Monit failing to connect to Dovecot over SSL IMAP

Question

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think this may have started after installing some package updates, but I'm not sure when.

Dovecot is working correctly for client connections as email is still working. I've tried testing with open_ssl s_client and all seems fine for SSLv3, TLS1.1 and TLS1.2 from there too.

Dovecot section from /etc/monit/monitrc: check process dovecot with pidfile /run/dovecot/master.pid start program = "/usr/sbin/service dovecot start" stop program = "/usr/sbin/service dovecot stop" if failed port 993 type tcpssl sslauto protocol imap then unmonitor

When I enable monitoring of Dovecot I get this message in /var/log/monit: 'dovecot' failed protocol test [IMAP] at INET[localhost:993] via TCPSSL -- IMAP: error receiving data -- Success

I thought it might be something like this https://secure.kitserve.org.uk/content/ssl-tls-version-conflict-zarafa-monit but I've tried replacing 'sslauto' with all of these options in turn, but with no luck: SSLV2|SSLV3|TLSV1|TLSV11|TLSV12

The Monit documentation I've been referring to is here: http://mmonit.com/monit/documentation/#connection_testing

Thanks in advance

Answer 1

The problem is caused by http://osdir.com/ml/ubuntu-security-announce/2014-05/msg00023.html as TomDogg mentioned.

This forum has more detail: http://comments.gmane.org/gmane.comp.monitoring.monit.general/7378

FYI, the problem is the same even if you try is with POP instead of IMAP.

Here are the possible solutions:

1. Apply these 2 patches or wait for them to be part of the mainstream release:

   http://hg.dovecot.org/dovecot-2.2/rev/09d3c9c6f0ad
   http://hg.dovecot.org/dovecot-2.2/rev/7129fe8bc260

2. Monitor either pop or imap without SSL as Sebastian S mentioned in his answer.

   if failed host localhost port 143 type tcp protocol imap then restart
   

3. Monitor the port only without imap or pop as kexik suggested

   if failed port 993 for 5 cycles then restart
   

Option 1 is the only real solution as the other two force the you to test something different that you were hoping to test, but they do at least easily provide a similar test while you wait for the update.

Answer 2

If you want to monitor dovecot in general, you might consider monitoring port 143 without SSL by using the following configuration:

  if failed host localhost port 143 type tcp protocol imap then restart

Answer 3

Check your version with:

$ monit -V

Replacing sslauto with TLSV11 or TLSV12 is only possible starting 5.8.

(Ubuntu, for example, has only 5.6 in their repo, as of today.)

Find more details about the issue/commit here: https://bitbucket.org/tildeslash/monit/issue/14/monit-33-add-support-for-tlsv11-and-tlsv12

So you can either:

a) force an update of monit to version 5.8 (or above), or

b) force your machine to use an older TLS version, such as SSLV2 or SSLV3 or TLSV1 and keep sslauto in your monit check, or

c) comment out the monit check until your distro has 5.8 available.