Bug #24552 “Bug in courier-imap-ssl: “couriertls: /etc/courier/i...” : Bugs : courier package : Ubuntu

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-24:

#1

Download full text (7.5 KiB)

Message-ID: <email address hidden>
Date: Thu, 20 Oct 2005 14:11:14 -0500
From: Joseph Pingenot <email address hidden>
To: <email address hidden>
Subject: Bug in courier-imap-ssl: "couriertls: /etc/courier/imapd.pem: error:25066067:DSO support
routines:DLFCN_LOAD:could not load the shared library"

--gBBFr7Ir9EOA20Yy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Package: courier-imap-ssl
Version: 3.0.8-11

When attempting to get email (with mutt) via imaps (TLS), I get
"SSL failed; I/O error" in mutt.
On the server, I see

Oct 20 14:05:28 kludge imapd-ssl: couriertls: /etc/courier/imapd.pem: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library

This happened fairly recently (within the last week; I believe around Wednesday
  or Thursday of last week, around the time openssl got upgraded, but I'm
  *not* certain that courier-imap-ssl didn't get upgraded around that time
  too).

I've no idea how to fix this, although I have a very kludgey workaround
(ssh-forwarding the *unencrypted* IMAP port).

Hardware: P2 330MHz, 128MB RAM, plenty of diskspace.
Kernel: 2.6.13.4 vanilla (Linux kludge 2.6.13.4 #2 Mon Oct 17 16:35:08 CDT 2005 i686 GNU/Linux)
More information available upon request.
Configuration file attached.

-Joseph
--
<email address hidden>--------------------------------------------------
Graduate student in physics, Free Software developer.

--gBBFr7Ir9EOA20Yy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=imapd-ssl

##VERSION: $Id: imapd-ssl.dist.in,v 1.10 2004/06/14 00:56:07 mrsam Exp $
#
# imapd-ssl created from imapd-ssl.dist by sysconftool
#
# Do not alter lines that begin with ##, they are used when upgrading
# this configuration.
#
# Copyright 2000 - 2002 Double Precision, Inc. See COPYING for
# distribution information.
#
# This configuration file sets various options for the Courier-IMAP server
# when used to handle SSL IMAP connections.
#
# SSL and non-SSL connections are handled by a dedicated instance of the
# couriertcpd daemon. If you are accepting both SSL and non-SSL IMAP
# connections, you will start two instances of couriertcpd, one on the
# IMAP port 143, and another one on the IMAP-SSL port 993.
#
# Download OpenSSL from http://www.openssl.org/
#
##NAME: SSLPORT:1
#
# Options in the imapd-ssl configuration file AUGMENT the options in the
# imapd configuration file. First the imapd configuration file is read,
# then the imapd-ssl configuration file, so we do not have to redefine
# anything.
#
# However, some things do have to be redefined. The port number is
# specified by SSLPORT, instead of PORT. The default port is port 993.
#
# Multiple port numbers can be separated by commas. When multiple port
# numbers are used it is possibly to select a specific IP address for a
# given port as "ip.port". For example, "127.0.0.1.900,192.68.0.1.900"
# accepts connections on port 900 on IP addresses 127.0.0.1 and 192.68.0.1
# The SSLADDRESS setting is a default for ports that do not have
# a specified IP address.

SSLPORT=993

##NAME: SSLADDRESS:0
#
# Address to listen on, can ...

Message-ID: <20051020191113.GA21445@digitasaru.net>
Date: Thu, 20 Oct 2005 14:11:14 -0500
From: Joseph Pingenot <trelane@digitasaru.net>
To: submit@bugs.debian.org
Subject: Bug in courier-imap-ssl: "couriertls: /etc/courier/imapd.pem: error:25066067:DSO support
	routines:DLFCN_LOAD:could not load the shared library"

--gBBFr7Ir9EOA20Yy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Package: courier-imap-ssl
Version: 3.0.8-11

When attempting to get email (with mutt) via imaps (TLS), I get
  "SSL failed; I/O error" in mutt.
On the server, I see

Oct 20 14:05:28 kludge imapd-ssl: couriertls: /etc/courier/imapd.pem: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library

This happened fairly recently (within the last week; I believe around Wednesday
  or Thursday of last week, around the time openssl got upgraded, but I'm
  *not* certain that courier-imap-ssl didn't get upgraded around that time
  too).

