☰

Dovecot：身份验证套接字权限

tag-icon • tag-icon permissions dovecot
Dovecot：身份验证套接字权限

从我的 postfix 设置中，我以 nobody:nobody 的身份运行 deliver，但它无法连接到 dovecot 的 auth-worker 套接字。这是我的 dovecot 配置：


# 2.0.13: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-lts x86_64  
auth_mechanisms = plain login
auth_username_format = %Lu
disable_plaintext_auth = no
first_valid_gid = 65534
mail_location = maildir:/var/spool/vmail/%d/%u/
mail_privileged_group = postfix

passdb {
  args = /etc/dovecot/dovecot-sql.conf
  driver = sql
}
protocols = imap pop3

service auth {
  user = nobody

  unix_listener login/auth-master {
    mode = 0666
  }
  unix_listener login/auth {
    group = postfix
    user = postfix
    mode = 0660
  }
}
ssl = no
userdb {
  args = /etc/dovecot/dovecot-sql.conf
  driver = sql
}
verbose_proctitle = yes
protocol imap {
  imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
}
protocol pop3 {
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
  pop3_uidl_format = %08Xu%08Xv
}
protocol lda {
  postmaster_address = [email protected]
  sendmail_path = /usr/sbin/sendmail
}

这就是我在日志中看到的内容：


Aug  5 10:10:21 localhost dovecot: lda: Error: userdb lookup: connect(/var/run/dovecot/auth-userdb) failed: Permission denied (euid=99(nobody) egid=99(nobody) missing +r perm: /var/run/dovecot/auth-userdb, euid is not dir owner)
Aug  5 10:10:21 localhost dovecot: lda: Fatal: Internal error occurred. Refer to server log for more information.

我尝试过


unix_listener auth-worker {
  user = nobody
}

在service auth部分中，但 dovecot 运行失败并显示以下消息：doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: duplicate listener: /var/run/dovecot/auth-worker

我该如何解决这个问题？

谢谢。

答案1

auth-userdb 权限和所有权问题解决如下：


service auth {
  unix_listener auth-userdb {
    mode = 0660 # socket access mode
    user = nobody # set uid to nobody
    group = nobody # set gid to nobody
  }
}

auth-worker 权限和所有权的问题更加棘手，我只有在阅读 dovecot 的源代码后才找到如何解决它的方法。也许有一些页面描述了这个问题，但我没有找到。我发现 auth-worker 是一种服务，其套接字权限可以这样设置：


service auth-worker {
  unix_listener auth-worker {
    user = nobody # same as above, mode and group are supported too
  }
}

答案2

根据错误消息，您的/var/run/dovecot/目录所有者有误。修复此问题即可。

相关内容