Bug 447450 - fatal: tls_prng_exch_open: cannot open PRNG exchange file /var/lib/postfix/prng_exch: Permission denied
Summary: fatal: tls_prng_exch_open: cannot open PRNG exchange file /var/lib/postfix/pr...
Keywords:
Status: CLOSED DUPLICATE of bug 447454
Alias: None
Product: Fedora
Classification: Fedora
Component: postfix
Version: 9
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Thomas Woerner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-05-19 23:00 UTC by Mads Kiilerich
Modified: 2008-05-20 19:42 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-05-20 09:04:21 UTC


Attachments (Terms of Use)

Description Mads Kiilerich 2008-05-19 23:00:22 UTC
Description of problem:
Postfix tlsmgr dies with permission error, and that can DOS the mail system.

Version-Release number of selected component (if applicable):
postfix-2.5.1-2.fc9.i386

How reproducible:
yes, I assume

Steps to Reproduce:
1. Mail works with the following in Fedora 8 postfix main.cf:
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_type = cyrus
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt
2. upgrade to Fedora 9
3. can't send mail
  
Actual results:
May 20 00:47:39 localhost postfix/master[14239]: warning: process
/usr/libexec/postfix/tlsmgr pid 14513 exit status 1
May 20 00:47:39 localhost postfix/master[14239]: warning:
/usr/libexec/postfix/tlsmgr: bad command startup -- throttling
May 20 00:48:39 localhost postfix/tlsmgr[14562]: fatal: tls_prng_exch_open:
cannot open PRNG exchange file /var/lib/postfix/prng_exch: Permission denied
May 20 00:48:40 localhost postfix/master[14239]: warning: process
/usr/libexec/postfix/tlsmgr pid 14562 exit status 1
May 20 00:48:40 localhost postfix/master[14239]: warning:
/usr/libexec/postfix/tlsmgr: bad command startup -- throttling

Additional info:
http://mail-index.netbsd.org/pkgsrc-users/2008/03/14/msg000561.html claims that
it has been solved in 2.5.1nb1

Problem might be related to issue 437042 and how it is solved.

A workaround is to add
tls_random_exchange_name = /var/spool/postfix/saved/prng_exch
which makes it work for me ... but I don't know if saved is the right place.

And I don't know what the real problem really is. But I think it might be worth
a backport of upgrade.

Comment 1 Mads Kiilerich 2008-05-19 23:03:56 UTC
Bad markup, sorry, not "issue 437042" but https://bugzilla.redhat.com/437042

Comment 2 Thomas Woerner 2008-05-20 09:04:21 UTC

*** This bug has been marked as a duplicate of 447454 ***

Comment 3 Mads Kiilerich 2008-05-20 19:42:10 UTC
Ok. This bug report is an example of selinux confusing admins. I should have
considered blaming selinux and looked for selinux messages. Apparently my
sealart isn't working.

For the record: new selinux rules fixes the problem.


Note You need to log in before you can comment on or make changes to this bug.