3

In order to use Exim's dovecot authentication, I need to bridge two unix sockets in two different machines: the exim server and the dovecot one.

To do so I'm using socat:

eximserver# socat UNIX-LISTEN:/run/exim4/auth-client,fork,group=Debian-exim,mode=660 OPENSSL:10.10.20.5:9999,cert=/etc/ssl/certs/eximserver.pem,key=/etc/ssl/private/eximserver.key,cafile=/etc/ssl/certs/dovecotserver.pem,commonname=dovecotserver

dovecotserver# socat OPENSSL-LISTEN:9999,reuseaddr,fork,cert=/etc/ssl/certs/dovecotserver.pem,key=/etc/ssl/private/dovecotserver.key,bind=10.10.20.5,cafile=/etc/ssl/certs/eximserver.pem UNIX:/run/dovecot/auth-client

It works like a charm. Exim connects to dovecot throught the local /run/exim4/auth-client unix socket, which is connected via TCP/IP through a crypted connection to the other end, where it's connected to /run/dovecot/auth-client socket unix.

Now, I'd like to run socat as a systemd service to run it automatically after dovecot starts, so I wrote this systemd unit:

# /etc/systemd/system/dovecot-auth-bridge.service
[Unit]
Description=Dovecot auth bridge
After=dovecot.service
Requires=dovecot.service

[Service]
ExecStart=socat OPENSSL-LISTEN:9999,reuseaddr,fork,cert=/etc/ssl/certs/dovecotserver.pem,key=/etc/ssl/private/dovecotserver.key,bind=10.10.20.5,cafile=/etc/ssl/certs/eximserver.pem UNIX:/run/dovecot/auth-client
Type=forking

[Install]
WantedBy=multi-user.target

However, I keep getting a timeout error whenever I try to start the service:

dovecotserver# systemctl start dovecot-auth-bridge.service
Job for dovecot-auth-bridge.service failed because a timeout was exceeded.
See "systemctl status dovecot-auth-bridge.service" and "journalctl -xe" for details.

dovecotserver# # systemctl status dovecot-auth-bridge.service
● dovecot-auth-bridge.service - Dovecot auth bridge
   Loaded: loaded (/etc/systemd/system/dovecot-auth-bridge.service; disabled; vendor preset: enabled)
   Active: failed (Result: timeout) since Wed 2021-07-14 09:38:42 CEST; 28s ago
  Process: 13251 ExecStart=/usr/bin/socat OPENSSL-LISTEN:9999,reuseaddr,fork,cert=/etc/ssl/certs/dovecotserver.pem,key=/etc/ssl/private/dovecotserver.key,bind=10.10.20.5,cafile=/etc/ssl/certs/eximserver.pem UNIX:/run/dovecot/auth-client (code=exited, status=143)

Jul 14 09:37:12 Dovecotserver systemd[1]: Starting Dovecot auth bridge...
Jul 14 09:38:42 Dovecotserver systemd[1]: dovecot-auth-bridge.service: Start operation timed out. Terminating.
Jul 14 09:38:42 Dovecotserver systemd[1]: dovecot-auth-bridge.service: Control process exited, code=exited, status=143/n/a
Jul 14 09:38:42 Dovecotserver systemd[1]: dovecot-auth-bridge.service: Failed with result 'timeout'.
Jul 14 09:38:42 Dovecotserver systemd[1]: Failed to start Dovecot auth bridge.

I feel there's a problem because socat doesn't go to background, but keeps running in foreground, so the service fails after a minute or so because of the timeout.

Maybe I should wrap the socat command in a shell script to run it in the background like this:

# /usr/local/bin/dovecot-auth-bridge.sh
#!/bin/bash
/usr/bin/socat OPENSSL-LISTEN:9999,reuseaddr,fork,cert=/etc/ssl/certs/dovecotserver.pem,key=/etc/ssl/private/dovecotserver.key,bind=10.10.20.5,cafile=/etc/ssl/certs/eximserver.pem UNIX:/run/dovecot/auth-client &

Nonetheless, I wonder whether there's a better way to do it.

Regards,

1 Answer 1

2

I truly apologise. I found the answer to my question right after posting the question. The thing was that socat tried to open stdout for writing. I have edited the unit file like follows:

# /etc/systemd/system/dovecot-auth-bridge.service
[Unit]
Description=Dovecot auth bridge
After=dovecot.service
Requires=dovecot.service

[Service]
Type=simple
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=dovecot-auth-bridge

ExecStart=socat -d -d OPENSSL-LISTEN:9999,reuseaddr,fork,cert=/etc/ssl/certs/dovecotserver.pem,key=/etc/ssl/private/dovecotserver.key,bind=10.10.20.5,cafile=/etc/ssl/certs/eximserver.pem UNIX:/run/dovecot/auth-client
Restart=always

[Install]
WantedBy=multi-user.target

Now the service starts inmediately. The output is written to the journal.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .