Password generation/changing error using dovecot:SHA512-CRYPT

[mykelu]

#0 /usr/local/vimbadmin/vendor/opensolutions/oss-framework/src/OSS/Auth/Password.php(90): ViMbAdmin_Dovecot::password('SHA512-CRYPT', 'xxxxxxxx+', 'xxxxxxxx...')
#1 /usr/local/vimbadmin/application/controllers/MailboxController.php(317): OSS_Auth_Password::hash('xxxxxxxx+', Array)
#2 /usr/local/vimbadmin/vendor/zendframework/zendframework1/library/Zend/Controller/Action.php(516): MailboxController->addAction()
#3 /usr/local/vimbadmin/vendor/zendframework/zendframework1/library/Zend/Controller/Dispatcher/Standard.php(308): Zend_Controller_Action->dispatch('addAction')
#4 /usr/local/vimbadmin/vendor/zendframework/zendframework1/library/Zend/Controller/Front.php(954): Zend_Controller_Dispatcher_Standard->dispatch(Object(Zend_Controller_Request_Http), Object(Zend_Controller_Response_Http))
#5 /usr/local/vimbadmin/vendor/zendframework/zendframework1/library/Zend/Application/Bootstrap/Bootstrap.php(101): Zend_Controller_Front->dispatch()
#6 /usr/local/vimbadmin/vendor/zendframework/zendframework1/library/Zend/Application.php(366): Zend_Application_Bootstrap_Bootstrap->run()
#7 /usr/local/vimbadmin/public/index.php(34): Zend_Application->run()
#8 {main}

[0xFFFFFFFFFFFFFFFF]

i also stumble in this problem, i made a work around(My guess is that the user www-data is running php-fpm process, so it does n have permission to run doveadm).

defaults.mailbox.dovecot_pw_binary = "/usr/bin/sudo /opt/doveadm_pw.sh"

/opt/doveadm_pw.sh

#!/bin/bash
/usr/bin/doveadm pw $@

/etc/sudoers
www-data ALL=(root) NOPASSWD: /opt/doveadm_pw.sh

P.S.: I am unaware of the security implications of using this way. Please if anyone knows a more secure way please point out.

[reissmann]

Same problem here. I'm not sure what exactly is causing this, yet.

I see this message in the apache2 error logfile:

doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 98: No matches

Which is this line:

!include conf.d/*.conf    

Even setting the full path there still results in the same error message.

[reissmann]

Ok, @0xFFFFFFFFFFFFFFFF is completely right about the permission problem - and I have no better idea to solve it :)

However, as long as you only want to use SHA512-CRYPT, you could just configure this:

defaults.mailbox.password_scheme = "crypt:sha512"

[sdellenb]

In my case, this error was caused by SELinux preventing doveadm to access the files in /etc/dovecot.

sudo -u nginx /usr/bin/doveadm pw -s 'SHA512-CRYPT' -u 'something@somewhere.com' -p 'password'
(the command line that's passed by ViMbAdmin) worked fine, so it had to be something else.

/var/log/audit/audit.log (I always check SELinux last 😛) had entries suggesting that doveadm was called from httpd_t context, and not allowed to access the dovecot_etc_t context of the dovecot config files.
This TE file solved it for me:

# doveadm.te
# This module is required to get ViMbAdmin working correctly with the
# dovecot:SHA512-CRYPT password scheme.
# Since it's being called from a httpd_t context, doveadm cannot access
# the dovecot_etc_t context of the config files.
# See also https://github.com/opensolutions/ViMbAdmin/issues/95

module doveadm 1.0;

require {
        type dovecot_etc_t;
        type httpd_t;
        class file { read getattr open };
        class dir read;
}

#============= httpd_t ==============
allow httpd_t dovecot_etc_t:file { read getattr open };
allow httpd_t dovecot_etc_t:dir read;

Compile and install it with

checkmodule -M -m -o doveadm.mod doveadm.te
semodule_package -o doveadm.pp -m doveadm.mod
semodule -i doveadm.pp

And now it's working!