I've no idea how to fix this, although I have a very kludgey workaround
  (ssh-forwarding the *unencrypted* IMAP port).

Hardware: P2 330MHz, 128MB RAM, plenty of diskspace.
Kernel: 2.6.13.4 vanilla (Linux kludge 2.6.13.4 #2 Mon Oct 17 16:35:08 CDT 2005 i686 GNU/Linux)
More information available upon request.
Configuration file attached.

-Joseph
-- 
trelane@digitasaru.net--------------------------------------------------
          Graduate student in physics, Free Software developer.

--gBBFr7Ir9EOA20Yy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=imapd-ssl

##VERSION: $Id: imapd-ssl.dist.in,v 1.10 2004/06/14 00:56:07 mrsam Exp $
#
# imapd-ssl created from imapd-ssl.dist by sysconftool
#
# Do not alter lines that begin with ##, they are used when upgrading
# this configuration.
#
#  Copyright 2000 - 2002 Double Precision, Inc.  See COPYING for
#  distribution information.
#
#  This configuration file sets various options for the Courier-IMAP server
#  when used to handle SSL IMAP connections.
#
#  SSL and non-SSL connections are handled by a dedicated instance of the
#  couriertcpd daemon.  If you are accepting both SSL and non-SSL IMAP
#  connections, you will start two instances of couriertcpd, one on the
#  IMAP port 143, and another one on the IMAP-SSL port 993.
#
#  Download OpenSSL from http://www.openssl.org/
#
##NAME: SSLPORT:1
#
#  Options in the imapd-ssl configuration file AUGMENT the options in the
#  imapd configuration file.  First the imapd configuration file is read,
#  then the imapd-ssl configuration file, so we do not have to redefine
#  anything.
#
#  However, some things do have to be redefined.  The port number is
#  specified by SSLPORT, instead of PORT.  The default port is port 993.
#
#  Multiple port numbers can be separated by commas.  When multiple port
#  numbers are used it is possibly to select a specific IP address for a
#  given port as "ip.port".  For example, "127.0.0.1.900,192.68.0.1.900"
#  accepts connections on port 900 on IP addresses 127.0.0.1 and 192.68.0.1
#  The SSLADDRESS setting is a default for ports that do not have
#  a specified IP address.

SSLPORT=993

##NAME: SSLADDRESS:0
#
#  Address to listen on, can be set to a single IP address.
#
# SSLADDRESS=127.0.0.1

SSLADDRESS=0

##NAME: SSLPIDFILE:0
#
# That's the SSL IMAP port we'll listen on.
# Feel free to redefine MAXDAEMONS, TCPDOPTS, and MAXPERIP.

SSLPIDFILE=/var/run/courier/imapd-ssl.pid

##NAME: IMAPDSSLSTART:0
#
# Different pid files, so that both instances of couriertcpd can coexist
# happily.
#
# You can also redefine AUTHMODULES and IMAP_CAPABILITY, although I can't
# think of why you'd want to do that.
#
#
# Ok, the following settings are new to imapd-ssl:
#
#  Whether or not to start IMAP over SSL on simap port:

IMAPDSSLSTART=YES

##NAME: IMAPDSTARTTLS:0
#
#  Whether or not to implement IMAP STARTTLS extension instead:

IMAPDSTARTTLS=YES

##NAME: IMAP_TLS_REQUIRED:1
#
# Set IMAP_TLS_REQUIRED to 1 if you REQUIRE STARTTLS for everyone.
# (this option advertises the LOGINDISABLED IMAP capability, until STARTTLS
# is issued).

IMAP_TLS_REQUIRED=0

#########################################################################
#
# The following variables configure IMAP over SSL.  If OpenSSL is available
# during configuration, the couriertls helper gets compiled, and upon
# installation a dummy TLS_CERTFILE gets generated.  courieresmtpd will
# automatically advertise the ESMTP STARTTLS extension if both TLS_CERTFILE
# and COURIERTLS exist.
#
# WARNING: Peer certificate verification has NOT yet been tested.  Proceed
# at your own risk.  Only the basic SSL/TLS functionality is known to be
# working. Keep this in mind as you play with the following variables.
#
##NAME: COURIERTLS:0
#

COURIERTLS=/usr/bin/couriertls

##NAME: TLS_PROTOCOL:0
# 
# TLS_PROTOCOL sets the protocol version.  The possible versions are:
#
# SSL2 - SSLv2
# SSL3 - SSLv3
# TLS1 - TLS1

