Bug 179430 - Create DH keys if they do not exist
Summary: Create DH keys if they do not exist
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: dovecot
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Petr Rockai
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2006-01-31 10:55 UTC by Reuben Farrelly
Modified: 2014-01-21 22:53 UTC (History)
3 users (show)

Fixed In Version: 1.0-0.beta2.2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2006-01-31 12:32:08 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Reuben Farrelly 2006-01-31 10:55:31 UTC
dovecot-1.0 beta1 introduced the use of Diffie Helman parameters for it's SSL. 
These keys need to be built the first time dovecot is run on either a new
installation, or an existing installation/upgrade if they have not been
generated before.

This can be achieved by executing dovecot like this:

dovecot --build-ssl-parameters

Dovecot starts, prints a message stating that it is generating parameters, and
then shuts down once they have been created.

What we want is the postinstall script to test for the presence of
/var/run/dovecot/login/ssl-parameters.dat - if it exists then fine (exit), if it
does not exist then invoke dovecot with the above parameters.
This allows the DH parameters to be generated at install time rather than run time.

Comment 1 Petr Rockai 2006-01-31 12:32:08 UTC
Thanks, fixed in 1.0-0.beta2.2.  

Comment 2 Steven Haigh 2006-02-01 15:14:52 UTC
After installing this update, OSX's Mail.app program now refuses to talk via
IMAP to the dovecot server. Using IMAPS on port 993 works, however not without
SSL on port 143.

the log in /var/log/maillog shows:
Feb  2 02:02:48 zeus dovecot: imap-login: Aborted login: rip=203.56.246.84,
lip=203.56.246.81
Feb  2 02:03:19 zeus last message repeated 10 times
Feb  2 02:03:48 zeus dovecot: imap-login: Aborted login: rip=203.56.246.84,
lip=203.56.246.81

interestingly enough, Squirrelmail can still use localhost:143 ok as it's IMAP
mail source.

I can also telnet to the server and get a banner.
# telnet zeus.crc.id.au 143
Trying 203.56.246.81...
Connected to zeus.crc.id.au (203.56.246.81).
Escape character is '^]'.
* OK Dovecot ready.

Do we know exactly what changed in this update?

Comment 3 Petr Rockai 2006-02-01 15:38:56 UTC
Steven, which update exactly, please? The only thing that changed between    
1.0-0.beta2.1 and beta2.2 is what is documented in the changelog - URL in    
package description and post-install script (which now calls dovecot   
--build-ssl-parameters as requested,  
when /var/run/dovecot/login/ssl-parameters.dat does not exist).  
 
If it appeared in 1.0-0.beta2.1, please open a new bugreport for the issue. 


Note You need to log in before you can comment on or make changes to this bug.