6

This is all on Debian Testing (= Stretch as of now).
I am trying to configure opendkim, but it won't use the socket I want it to.

According to man opendkim.conf, the Socket can be configured in /etc/opendkim.conf.
I have also tried creating the file /etc/default/opendkim as I see it in my Jessie box, but that did not work either.

Thus, I have tried entering the following line in /etc/opendkim.conf:

Socket  inet:39172@localhost

Now, according to /etc/init.d/opendkim, this file is read:

if [ -f /etc/opendkim.conf ]; then
  CONFIG_SOCKET=`awk '$1 == "Socket" { print $2 }' /etc/opendkim.conf`
fi

To me, that looks good so far. But the following snippet, which follows immediately, seems to dump the information that has been read right now:

# This can be set via Socket option in config file, so it's not required
if [ -n "$SOCKET" -a -z "$CONFIG_SOCKET" ]; then
    DAEMON_OPTS="-p $SOCKET $DAEMON_OPTS"
fi

DAEMON_OPTS="-x /etc/opendkim.conf -u $USER -P $PIDFILE $DAEMON_OPTS"

I don't really understand what this is supposed to do. $CONFIG_SOCKET is never actually used to start opendkim, is it? Why is being read from the configuration file in the first place, then?

I noticed there is also a file /etc/systemd/system/multi-user.target.wants/opendkim which does not seem to load any configuration.
If it is of any importance: To restart opendkim, I enter service opendkim restart.

My check to see if the socket has been read is: telnet localhost 39172 says Connection refused and /var/log/syslog says:

 opendkim[8343]: OpenDKIM Filter v2.11.0 starting (args: -P /var/run/opendkim/opendkim.pid -p local:/var/run/opendkim/opendkim.sock)

My question is: How should I be configuring the socket for opendkim on Debian Testing/Stretch?

Which probably also solves the mystery how the script above is supposed to work.

5

You are configuring it correctly, but this is an open bug with Debian Stretch where it ignores configuration:

See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864162

  • 2
    It is encouraged that you summarize content on linked sites in your answer, so that if the link becomes invalid, your answer will still be useful - From Review – John Militer Jun 30 '17 at 2:21
  • For anyone experiencing this in Ubuntu, there's a bug for it as well that you can subscribe to, to know when it's fixed. I've just mentioned the Debian bug (thx, Torrance!) in their bug tracker, hoping it will speed up a fix Ubuntu. bugs.launchpad.net/ubuntu/+source/opendkim/+bug/1697631 – decibyte Apr 18 '18 at 12:38
3

Editing a systemd unit isn't a best practice of course. Here is how we should go:

sudo systemctl edit opendkim

and insert:

[Service]
ExecStart=
ExecStart=/usr/sbin/opendkim -P /var/run/opendkim/opendkim.pid -p local:/var/spool/postfix/opendkim/opendkim.sock

(note the double ExecStart - this is not a typo)

0

I solved this by editing the mentioned file /etc/systemd/system/multi-user.target.wants/opendkim. I don't know if this is best practice, but since the configuration seems to hardcoded there I saw no other choice.

Contents of the file (I am using a unix socket instead of the random port 39172 now):

[...]
ExecStart=/usr/sbin/opendkim -P /var/run/opendkim/opendkim.pid -p local:/var/spool/postfix/var/run/opendkim/opendkim.sock
[...]

The directory /var/spool/postfix/var/run/opendkim needed to be created and given ownership to opendkim:opendkim. After changing the file, I have executed systemctl daemon-reload and service opendkim restart, and the new socket was recognized. Then I changed the permissions (Umask 002 in /etc/opendkim.conf), and postfix can now access the milter.

  • Actually, your answer worked but isn't complete. /etc/systemd/system/multi-user.target.wants/opendkim is a link to /lib/systemd/system/opendkim.service I've understood it's a conf file for systemd services, which can be edited. Your answer worked for opendkim on debian stretch, but I couldn't find the same file for opendmarc; this article about Debian SID Opendmarc Installation and Configuration told me how I could fix my problem. – Tav May 9 '17 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.