41

I have problem with postfix on debian after upgrading from squeeze to wheezy. Postfix was configured to sign messages using dkim-filter. Before update, everything was working flawlessly, now it fails on connection with service (tcp or unix sockets). I thought that maybe it was because of debian switch to opendkim, so I removed dkim-filter and installed opendkim - same problem. I even tried setting unix file socket connection instead of tcp option - same problem:

postfix/smtpd: warning: connect to Milter service unix:/var/run/opendkim/opendkim.sock: No such file or directory

or (with tcp/ip):

postfix/cleanup: warning: connect to Milter service inet:localhost:8891: Connection refused

I checked twice - socket file exists and service was listening on port 8891.

What can I do to fix this?

67
  1. Check if opendkim is running. (I assume it is as you saw the socket file.)
  2. Did you configure opendkim? The configuration file is /etc/opendkim.conf.

    You need to update the file to match your site/domain and dkim.key path.

  3. Add postfix to opendkim group

    If opendkim.sock permission is as follow

    $ ls -l /var/run/opendkim
    
    -rw-rw-r-- 1 opendkim opendkim 6 May  2 14:56 opendkim.pid
    srwxrwxr-x 1 opendkim opendkim 0 May  2 14:56 opendkim.sock
    

    If Not, make sure UMask is set to 0002 in /etc/opendkim.conf.

    Then do the following

    sudo adduser postfix opendkim
  4. Postfix running in chroot

    Modify /etc/default/opendkim, change SOCKET option to postfix chroot location

    SOCKET="local:/var/spool/postfix/var/run/opendkim/opendkim.sock"

    You will have to create directory /var/spool/postfix/var/run/opendkim and change its permission

    sudo mkdir -p /var/spool/postfix/var/run/opendkim
    sudo chown opendkim:opendkim /var/spool/postfix/var/run/opendkim
    
  5. Restart opendkim

    sudo service opendkim restart
    
| improve this answer | |
  • 4
    I found a similar problem caused by overly restrictive permissions on the opendkim directory. – Darrell Duane May 17 '15 at 1:18
  • 1
    I'm sure I had opendkim working before, but noticed that it wasn't working after upgrading from Ubuntu 15.04 to 15.10. Updating socket path in /etc/default/opendkim to the same one I had already defined in /etc/opendkim.conf fixed it. Thanks! – Haprog Feb 28 '16 at 11:52
  • my problem is I'm running postfix in chroot and I'm using unix socket. If you see No such file or directory that mean postfix cannot find the path, but it looked for the socket inside /var/spool/postfix/var/run/opendkim/, not /var/run/opendkim – HVNSweeting Feb 8 '17 at 7:36
  • @HVNSweeting Isn't that covered in (4)? – John Siu Feb 9 '17 at 14:46
  • it is, that why I comment and upvoted instead of create new answer. The question contains so many problems, because if opendkim configured properly, then TCP socket should work. Thank you – HVNSweeting Feb 10 '17 at 4:41
14

Quick summary that helped me to fix this warning on Ubuntu 16.04 LTS: Postfix version 3.1.0-3ubuntu0.2 Opendkim version 2.10.3-3build1

  • (I assume that Postfix and Opendkim are already installed, integrated with each other and the only warning you are getting is 'connect to Milter service local:/var/spool/postfix/opendkim/opendkim.sock: No such file or directory')

  • Add user postfix to group opendkim (skip if already done)

sudo adduser postfix opendkim

  • Create directory and set owner (skip if already done)

sudo mkdir -p /var/spool/postfix/var/run/opendkim

sudo chown opendkim:opendkim /var/spool/postfix/var/run/opendkim

  • Check permissions:

ls -l /var/spool/postfix/var/run/opendkim

srwxrwxr-x 1 opendkim opendkim 0 Nov 12 14:34 opendkim.sock
  • Edit opendkim configuration files: /etc/opendkim.conf, add line

Socket local:/var/spool/postfix/var/run/opendkim/opendkim.sock

/etc/defaults/opendkim, add

SOCKET="local:/var/spool/postfix/var/run/opendkim/opendkim.sock"