TLS_PROTOCOL=SSL3

##NAME: TLS_STARTTLS_PROTOCOL:0
# 
# TLS_STARTTLS_PROTOCOL is used instead of TLS_PROTOCOL for the IMAP STARTTLS
# extension, as opposed to IMAP over SSL on port 993.
#

TLS_STARTTLS_PROTOCOL=TLS1

##NAME: TLS_CIPHER_LIST:0
#
# TLS_CIPHER_LIST optionally sets the list of ciphers to be used by the
# OpenSSL library.  In most situations you can leave TLS_CIPHER_LIST
# undefined
#
# TLS_CIPHER_LIST="ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH"

##NAME: TLS_TIMEOUT:0
# TLS_TIMEOUT is currently not implemented, and reserved for future use.
# This is supposed to be an inactivity timeout, but its not yet implemented.
#

##NAME: TLS_DHCERTFILE:0
#
# TLS_DHCERTFILE - PEM file that stores our Diffie-Hellman cipher pair.
# When OpenSSL is compiled to use Diffie-Hellman ciphers instead of RSA
# you must generate a DH pair that will be used.  In most situations the
# DH pair is to be treated as confidential, and the file specified by
# TLS_DHCERTFILE must not be world-readable.
#
# TLS_DHCERTFILE=

##NAME: TLS_CERTFILE:0
#
# TLS_CERTFILE - certificate to use.  TLS_CERTFILE is required for SSL/TLS
# servers, and is optional for SSL/TLS clients.  TLS_CERTFILE is usually
# treated as confidential, and must not be world-readable.
#
TLS_CERTFILE=/etc/courier/imapd.pem

##NAME: TLS_TRUSTCERTS:0
#
# TLS_TRUSTCERTS=pathname - load trusted certificates from pathname.
# pathname can be a file or a directory. If a file, the file should
# contain a list of trusted certificates, in PEM format. If a
# directory, the directory should contain the trusted certificates,
# in PEM format, one per file and hashed using OpenSSL's c_rehash
# script. TLS_TRUSTCERTS is used by SSL/TLS clients (by specifying
# the -domain option) and by SSL/TLS servers (TLS_VERIFYPEER is set
# to PEER or REQUIREPEER).
#
#
# TLS_TRUSTCERTS=

##NAME: TLS_VERIFYPEER:0
#
# TLS_VERIFYPEER - how to verify client certificates.  The possible values of
# this setting are:
#
# NONE - do not verify anything
#
# PEER - verify the client certificate, if one's presented
#
# REQUIREPEER - require a client certificate, fail if one's not presented
#
#
TLS_VERIFYPEER=NONE

##NAME: TLS_CACHE:0
#
# A TLS/SSL session cache may slightly improve response for IMAP clients
# that open multiple SSL sessions to the server.  TLS_CACHEFILE will be
# automatically created, TLS_CACHESIZE bytes long, and used as a cache
# buffer.
#
# This is an experimental feature and should be disabled if it causes
# problems with SSL clients.  Disable SSL caching by commenting out the
# following settings:

TLS_CACHEFILE=/var/lib/courier/couriersslcache
TLS_CACHESIZE=524288

##NAME: MAILDIRPATH:0
#
# MAILDIRPATH - directory name of the maildir directory.
#
#MAILDIRPATH=Maildir
MAILDIRPATH=.Maildir

--gBBFr7Ir9EOA20Yy--

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-24:

#2

Message-ID: <email address hidden>
Date: Mon, 24 Oct 2005 20:55:20 +0200
From: Stefan Hornburg <email address hidden>
To: <email address hidden>
Subject: Merge and reassign courier-ssl problems

reassign 334920 courier-ssl
severity 334920 grave
reassign 335512 courier-ssl
retitle 335512 certificate problem: DLFCN_LOAD:could not load the shared library
severity 333896 grave
merge 334920 335512 333896

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-24:

#3

Marking as duplicate based on debbugs merge (333896,334920)

This bug has been marked as a duplicate of bug 24551.

