docker-mailserver: bug report: Test on rspamd private key files not working as expected

I can also confirm this bug. I was on “latest” and got the v13 update overnight. Saw the DKIM permissions/ownership warning in the log, checked outgoing messages, they were not signed anymore. Tried to revert to 12.1.0 but messages were still not signed, tried to revert the changes in dkim_signing config file manually but this also did not solve it. In the end I reverted to yesterdays backup and fixed the version to 12.1, as I unfortunately don’t have the time to debug it today. (DKIM signing works as expected with 12.1) If there is a fix to be tested, I volunteer since I now know my rollback option works fine 😉

Everything worked fine so far and this is the first bug I encountered which is impressive with a project this size 👍 So thanks to you all for your great work!

@polarathene: Thanks, image is ready, DKIM is working. Logfiles still shows Welcome to docker-mailserver 13.0.0 on start 😉

v13.0.1 is released. Sorry for the delay, CI is building the new image release and should be available shortly.

Thank you for the fix! Mails are signed with :edge.

Sorry for the delay; working on PR feedback took longer than anticipated. We want to ship a proper release; I will try to get it done today.

I will provide a PR today (tonight) and release v13.0.1. Keep the outputs of the commands I posted flowing in 😃

root@mail:/etc/rspamd/local.d# more settings.conf 
authenticated {
    priority = high;
    authenticated = yes;
    apply {
        groups_enabled = [dkim];
    }
}
root@mail:/etc/rspamd/local.d# supervisorctl restart rspamd
rspamd: stopped
rspamd: started

Mails are signed.

Good!

(The value of RSPAMD_CHECK_AUTHENTICATED in mailserver.env doesn’t matter, right?)

Yes, no worries 😃

Perfect - I have gathered all data to provide a PR that fixes the two issues posted here.

I assume OpenDKIM is working fine, if anyone can chime in on that? Is it only rspamd dkim support affected in v13?

Were there any other dkim changes for v13.0.0 that might have prevented dkim signing?

There was quite a bit of DKIM related churn, mostly related to rspamd IIRC. v13 was a bit of a long release cycle but the changelog should highlight most of it as either dkim or rspamd changes.

They were meant to be fixes however, and last I knew those affected had confirmed their issues were fixed, with no other concerns raised.

• dkim_signing.conf location was changed: https://github.com/docker-mailserver/docker-mailserver/pull/3597
• Symlink changed to internal copy: https://github.com/docker-mailserver/docker-mailserver/pull/3599

Some other earlier fixes were related to Postfix config for the DKIM milter.

Perhaps we missed a migration concern that you’ve run into, that wouldn’t apply to a fresh install + setup? 😬 (tad tricky for us to test for)

Apologies for the mishap here, when I can find enough time the test suite will get an overhaul which should make it easier to add better test coverage for issues like this.

I have been advocating for simplifying the DKIM management related scripts, since a fair bit of OpenDKIM and Rspamd support is roughly the same logic.

When that support is unified, both will share a common DKIM files location in the config volume, and copy over to an internal location IIRC. Their configs generated at runtime allowing for easy switching.

Staying on v12.1 for now is probably best until someone has time to investigate.

I just noticed this issue on my DMS instance. Nice to see that there is a fix available so quickly! Keep up the good work 👍

Welcome to docker-mailserver 13.0.0 on start 😉

Whoops! Looks like I missed a spot 😬

I’ve addressed that here: https://github.com/docker-mailserver/docker-mailserver/pull/3676

I don’t think it warrants a new patch release, but if anyone does have an issue with the slight inaccuracy with that log message let me know.

When #3666 and #3669 are merged, v13.0.1 will be released as a hotfix.

I knew it - damn. Okay @medebb please do me one more favor (1 sec):

OK, I changed RSPAMD_CHECK_AUTHENTICATED=1 in mailserver.env and restarted the container. Now mails are signed 😃

Ahh, the 600 is still on there, i changed ownership because it was weird. But i forgot that it relates to the user inside the container. So i might have to change it back, just need to know the user id and the group id again for when a fix is released.

Just do it inside your container: docker exec -it mail chown _rspamd:_rspamd /tmp/docker-mailserver/rspamd/dkim/private.key change container name and private key file name

I tested this issue with a fresh installation of dms:

• installing with 1 account - mail can be sent
• configuring dkim - no error in log - mail can be sent but is not signed
• restart container - warning in log - mail can be sent but is not signed

Did switch to rspamd yesterday during upgrade to v13. Tried until midnight to get around the WARN message in the log file about DKIM private key file 😉. I can confirm that my mails aren’t DKIM signed any longer. Thanks for your hard work despite this bug.

Correct me if I am wrong, but my understanding was that this change would produce a warning message only and wouldn’t impact the actual dkim functionality? Were there any other dkim changes for v13.0.0 that might have prevented dkim signing?

Edit: I rolled back to v12.1.0 and dkim signing is definitely working properly there and not in v13.0.0 with the same config.