasl_auth_enable=yes
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
-o smtpd_sasl_path=/dev/shm/sasl-auth.sock
Copy link
Copy Markdown
Member

@georglauterbach georglauterbach Feb 27, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unrelated to the actual issue, but @polarathene any idea why we overwrite the default here with the same value? Does not make sense to me really..


I'd do this:

Suggested change
-o smtpd_sasl_path=private/auth
-o smtpd_sasl_path=/dev/shm/sasl-auth.sock

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably just how it was originally contributed / configured (or from multiple contributions) that we got a default path in main.cf and another in master.cf 🤷‍♂️

The prior relative path was to be scoped to the chroot jail at /var/spool/postfix, but I guess the answer is just misconfiguration, or copy/paste from guides / snippets online without trying to understand it much 😅

Should be safe to drop I think, but we can do that in a future PR if preferred. I am short on time to double check.

@DavyLandman
Copy link
Copy Markdown
Author

After updating docker the error persists. No idea why I need credentials to pull stuff (as in, not that chatty from this vps).

davy@vps1 /tmp/docker-mailserver sasl-socket-move
❯ make build
[+] Building 0.3s (3/3) FINISHED
 => [internal] load .dockerignore                                                                                                                                                                                 0.0s
 => => transferring context: 59B                                                                                                                                                                                  0.0s
 => [internal] load build definition from Dockerfile                                                                                                                                                              0.0s
 => => transferring dockerfile: 12.39kB                                                                                                                                                                           0.0s
 => ERROR resolve image config for docker.io/docker/dockerfile:1                                                                                                                                                  0.3s
------
 > resolve image config for docker.io/docker/dockerfile:1:
------
Dockerfile:1
--------------------
   1 | >>> # syntax=docker.io/docker/dockerfile:1
   2 |
   3 |     # This Dockerfile provides two stages: stage-base and stage-final
--------------------
ERROR: failed to solve: error getting credentials - err: exit status 1, out: `Cannot autolaunch D-Bus without X11 $DISPLAY`
make: *** [Makefile:21: build] Error 1

davy@vps1 /tmp/docker-mailserver sasl-socket-move
❯ docker --version
Docker version 23.0.1, build a5ee5b1

Comment thread target/postfix/master.cf
-o smtpd_sasl_auth_enable=yes
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
-o smtpd_sasl_path=/dev/shm/sasl-auth.sock
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here as well:

Suggested change
-o smtpd_sasl_path=private/auth
-o smtpd_sasl_path=/dev/shm/sasl-auth.sock

@georglauterbach
Copy link
Copy Markdown
Member

Docker seems to be trying to invoke a credentials helper which requires a graphical frontent, which of course is not enabled. Can you try logging out of all registries with Docker? AFAIK you do not need any credentials for building DMS.

@DavyLandman
Copy link
Copy Markdown
Author

in the end, some googling pointed out outdated credential helpers.

sudo apt remove golang-docker-credential-helpers

did the trick. such fun. it's now building. curious if I can also get this set3 suite to fail.

@georglauterbach
Copy link
Copy Markdown
Member

georglauterbach commented Feb 27, 2023

I actuall think this is a sporadic failure.. seems unrelated to me. Tests have been restarted.

UPDATE: Seems not to be sporadic.. weird. I am currently unable to investigate too, but maybe I can find some time today or tomorrow. Nevermind, found the issue: https://github.com/docker-mailserver/docker-mailserver/blob/master/test/config/dovecot-lmtp/user-patches.sh. The sed will now touch 0660 as well and replace it, which does not make sense. We need to adjust this file.

EDIT2: I am not yet sure how to go about this. @polarathene any idea?

EDIT3: Something like sed -i '/unix_listener lmtp {/,+4d' /etc/dovecot/conf.d/10-master.conf to delete the UNIX socket listener; uncommenting the TCP listener is another task though.

EDIT4: We could delete the whole service lmtp { section and just append to the file; that should work:

sed -i '/service lmtp {/,+13d' /etc/dovecot/conf.d/10-master.conf
cat >>/etc/dovecot/conf.d/10-master.conf << EOF

service lmtp {
  inet_listener lmtp {
    address = 0.0.0.0
    port = 24
  }
}
EOF

@polarathene
Copy link
Copy Markdown
Member

The failure happening in this PR is because of mode = 0660 now having another match for sed?

EDIT4: We could delete the whole service lmtp { section and just append to the file; that should work:

Yeah I guess that works. I think that section could be moved to a separate file and use the include syntax to have Dovecot handle it.

Then the test would just replace that include line or config file.

@georglauterbach
Copy link
Copy Markdown
Member

Yeah; using an include and changing the path if required is probably the best idea!

@DavyLandman
Copy link
Copy Markdown
Author

hey @georglauterbach it seems you have a better idea of what to change, so will you propose a patch?

@georglauterbach
Copy link
Copy Markdown
Member

georglauterbach commented Feb 27, 2023

hey @georglauterbach it seems you have a better idea of what to change, so will you propose a patch?

I can provide a patch and we can then rebase this PR.

EDIT: I have two pending PRs in the pipeline that I am currently waiting for to be merged; I will apply the patch afterwards:

@georglauterbach georglauterbach added the pr/waiting for other PR to get merged This PR is waiting for another / other PR(s) to get merged label Feb 27, 2023
@DavyLandman
Copy link
Copy Markdown
Author

I'm also fine with closing this PR in favor of a new PR that you make that merges these changes? I mean, I'm happy I could help diagnose this issue a bit, I don't need to have my name on the commits ;)

@polarathene
Copy link
Copy Markdown
Member

No worries, we'll take care of it if you like 👍

@georglauterbach
Copy link
Copy Markdown
Member

Alright; let's leave this open for now, I will close it when merging the PR that supersedes this PR.

@georglauterbach
Copy link
Copy Markdown
Member

Superseeded by #3131

@DavyLandman DavyLandman deleted the sasl-socket-move branch February 28, 2023 15:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/configuration (file) kind/update Update an existing feature, configuration file or the documentation pr/waiting for other PR to get merged This PR is waiting for another / other PR(s) to get merged priority/medium service/dovecot service/postfix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] cannot send email, private/auth failed: permission denied

3 participants