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-25:

#4

Message-ID: <email address hidden>
Date: Mon, 24 Oct 2005 15:41:41 -0700
From: Steve Langasek <email address hidden>
To: Russel Winder <email address hidden>, <email address hidden>
Subject: Re: Bug#335512: courier-imap-ssl: 2004-10-24 Testing update causes imap ssl to cease working

--sgneBHv3152wZ8jf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

block 335512 by 335271
thanks

On Mon, Oct 24, 2005 at 12:56:59PM +0100, Russel Winder wrote:
> Package: courier-imap-ssl
> Version: 3.0.8-11
> Severity: grave
> Justification: renders package unusable

> I run Debian GNU/Linux Testing. My courier IMAP SSL system was
> working fine. I upgraded this morning 2005-10-24 and now for every
> attempted connection, I get:

> Oct 24 12:26:44 dimen imapd-ssl: couriertls: /etc/courier/imapd.pem:
> error:25066067:DSO support routines:DLFCN_LOAD:could not load the
> shared library

Yes, this error has been reported against several other packages already,
and appears to be a regression in libssl0.9.8. Apologies for not catching
this before it reached testing.

--=20
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
<email address hidden> http://www.debian.org/

--sgneBHv3152wZ8jf
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDXWMlKN6ufymYLloRAtpUAKCP4yWVpCK4wJ/zUAF7Ri+4OqtfLACfTvB2
MtMMsD9L4Inj3ywqSPzu54Q=
=mCO7
-----END PGP SIGNATURE-----

--sgneBHv3152wZ8jf--

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-25:

#5

Message-Id: <email address hidden>
Date: Tue, 25 Oct 2005 09:57:56 +0200
From: Stefan Hornburg <email address hidden>
To: <email address hidden>
Cc: <email address hidden>

tags 333896 + confirmed
tags 334920 + confirmed
tags 335512 + confirmed

--
LinuXia Systems => http://www.linuxia.de/
Expert Interchange Consulting and System Administration
ICDEVGROUP => http://www.icdevgroup.org/
Interchange Development Team

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-26:

#6

Message-Id: <email address hidden>
Date: Tue, 25 Oct 2005 17:33:42 -0700
From: Steve Langasek <email address hidden>
To: <email address hidden>
Subject: unblock 333896 with 335510, unblock 334920 with 335510, unblock 335512 with 335510

# Automatically generated email from bts, devscripts version 2.9.7
unblock 333896 with 335510
unblock 334920 with 335510
unblock 335512 with 335510

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-29:

#7

Message-ID: <email address hidden>
Date: Sat, 29 Oct 2005 06:55:33 +0200 (CEST)
From: Ondrej Jombik <email address hidden>
To: <email address hidden>
Subject: ** PROBLEM alert - lonemountain/IMAPS is CRITICAL ** (fwd)

Hello

Please provide some downgrade package links, this cannot leave in this state.

IMAPS is not working.

Ondrej

--
   /\ Ondrej Jombik - <email address hidden> - http://nepto.sk - ICQ #122428216
  //\\ Platon Group - open source software development - http://platon.sk
  //\\ 10 types of people: those who understand binary & those who do not

---------- Forwarded message ----------
From: <email address hidden>
To: <email address hidden>
Subject: ** PROBLEM alert - lonemountain/IMAPS is CRITICAL **
Date: Sat, 29 Oct 2005 05:35:07 +0200 (CEST)

***** Nagios *****

Notification Type: PROBLEM

Service: IMAPS
Host: lonemountain
Address: 1.2.3.4
State: CRITICAL

Date/Time: Sat Oct 29 05:35:07 CEST 2005

Additional Info:

CRITICAL - Cannot make SSL connection

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-29:

#8

Message-Id: <email address hidden>
Date: Sat, 29 Oct 2005 08:33:25 +0200
From: Stefan Hornburg <email address hidden>
To: Ondrej Jombik <email address hidden>, <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#334920: ** PROBLEM alert - lonemountain/IMAPS is CRITICAL
** (fwd)

On Sat, 29 Oct 2005 06:55:33 +0200 (CEST)
Ondrej Jombik <email address hidden> wrote:

> Hello
>
> Please provide some downgrade package links, this cannot leave in this state.
>
> IMAPS is not working.

