error ssh_dh=</path/to/dh.pem

[mikysal78]

• Distribution: Debian
• Codename: Buster.
• Arch: 64 Bits
• Database: MySQL

Log mail.err

root@mx:log # more mail.err
Jan 27 00:31:53 mx dovecot: imap-login: Error: Diffie-Hellman key exchange requested, but no DH parameters provided. Set ssh_dh=</path/to/dh.pem

[tonioo]

@mikysal78 Looks like this setting is available starting with dovecot 2.3.

[Kedakai]

No!

This output is wrong.
The option is called ssl_dh not as printed ssh_dh.

Someone made a mistake there that still isn't fixed.

[almereyda]

Yes, we should include DH parameters for Dovecot as well, as done for Postfix and Nginx already:

• https://doc.dovecot.org/settings/core/#core_setting-ssl_dh

Postfix:

modoboa-installer/modoboa_installer/scripts/postfix.py

Lines 89 to 91 in 33a909a

	# Generate EDH parameters
	if not os.path.exists("{}/dh2048.pem".format(self.config_dir)):
	cmd = "openssl dhparam -dsaparam -out dh2048.pem 2048"

modoboa-installer/modoboa_installer/scripts/files/postfix/main.cf.tpl

Line 44 in 7f87c25

smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem

Nginx:

modoboa-installer/modoboa_installer/scripts/nginx.py

Lines 88 to 89 in 33a909a

	if not os.path.exists("{}/dhparam.pem".format(self.config_dir)):
	cmd = "openssl dhparam -dsaparam -out dhparam.pem 4096"

modoboa-installer/modoboa_installer/scripts/files/nginx/modoboa.conf.tpl

Line 25 in 58f5a8a

ssl_dhparam /etc/nginx/dhparam.pem;

A reference to the ssl_dh parameter is missing entirely in the Dovecot-associated installer files.

• https://github.com/modoboa/modoboa-installer/blob/master/modoboa_installer/scripts/dovecot.py
• https://github.com/modoboa/modoboa-installer/blob/master/modoboa_installer/scripts/files/dovecot/dovecot.conf.tpl
• https://github.com/modoboa/modoboa-installer/blob/master/modoboa_installer/scripts/files/dovecot/conf.d/10-ssl.conf.tpl

I'd suggest to add parameter generation logic to dovecot.py, and reference this file through ssl_dh in 10-ssl.conf.tpl.