"Key Data is Not Secure" log message from OpenDKIM

[Futurama56]

message repeated 71 times: [ XXX.com: key data is not secure: /home/user-data is writeable and owned by uid 1000 which is not the executing uid (110) or the superuser]

Any hints?

[JoshData]

OpenDKIM is the only program complaining about this. I was planning on ignoring it. The threat model for this project assumes all local users are privileged, so it's not really a problem.

[Futurama56]

It would be nice to have a solution, as 71 times will soon become 700,000!

[JoshData]

Do you have RequireSafeKeys false in /etc/opendkim.conf?

[CGeorges]

This warning is still there. I checked /etc/opendkim.conf and RequireSafeKeys is set to false.

[boussou]

@JoshData is right. Tested on Debian 7 it works perfectly

[alpha-and-omega]

Same warning here in 2019, latest stable release. And:

grep RequireSafeKeys /etc/opendkim.conf RequireSafeKeys false

[andyjeffries]

Same error here almost a month later...

# grep RequireSafeKeys /etc/opendkim.conf
RequireSafeKeys         false

Latest release according to the status checks.

[ringe]

Same here. I would like this issue reopened.

[CholoTook]

Do you just need to change a permission somewhere to make this go away?

[CholoTook]

I was wondering about simply changing /home/user-data to be owned by opendkim?

[CholoTook]

zgrep -c "key data is not secure" /var/log/mail.log*
/var/log/mail.log:984
/var/log/mail.log.1:1769
/var/log/mail.log.2.gz:2357
/var/log/mail.log.3.gz:1811
/var/log/mail.log.4.gz:2397

and

grep RequireSafeKeys /etc/opendkim.conf
RequireSafeKeys         false

[myfirstnameispaul]

@CholoTook

Making /home/user-data owned by opendkim means you are effectively putting nearly all of your security into the hands of the OpenDKIM project.

[CholoTook]

Is that good?

On Wed, 3 Jun 2020 at 13:24, Paul [email protected] wrote:

@CholoTook https://github.com/CholoTook

Making /home/user-data owned by opendkim means you are effectively putting nearly all of your security into the hands of the OpenDKIM project.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/mail-in-a-box/mailinabox/issues/125#issuecomment-638162607, or unsubscribe https://github.com/notifications/unsubscribe-auth/ANKSZTXJVZXNJCEE3DHO7Q3RUY6IHANCNFSM4ASOBJJA .

[71GA]

@CholoTook Not at all.

[juank-R]

sudo chmod 600 /etc/opendkim/mail.private

worked for me

[KyleMaas]

I'd also like to see this message silenced when RequireSafeKeys false. I have a use case where another user with very low privileges needs to be able to write keys for OpenDKIM, for security reasons I can't publicly discuss. So it would be nice if it didn't complain about it all the time, since I already explicitly told it that was okay with RequireSafeKeys false.

EDIT: Missing word

[frankofno]

is there a fix for this?

opendkim-testkey: key not secure
opendkim-testkey: key OK

the folder and file permissions are set to:

ls -al /etc/opendkim/ drwx------. 3 opendkim opendkim 4096 Mar 14 00:35 keys

ls -al /etc/opendkim/keys drwx------. 2 opendkim opendkim 4096 Apr 15 19:08 mydomain.tld

ls -al /etc/opendkim/keys/mydomain.tld -rw-------. 1 root root 1704 Apr 15 19:08 20240101.private

[createyourpersonalaccount]

@frankofno if you chown the 20240101.private key to belong to opendkim:opendkim it should be fine.