Just create a symbolic link libz.so in /usr/lib pointing to libz.so.1

Bye
Racke

--
LinuXia Systems => http://www.linuxia.de/
Expert Interchange Consulting and System Administration
ICDEVGROUP => http://www.icdevgroup.org/
Interchange Development Team

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-29:

#9

Message-ID: <email address hidden>
Date: Sat, 29 Oct 2005 09:25:47 +0200 (CEST)
From: Ondrej Jombik <email address hidden>
To: Stefan Hornburg <email address hidden>
cc: <email address hidden>
Subject: Re: Bug#334920: ** PROBLEM alert - lonemountain/IMAPS is CRITICAL
** (fwd)

On Sat, 29 Oct 2005, Stefan Hornburg wrote:

>> Please provide some downgrade package links, this cannot leave in
>> this state. IMAPS is not working.
> Just create a symbolic link libz.so in /usr/lib pointing to libz.so.1

Thank you very much, your help is very appreciated.

It works!

Ondrej

--
   /\ Ondrej Jombik - <email address hidden> - http://nepto.sk - ICQ #122428216
  //\\ Platon Group - open source software development - http://platon.sk
  //\\ 10 types of people: those who understand binary & those who do not

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-29:

#10

Message-ID: <email address hidden>
Date: Sat, 29 Oct 2005 11:29:16 +0200
From: Lubomir Host <email address hidden>
To: <email address hidden>
Subject: another fix

Hi!

Here is another quickfix solution. Sorry, some content is in Slovak
language, but shell commands are language independent:

http://lists.linux.sk/pipermail/linux/2005-October/036291.html

Just create simlinks in libssl library.

rajo

--
Lubomir Host 'rajo' <rajo AT platon.sk> ICQ #: 257322664 ,''`.
Platon Software Development Group http://platon.sk/ : :' :
Homepage: http://rajo.platon.sk/en/references `. `'
http://www.gnu.org/philosophy/no-word-attachments.html `-

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-30:

#11

Message-ID: <email address hidden>
Date: Sun, 30 Oct 2005 17:28:47 +0100
From: Kurt Roeckx <email address hidden>
To: <email address hidden>
Subject: Re: dovecot-imapd does not load shared libraries or ssl certs

reassign 336140 libpq4
block 333896 by 336140
block 334920 by 336140
block 335512 by 336140
unblock 333896 by 335271
unblock 334920 by 335271
unblock 335512 by 335271
merge 336140 334180
thanks

I hope this does it.

Kurt

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-11-02:

#12

Message-ID: <email address hidden>
Date: Wed, 2 Nov 2005 20:27:06 +0100
From: Kurt Roeckx <email address hidden>
To: <email address hidden>
Cc: <email address hidden>
Subject: Re: courier-imap-ssl: DSO support routines:DLFCN_LOAD:could not load the shared library"

reassign 334920 libssl0.9.8 0.9.8-1
close 334920 0.9.8a-3
thanks

I believe all those (merged) bugs should have been fixed by the
new openssl (libssl0.9.8) 0.9.8a-3 upload. Not really sure about
#333896 though.

Please let me know if there are any problems left.

Kurt

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-11-03:

#13

Message-Id: <email address hidden>
Date: Thu, 3 Nov 2005 10:30:38 +0100
From: Stefan Hornburg <email address hidden>
To: Kurt Roeckx <email address hidden>, <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#334920: courier-imap-ssl: DSO support
routines:DLFCN_LOAD:could not load the shared library"

On Wed, 2 Nov 2005 20:27:06 +0100
Kurt Roeckx <email address hidden> wrote:

> reassign 334920 libssl0.9.8 0.9.8-1
> close 334920 0.9.8a-3
> thanks
>
> I believe all those (merged) bugs should have been fixed by the
> new openssl (libssl0.9.8) 0.9.8a-3 upload. Not really sure about
> #333896 though.

#333896 is most likely the same as the other ones.

Bye
Racke

--
LinuXia Systems => http://www.linuxia.de/
Expert Interchange Consulting and System Administration
ICDEVGROUP => http://www.icdevgroup.org/
Interchange Development Team

Affects		Status	Importance	Assigned to	Milestone
	courier (Debian)	Fix Released	Unknown	debbugs #334920
	courier (Ubuntu)	Invalid	High	Unassigned

Ubuntu
courier package

Bug in courier-imap-ssl: "couriertls: /etc/courier/imapd.pem: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library"

Bug Description

Other bug subscribers

Remote bug watches

Ubuntucourier package

Bug in courier-imap-ssl: "couriertls: /etc/courier/imapd.pem: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library"

Bug Description

Other bug subscribers

Remote bug watches

Ubuntu
courier package