1

I am having a hard time in debugging this error:

Syslog:

Apr 24 06:18:08 abcex opendkim[24223]: abcex: key data is not secure: /etc/opendkim/keys/abcex.private
Apr 24 06:18:08 abcex opendkim[24223]: 28E1C29C5FB: error loading key 'abcex'
pr 24 06:18:08 abcex postfix/cleanup[24394]: A21DE29C5FB: milter-reject: END-OF-MESSAGE from localhost[127.0.0.1]: 4.7.1 Service unavailable - try again later; from=<root@abcex.com> to=<admin@abcex.com>

Here is the output from namei -l /etc/opendkim/keys/abcex.private

drwxr-xr-x root     root     /
drwxr-xr-x root     root     etc
drwxr-xr-x opendkim opendkim opendkim
drwxr-xr-- opendkim opendkim keys
-rwxr-xr-- opendkim opendkim abcex.private

However testing is working fine:

opendkim-testkey -d abcex.com -s 201804 -vvv

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: /etc/opendkim/keys/abcex.private: WARNING: unsafe permissions
opendkim-testkey: key loaded from /etc/opendkim/keys/abcex.private
opendkim-testkey: checking key '201804._domainkey.abcex.com'
opendkim-testkey: key not secure
opendkim-testkey: key OK

Output from dig is also fine

dig 201804._domainkey.abcex.com txt +short

"v=DKIM1; h=sha256; k=rsa; s=email; p=...."

I have looked at similar questions but not finding solutions. I have changed permissions as per OpenDKIM errors.

Also looked at https://sourceforge.net/p/opendkim/support-requests/19/, https://sourceforge.net/p/opendkim/support-requests/13/ but not finding any solution.

Please help.

1

The error message is quite clear "key data is not secure:" which indicates incorrect permissions on the key file, what is confirmed by the output of your ls command:

-rwxr-xr-- opendkim opendkim abcex.private
       ^
       |__ world readable 

Change the permissions for instance to:

chmod 0600 /etc/opendkim/keys/abcex.private
  • After changing the permissions, getting the same error. Now the permission for key looks like this: -rw------- opendkim opendkim abcex.private – Optionfan Bob Apr 24 '18 at 6:52
  • Hmmm, my opendkim install also has some more restrictive permissions on the keys directory than you do. drwxr-x--- opendkim opendkim keys or chmod 0750 /etc/opendkim/keys – HBruijn Apr 24 '18 at 6:56
  • Thanks. But it is also not working. It is working if RequireSafeKeys is set as no in /etc/opendkim.conf – Optionfan Bob Apr 24 '18 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.