Re: Spool directories on ext4 with encryption

2018-08-21 Thread Fongaboo
Last night, it would appear that zen.spamhaus.org started blacklisting a number of IPs assigned to Spectrum consumers, of which I am one. When I tried telnetting to port 25 of my mail server and manually sending a message to one of our virtual mailboxes, I got this error: 554 5.7.1 Service

Re: Spool directories on ext4 with encryption

2018-08-20 Thread Christian Rößner
> Am 20.08.2018 um 20:59 schrieb Viktor Dukhovni : > > See http://man7.org/linux/man-pages/man8/e4crypt.8.html > > Access to content is session based, with keys in the session keyring. > This access control model may not be compatible with Postfix running > multiple services under various user i

Re: Spool directories on ext4 with encryption

2018-08-20 Thread Viktor Dukhovni
See http://man7.org/linux/man-pages/man8/e4crypt.8.html Access to content is session based, with keys in the session keyring. This access control model may not be compatible with Postfix running multiple services under various user ids. If you want to use such filesystems, you have to figure out

Re: Spool directories on ext4 with encryption

2018-08-20 Thread Christian Rößner
> Am 20.08.2018 um 18:10 schrieb Wietse Venema : > > Christian Ro??ner: >> What key is the log message talking about? > > Postfix asks the kernel to create a queue file, and the kernel > returns the ENOKEY error code. Postfix is not responsible for > eCryptfs key management. It is ext4 encrypt

Re: Spool directories on ext4 with encryption

2018-08-20 Thread Wietse Venema
Christian Ro??ner: > What key is the log message talking about? Postfix asks the kernel to create a queue file, and the kernel returns the ENOKEY error code. Postfix is not responsible for eCryptfs key management. Maybe there is a problem with the startup order, where Postfix starts before eCrypt

Re: Spool directories on ext4 with encryption

2018-08-20 Thread Christian Rößner
> Am 20.08.2018 um 16:17 schrieb Wietse Venema : > > Christian Ro??ner: >> Aug 20 15:02:34 mx postfix/submission/cleanup[28091]: warning: >> mail_queue_enter: create file incoming/648259.28091: Required >> key not available > > Can you check if the cleanup daemon runs chrooted? > > $ postconf

Re: Spool directories on ext4 with encryption

2018-08-20 Thread Wietse Venema
Christian Ro??ner: > Aug 20 15:02:34 mx postfix/submission/cleanup[28091]: warning: > mail_queue_enter: create file incoming/648259.28091: Required > key not available Can you check if the cleanup daemon runs chrooted? $ postconf -F cleanup/unix/chroot If the output says 'yes' then you may want

Spool directories on ext4 with encryption

2018-08-20 Thread Christian Rößner
Hi, today I tried to use ext4 encryption for /var/spool/postfix* 1. Create static salt with: head -c 16 /dev/urandom | xxd -p >~/tmp-salt.txt echo 0x`cat ~/tmp-salt.txt` >~/.cryptoSalt 2. Adding key: /usr/sbin/e4crypt add_key -S f:/root/.cryptoSalt 3. Stopping postfix 4. Create /var/spool/old 5