Send-only accounts - errors reading users file

[jpitoniak]

I'm wondering if it is possible to use both Chasquid accounts and Dovecot accounts for authentication at the same time. The website seems to imply that it is, but I haven't been able to get it working.

I just set up a new mail server using Chasquid and Dovecot and I'm in the process of moving my domains over to it. I've had mail for one of my domains going to it for about a week and it's been working well. I'm hoping to move my other domains over by this weekend.

This is my use case: I have a handful of Linux boxes that are connected together via a private network using a Tinc VPN. I want all email that they generate to come from one location, so in my current setup I have msmtp running on each box to emulate sendmail and msmtp passes the messages on to my SMTP server (Exim). Exim is configured to allow relaying from the private IP range of the VPN.

I know this isn't possible with Chasquid, so I tried creating a Chasquid account for one of my boxes with chasquid-util user-add boxname@mydomain.com. It worked and I can validate it using chasquid-util authenticate boxname@mydomain.com, but when msmtp attempts to send a message, it fails with the following:

host=10.9.0.10 tls=on auth=on user=boxname@mydomain.com from=boxname@mydomain.com recipients=me@mydomain.com smtpstatus=535 smtpmsg='535 5.7.8 Incorrect user or password' errormsg='authentication failed (method PLAIN)' exitcode=EX_NOPERM

If I add the same user credentials to my Dovecot passwd file, messages flow fine.

The "boxname" email addresses will never receive mail, so they don't need mailboxes.

My chasquid.conf file is basically the same as the one at https://blitiri.com.ar/p/chasquid/howto/#configure-chasquid, with the exception that I changed smtp_adress to an arbitrary port number. I use a third-party spam filtering service as my mail exchanger; they can forward passing messages to whatever port I want, so keeping 25 closed helps keep out the riff raff.

if I can't use chasquid accounts for this, it isn't the end of the world. If I don't tell my spam provider that those addresses exist, they'll never get any mail from the internet, so I don't really have to worry about them.

[albertito]

I'm wondering if it is possible to use both Chasquid accounts and Dovecot accounts for authentication at the same time. The website seems to imply that it is, but I haven't been able to get it working.

Yes, this is possible and should work out of the box.

chasquid's internal user db is checked first, and if the check fails, it falls back to dovecot (source).

I just set up a new mail server using Chasquid and Dovecot and I'm in the process of moving my domains over to it. I've had mail for one of my domains going to it for about a week and it's been working well. I'm hoping to move my other domains over by this weekend.

Happy to hear that!

This is my use case: I have a handful of Linux boxes that are connected together via a private network using a Tinc VPN. I want all email that they generate to come from one location, so in my current setup I have msmtp running on each box to emulate sendmail and msmtp passes the messages on to my SMTP server (Exim). Exim is configured to allow relaying from the private IP range of the VPN.

I know this isn't possible with Chasquid, so I tried creating a Chasquid account for one of my boxes with chasquid-util user-add boxname@mydomain.com.

FWIW, this is totally normal use case, and I do this in my personal setup too. It should work just fine.

It worked and I can validate it using chasquid-util authenticate boxname@mydomain.com, but when msmtp attempts to send a message, it fails with the following:

host=10.9.0.10 tls=on auth=on user=boxname@mydomain.com from=boxname@mydomain.com recipients=me@mydomain.com smtpstatus=535 smtpmsg='535 5.7.8 Incorrect user or password' errormsg='authentication failed (method PLAIN)' exitcode=EX_NOPERM

If I add the same user credentials to my Dovecot passwd file, messages flow fine.

This should not happen :S

If you go to the monitoring http server and look at the Auth.Authenticate traces (or alternatively if you run chasquid with extra verbosity and look at the logs), what do you see when you try to authenticate?

The "boxname" email addresses will never receive mail, so they don't need mailboxes.

My chasquid.conf file is basically the same as the one at https://blitiri.com.ar/p/chasquid/howto/#configure-chasquid, with the exception that I changed smtp_adress to an arbitrary port number. I use a third-party spam filtering service as my mail exchanger; they can forward passing messages to whatever port I want, so keeping 25 closed helps keep out the riff raff.

if I can't use chasquid accounts for this, it isn't the end of the world. If I don't tell my spam provider that those addresses exist, they'll never get any mail from the internet, so I don't really have to worry about them.

You should be able to use chasquid accounts for this. It is covered in the tests, and personally I use the same setup, so it should work just fine. Let's figure out what's going on :)

Thanks for reporting this!

[albertito]

Just thought of another potential issue: check the logs of chasquid starting up, what do you see? Are there any lines with users file error?

If chasquid doesn't have permissions to open /etc/chasquid/domains/example.com/users, it could be the causing the behaviour you see: no users are loaded, but the dovecot fallback works fine.

[jpitoniak]

First rule of Linux troubleshooting: check permissions. Which is exactly what I missed. It was permissions. Everything is working now.

Thanks for the quick response and thanks for all your work on Chasquid. I'm really liking the simplicity of it: so far it does everything I need right out of the box, with no complicated configuration.

[albertito]

First rule of Linux troubleshooting: check permissions. Which is exactly what I missed. It was permissions. Everything is working now.

I'm glad the issue is solved!

I think this issue shows chasquid could also make the situation more obvious.

I'll work on some patches to make it either crash when there are errors reading, or at least log them it periodically (e.g. if the reload fails).

Thanks for the quick response and thanks for all your work on Chasquid. I'm really liking the simplicity of it: so far it does everything I need right out of the box, with no complicated configuration.

I'm glad to hear that! Please let me know if you have any other questions or suggestions!