andryyy
commented
2 years ago Hi, can you try this? ->
Run „down“, delete the folder data/assets/ssl/mail.yourmailcowhostname.tld, run „up -d“
Mit besten Grüßen André Peters
Am 28.12.2021 um 10:06 schrieb Julien @.***>:
Prior to placing the issue, please check following: (fill out each checkbox with an X once done)
I understand that not following or deleting the below instructions will result in immediate closure and/or deletion of my issue. I have understood that this bug report is dedicated for bugs, and not for support-related inquiries. I have understood that answers are voluntary and community-driven, and not commercial support. I have verified that my issue has not been already answered in the past. I also checked previous issues. Summary
We had a new mailcow install working briefly (with default ssl certificates).
The installation of a custom certificate (issued by Let's Encrypt, but not by acme-mailcow) then prevents dovecot from starting.
The certificate and private key are provided by Let's Encrypt from another machine, and copied via scp to mailcow. They were copied as stated in the documentation (fullchain.pem->cert.pem and privatekey->key.pem) The permissions for both files are kept to 600 and root:root, as the default provided ones. The local let's encrypt container has been disabled since the installation of mailcow. After restarting the required services (still following the documentation), dovecot is not running and will not start.
Adding debug options to dovecot.conf didn't help me diagnose further. Restoring the original certificates and restarting services didn't solve the issue. Updating the whole mailcow install (./update.sh) didn't solve the issue. Crazy thing : it was broken for the 6 hours of attempted debugging + last night and when collecting logs for this issue just 15min ago, dovecot seems to have finally started after running ?!
I guess this command may play a role in fixing the issue ? docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254 as suggested in the issue template.
As following of the guide entails a crashed dovecot, I hope that this issue is legitimate.
emails:/opt/mailcow-dockerized/data/assets/ssl# openssl x509 -in cert.pem -text Certificate: Data: Version: 3 (0x2) Serial Number: 04:7f:a4:0d:2a:82:a7:21:27:80:b4:11:bf:e5:23:d6:91:a0 Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Let's Encrypt, CN = R3 Validity Not Before: Nov 19 19:11:54 2021 GMT Not After : Feb 17 19:11:53 2022 GMT Subject: CN = mail.{ourdomainnameredacted}.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit)
Logs
Dec 28 09:37:02 0861c46e0a5e dovecot: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 Reproduction
Import certificates from another host that Let's Encrypt, as explained in the documentation.
git diff origin/master shows :
different data/assets/ssl-example/... data/conf/dovecot/dovecot.conf
-#mail_debug = yes -#auth_debug = yes +mail_debug = yes +auth_debug = yes data/conf/postfix/main.cf
myhostname = mail.{ourdomainredactedhere}.com docker-compose.yml
- sysctls:
- net.core.somaxconn=4096 but this setting is already applied.
System information
uname Linux emails 5.13.19-2-pve #1 SMP PVE 5.13.19-4 (Mon, 29 Nov 2021 12:10:09 +0100) x86_64 GNU/Linux Question Answer My operating system Debian 11.2 Is Apparmor, SELinux or similar active? No Virtualization technlogy (KVM, VMware, Xen, etc - LXC and OpenVZ are not supported LXC With full control over the Kernel settings and host Server/VM specifications (Memory, CPU Cores) 4 vCores, 6Gb RAM Docker Version (docker version) 20.10.12 Docker-Compose Version (docker-compose version) 1.29.2 Reverse proxy (custom solution) Nginx on another machine, but the issue exists with direct access via IP address Output of git diff origin/master, any other changes to the code? If so, see above. All third-party firewalls and custom iptables rules are unsupported. Please check the Docker docs about how to use Docker with your own ruleset. Nevertheless, iptabels output can help us to help you: iptables -L -vn, ip6tables -L -vn, iptables -L -vn -t nat and ip6tables -L -vn -t nat. We do not have custom rules, other services running on this machine, nor have we modified mailcow's IP addresses or ranges.
