4

I am having a hard time in debugging this error:

Syslog:

Apr 24 06:18:08 abcex opendkim[24223]: abcex: key data is not secure: /etc/opendkim/keys/abcex.private
Apr 24 06:18:08 abcex opendkim[24223]: 28E1C29C5FB: error loading key 'abcex'
pr 24 06:18:08 abcex postfix/cleanup[24394]: A21DE29C5FB: milter-reject: END-OF-MESSAGE from localhost[127.0.0.1]: 4.7.1 Service unavailable - try again later; from=<root@abcex.com> to=<admin@abcex.com>

Here is the output from namei -l /etc/opendkim/keys/abcex.private

drwxr-xr-x root     root     /
drwxr-xr-x root     root     etc
drwxr-xr-x opendkim opendkim opendkim
drwxr-xr-- opendkim opendkim keys
-rwxr-xr-- opendkim opendkim abcex.private

However testing is working fine:

opendkim-testkey -d abcex.com -s 201804 -vvv

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: /etc/opendkim/keys/abcex.private: WARNING: unsafe permissions
opendkim-testkey: key loaded from /etc/opendkim/keys/abcex.private
opendkim-testkey: checking key '201804._domainkey.abcex.com'
opendkim-testkey: key not secure
opendkim-testkey: key OK

Output from dig is also fine

dig 201804._domainkey.abcex.com txt +short

"v=DKIM1; h=sha256; k=rsa; s=email; p=...."

I have looked at similar questions but not finding solutions. I have changed permissions as per OpenDKIM errors.

Also looked at https://sourceforge.net/p/opendkim/support-requests/19/, https://sourceforge.net/p/opendkim/support-requests/13/ but not finding any solution.

Please help.

Optionfan Bob
  • 41
  • 1
  • 1
  • 2

2 Answers2

4

The error message is quite clear "key data is not secure:" which indicates incorrect permissions on the key file, what is confirmed by the output of your ls command: 

-rwxr-xr-- opendkim opendkim abcex.private
       ^
       |__ world readable

Change the permissions for instance to:

chmod 0600 /etc/opendkim/keys/abcex.private
HBruijn
  • 72,524
  • 21
  • 127
  • 192
  • After changing the permissions, getting the same error. Now the permission for key looks like this: -rw------- opendkim opendkim abcex.private – Optionfan Bob Apr 24 '18 at 06:52
  • Hmmm, my opendkim install also has some more restrictive permissions on the keys directory than you do. `drwxr-x--- opendkim opendkim keys` or `chmod 0750 /etc/opendkim/keys` – HBruijn Apr 24 '18 at 06:56
  • Thanks. But it is also not working. It is working if RequireSafeKeys is set as no in /etc/opendkim.conf – Optionfan Bob Apr 24 '18 at 12:23
1

In my case helped only this permission combination

chown -R opendkim:opendkim /etc/opendkim
chmod 0750 /etc/opendkim/keys
chmod 0600 /etc/opendkim/keys/abcex.private
Ruslan Novikov
  • 231
  • 2
  • 8