Bug 1280436 - Setting first_valid_gid/last_valid_gid leads to (wrong) error messages
Setting first_valid_gid/last_valid_gid leads to (wrong) error messages
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: dovecot (Show other bugs)
7.1
All Linux
medium Severity medium
: rc
: ---
Assigned To: Michal Hlavinka
Frantisek Sumsal
: Patch
Depends On:
Blocks: 1298243 1400961 1393870
  Show dependency treegraph
 
Reported: 2015-11-11 12:54 EST by Robert Scheck
Modified: 2017-08-01 17:44 EDT (History)
4 users (show)

See Also:
Fixed In Version: dovecot-2.2.10-8.el7
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-01 17:44:24 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Robert Scheck 2015-11-11 12:54:58 EST
Description of problem:
Setting first_valid_gid/last_valid_gid leads to (wrong) error messages: In
/etc/dovecot/conf.d/10-mail.conf you can configure first_valid_gid = 100 and
last_valid_gid = 100 (while leaving the rest on default values). This assumes
that your e-mail users are in group users and other users in !users groups.
This works more or less but throws error messages which are right by content
but wrong that they are created:

$ doveadm purge -A
doveadm(polkitd): Error: user polkitd: Mail access for users with GID 997 not permitted (see first_valid_gid in config file, gid from userdb lookup).
doveadm(polkitd): Error: User init failed
doveadm(dovenull): Error: user dovenull: Mail access for users with GID 996 not permitted (see first_valid_gid in config file, gid from userdb lookup).
doveadm(dovenull): Error: User init failed
doveadm(unbound): Error: user unbound: Mail access for users with GID 995 not permitted (see first_valid_gid in config file, gid from userdb lookup).
doveadm(unbound): Error: User init failed
doveadm(saslauth): Error: user saslauth: Mail access for users with GID 76 not permitted (see first_valid_gid in config file, gid from userdb lookup).
doveadm(saslauth): Error: User init failed
doveadm(nfsnobody): Error: user nfsnobody: Mail access for users with GID 65534 not permitted (see first_valid_gid in config file, gid from userdb lookup).
doveadm(nfsnobody): Error: User init failed
$ 

I agree with Dovecot that mail access isn't allowed for these users, but the
users are also not used for e-mail but they are excluded via first_valid_gid/
last_valid_gid. So "doveadm purge -A" should not complain, but ignore these
users (based on their GID).

Version-Release number of selected component (if applicable):
dovecot-2.2.10-4.el7_0.1.x86_64

How reproducible:
Everytime, see above and below.

Actual results:
Setting first_valid_gid/last_valid_gid leads to (wrong) error messages.

Expected results:
No complains by "doveadm purge -A" if the GID is excluded (because Dovecot
decides what -A contains, thus Dovecot should not complain about its own
selection of applicable users).

Additional info:
This is not a duplicate of bug #1280433, these are two different issues.
Comment 1 Robert Scheck 2015-11-11 13:01:02 EST
Note, the userdb is passwd - I am not aware that there already a restriction
would be possible.
Comment 3 Robert Scheck 2015-11-11 13:10:24 EST
Cross-filed case 01538033 on the Red Hat customer portal.
Comment 4 Michal Hlavinka 2016-06-20 11:23:01 EDT
could you post your configuration? Output of: doveconf -n 
based on this http://hg.dovecot.org/dovecot-2.1/rev/85a8d582d37f
it should already work
Comment 5 Robert Scheck 2016-06-20 11:36:01 EDT
auth_mechanisms = plain login
auth_verbose = yes
first_valid_gid = 100
first_valid_uid = 1000
hostname = mail.example.net
imap_client_workarounds = delay-newmail
last_valid_gid = 100
mail_location = mdbox:/home/%u/Mail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
mbox_write_locks = fcntl
mdbox_rotate_interval = 1 weeks
mdbox_rotate_size = 10 M
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  driver = pam
}
plugin {
  sieve = ~/.dovecot.sieve
  sieve_dir = ~/sieve
}
postmaster_address = postmaster@example.net
protocols = imap lmtp sieve
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
  unix_listener auth-userdb {
    group = root
    mode = 0666
    user = root
  }
}
service imap-login {
  inet_listener imap {
    port = 143
  }
}
service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
}
ssl = required
ssl_cert = </etc/pki/tls/certs/mail.example.net.pem
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
ssl_key = </etc/pki/tls/private/mail.example.net.pem
ssl_prefer_server_ciphers = yes
ssl_protocols = !SSLv2 !SSLv3
userdb {
  driver = passwd
}
protocol lda {
  mail_plugins = " sieve"
}
protocol imap {
  mail_max_userip_connections = 10
}
protocol sieve {
  managesieve_logout_format = bytes=%i/%o
}
Comment 6 Michal Hlavinka 2016-06-29 07:14:01 EDT
I have prepared a patch for this. I've send it upstream, waiting for their feedback.
Comment 13 errata-xmlrpc 2017-08-01 17:44:24 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2187

Note You need to log in before you can comment on or make changes to this bug.