@emails:/opt/mailcow-dockerized# iptables -L -vn
Warning: iptables-legacy tables present, use iptables-legacy to see them
Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
195K 181M DOCKER-USER all -- 0.0.0.0/0 0.0.0.0/0
195K 181M DOCKER-ISOLATION-STAGE-1 all -- 0.0.0.0/0 0.0.0.0/0
125K 178M ACCEPT all -- br-mailcow 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 207 13083 DOCKER all -- br-mailcow 0.0.0.0/0 0.0.0.0/0
69576 3153K ACCEPT all -- br-mailcow !br-mailcow 0.0.0.0/0 0.0.0.0/0
206 13023 ACCEPT all -- br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 DOCKER all -- docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
Chain DOCKER (2 references) pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.249 tcp dpt:6379 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.8 tcp dpt:3306 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.9 tcp dpt:8983 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:587 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:465 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:25 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:12345 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:4190 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:995 1 60 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:993 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:143 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:110 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.13 tcp dpt:443 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.13 tcp dpt:80Chain DOCKER-ISOLATION-STAGE-1 (1 references) pkts bytes target prot opt in out source destination
69576 3153K DOCKER-ISOLATION-STAGE-2 all -- br-mailcow !br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
529K 474M RETURN all -- 0.0.0.0/0 0.0.0.0/0Chain DOCKER-ISOLATION-STAGE-2 (2 references) pkts bytes target prot opt in out source destination
0 0 DROP all -- br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- docker0 0.0.0.0/0 0.0.0.0/0
171K 7810K RETURN all -- 0.0.0.0/0 0.0.0.0/0Chain DOCKER-USER (1 references) pkts bytes target prot opt in out source destination
529K 474M RETURN all -- 0.0.0.0/0 0.0.0.0/0
emails:/opt/mailcow-dockerized# iptables -L -vn -t natWarning: iptables-legacy tables present, use iptables-legacy to see them
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
54 3240 DOCKER all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCALChain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
0 0 DOCKER all -- 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCALChain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
229 16377 MASQUERADE all -- !br-mailcow 172.22.1.0/24 0.0.0.0/0
0 0 MASQUERADE all -- !docker0 172.17.0.0/16 0.0.0.0/0
0 0 MASQUERADE tcp -- 172.22.1.249 172.22.1.249 tcp dpt:6379 0 0 MASQUERADE tcp -- 172.22.1.8 172.22.1.8 tcp dpt:3306 0 0 MASQUERADE tcp -- 172.22.1.9 172.22.1.9 tcp dpt:8983 0 0 MASQUERADE tcp -- 172.22.1.253 172.22.1.253 tcp dpt:587 0 0 MASQUERADE tcp -- 172.22.1.253 172.22.1.253 tcp dpt:465 0 0 MASQUERADE tcp -- 172.22.1.253 172.22.1.253 tcp dpt:25 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:12345 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:4190 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:995 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:993 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:143 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:110 0 0 MASQUERADE tcp -- 172.22.1.13 172.22.1.13 tcp dpt:443 0 0 MASQUERADE tcp -- 172.22.1.13 172.22.1.13 tcp dpt:80Chain DOCKER (2 references) pkts bytes target prot opt in out source destination
0 0 RETURN all -- br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- docker0 0.0.0.0/0 0.0.0.0/0
0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 127.0.0.1 tcp dpt:7654 to:172.22.1.249:6379 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 127.0.0.1 tcp dpt:13306 to:172.22.1.8:3306 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 127.0.0.1 tcp dpt:18983 to:172.22.1.9:8983 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 to:172.22.1.253:587 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:465 to:172.22.1.253:465 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 to:172.22.1.253:25 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 127.0.0.1 tcp dpt:19991 to:172.22.1.250:12345 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:4190 to:172.22.1.250:4190 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:995 to:172.22.1.250:995 1 60 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:993 to:172.22.1.250:993 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:143 to:172.22.1.250:143 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 to:172.22.1.250:110 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:172.22.1.13:443 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:172.22.1.13:80DNS problems? Please run docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254 (set the IP accordingly, if you changed the internal mailcow network) and post the output. 151.101.65.69 151.101.193.69 151.101.1.69 151.101.129.69 I am aware that LXC are not supported, but we have full control over the host (as that seems to be the main concern for not supporting them) and we are applying the required settings to the host's kernel (ie. net.core.somaxconn=4096).
We are more than open to paid support if this was to be considered a support request and not a mailcow issue.
— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you are subscribed to this thread.
AnnoyingTechnology
MAGICCC
DerLinkman
milkmaker
Prior to placing the issue, please check following: (fill out each checkbox with an
Xonce done)Summary
We had a new mailcow install working briefly (with default ssl certificates).
The installation of a custom certificate (issued by Let's Encrypt, but not by acme-mailcow) then prevents dovecot from starting.
600androot:root, as the default provided ones.After restarting the required services (still following the documentation), dovecot is not running and will not start.
dovecot.confdidn't help me diagnose further.Crazy thing : it was broken for the 6 hours of attempted debugging + last night and when collecting logs for this issue just 15min ago, dovecot seems to have finally started after running ?!
I guess this command may play a role in fixing the issue ?
docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254as suggested in the issue template.As following of the guide entails a crashed dovecot, I hope that this issue is legitimate.
Logs
Reproduction
Install mailcow using
SKIP_LETS_ENCRYPT=yandSKIP_CLAMD=uImport certificates from another host that uses Let's Encrypt, as explained in the documentation.
git diff origin/mastershows :data/conf/dovecot/dovecot.confdata/conf/postfix/main.cfdocker-compose.ymlbut this setting is already applied.
System information
Linux emails 5.13.19-2-pve #1 SMP PVE 5.13.19-4 (Mon, 29 Nov 2021 12:10:09 +0100) x86_64 GNU/Linuxdocker version)docker-compose version)git diff origin/master, any other changes to the code? If so, see above.iptables -L -vn,ip6tables -L -vn,iptables -L -vn -t natandip6tables -L -vn -t nat.We do not have custom rules, other services running on this machine, nor have we modified mailcow's IP addresses or ranges.
docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254(set the IP accordingly, if you changed the internal mailcow network) and post the output.I am aware that LXC are not supported, but we have full control over the host (as that seems to be the main concern for not supporting them) and we are applying the required settings to the host's kernel (ie.
net.core.somaxconn=4096).We are more than open to paid support if this was to be considered a support request and not a mailcow issue.