  • Edit postfix configuration: /etc/postfix/main.cf
# Milter configuration
# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
milter_protocol = 6
milter_default_action = accept
smtpd_milters = unix:var/run/opendkim/opendkim.sock
non_smtpd_milters = unix:var/run/opendkim/opendkim.sock
  • Restart services (or reboot)

systemctl restart opendkim

systemctl restart postfix

That's it. I don't know why it's necessary to write

smtpd_milters = unix:var/run/opendkim/opendkim.sock

instead of

smtpd_milters = local:/var/spool/postfix/var/run/opendkim/opendkim.sock

. If somebody knows, explanations are welcome.

| improve this answer | |
  • 3
    If postfix runs with CHROOT, then the config paths are relative to that. You would end up with postfix trying to resolve /var/spool/postfix/var/spool/postfix/var/run/opendkim/opendkim.sock – darken Jul 15 '18 at 21:05
5

I was facing the same issue on Debian stretch, which turned out to be caused by a broken systemd service file for opendkim. See this answer for a solution: https://serverfault.com/a/847442/84962

This fix boils down to:

/lib/opendkim/opendkim.service.generate
systemctl daemon-reload
service opendkim restart
| improve this answer | |
  • 1
    I have Ubuntu system, where only this advise helped, while everything else did not work. – silpol Dec 20 '17 at 14:08
  • I run 16.04 and /lib/opendkim/opendkim.service.generate doesn't exists – Laurent Nov 13 '18 at 22:29
  • Work fine on Ubuntu 18.04. Thank you. – Duque Dec 4 '18 at 17:22
  • This solved my problem on Debian 9. – jchook Mar 10 '19 at 18:32
2
smtpd_milters = unix:var/run/opendkim/opendkim.sock, unix:var/run/opendmarc/opendmarc.sock
non_smtpd_milters = unix:var/run/opendkim/opendkim.sock, unix:var/run/opendmarc/opendmarc.sock

usermod -G opendkim,opendmarc
| improve this answer | |
  • 5
    This would be a much better answer if it included some explanation of How and Why this answers the question. – Stephen Rauch May 4 '17 at 16:17
  • 3
    Welcome to Unix & Linux! While this code snippet may solve the question, including an explanation really helps to improve the quality of your post. Remember that you are answering the question for readers in the future, not just the person asking now! Please edit your answer to add explanation, and give an indication of what limitations and assumptions apply. – Toby Speight May 4 '17 at 17:53
1

An alternative would be to disable the chroot, this has security implications:

vi /etc/postfix/master.cf

# service type  private unpriv  chroot  wakeup  maxproc command + args
cleanup   unix  n       -       n       -       0       cleanup

The warnings says postfix/cleanup, so you can deactivate the chroot for this service.

| improve this answer | |
0

I had a problem because OpenDKIM and Postfix work with the rights of different users and write and read from the same socket.

I added postfix user to opendkim group:

sudo usermod -a -G opendkim postfix
| improve this answer | |
0

connect to Milter service with error:

unix:/clamav/clamav-milter.ctl: Permission denied

This file:

ls -l /var/spool/postfix/clamav
srw-rw---- 1 clamav clamav 0 Apr  4 17:59 clamav-milter.ctl

shows:

user clamav
MilterSocketGroup postfix
MilterSocketMode 660 

user permissions for the milter

chown postfix:postfix /var/spool/postfix/clamav/clamav-milter.ctl 

Works for me

| improve this answer | |
0

I got this to work by switching from pid to socket. Add the following two statements in respective files then restart both postfix and opendkim

.........Add this single line here regarding the smtpd_milters...

/etc/postfix/main.cf

smtpd_milters = inet:127.0.0.1:8891

Unrelated... Other stuff I have in this file you might need...

non_smtpd_milters = $smtpd_milters milter_default_action = accept milter_protocol = 2 smtp_tls_security_level = may smtp_tls_loglevel = 1 policyd-spf_time_limit = 3600

THEN....... in this file...

/etc/opendkim.conf

Add this line....

Socket inet:8891@localhost

Both lines replacing whatever you had

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.