Sendmail client error

[shishkin]

Subject of the issue

I'm unable to get vaultwarden to send a test email using sendmail command.

Deployment environment

Versions

Server Installed
Server Latest
1.30.5
Web Installed
2023.10.0
Web Latest
2024.1.2b
Database
SQLite: 3.44.0

Checks

OS/Arch
linux / aarch64
Running within Docker
No
Environment settings overridden
Yes
Uses a reverse proxy
Yes
IP header Match
Config/Server: X-Real-IP
Internet access Ok
Yes
Internet access via a proxy
No
DNS (github.com)
20.201.28.151
Date & Time (Local)
Server: 2024-03-08 18:31:29 +01:00
Date & Time (UTC) Server/Browser Ok Server NTP Ok Browser NTP Ok
NTP: 2024-03-08 17:31:29 UTC Server: 2024-03-08 17:31:29 UTC Browser: 2024-03-08 17:31:29 UTC
Domain configuration Match HTTPS
Server: https://vault.example.org/admin/diagnostics Browser: https://vault.example.org/admin/diagnostics

• Install method: vaultwarden service on NixOS

• Other relevant details:

I have installed nullmailer service on NixOS and configured vaultwarden systemd unit according to https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration#using-sendmail-without-docker. User vaultwarden added to nullmailer group.

Systemd unit generated by nixos:

[Unit]
After=network.target nullmailer.service

[Service]
Environment="LOCALE_ARCHIVE=/nix/store/njw85hk2qpsri7b0js2sl4ngn3pn4vbc-glibc-locales-2.38-44/lib/locale/locale-archive"
Environment="PATH=/nix/store/6cdz0jqlhzf1f9n7z4385qp1w2i07syk-openssl-3.0.13-bin/bin:/nix/store/b6zx4l1fckzxh2rvgdriv212ashc089c-nullmailer-2.2/bin:/nix/store/k6h0vjh342kqlkq69sxjj8i5y50l6jfr-coreutils-9.3/bin:/nix/store/1mlygd55wv1wb2a524aa72lgl8mi4346-findutils-4.9.0/bin:/nix/store/h0bg57s9kl87jh5175zjscaf70wmshra-gnugrep-3.11/bin:/nix/store/f41vw9g59504hkbmxhz04gbr1vl6bviy-gnused-4.9/bin:/nix/store/0jl30l5q1xf26pfh1pzyvm33gjpg5qwy-systemd-254.6/bin:/nix/store/6cdz0jqlhzf1f9n7z4385qp1w2i07syk-openssl-3.0.13-bin/sbin:/nix/store/b6zx4l1fckzxh2rvgdriv212ashc089c-nullmailer-2.2/sbin:/nix/store/k6h0vjh342kqlkq69sxjj8i5y50l6jfr-coreutils-9.3/sbin:/nix/store/1mlygd55wv1wb2a524aa72lgl8mi4346-findutils-4.9.0/sbin:/nix/store/h0bg57s9kl87jh5175zjscaf70wmshra-gnugrep-3.11/sbin:/nix/store/f41vw9g59504hkbmxhz04gbr1vl6bviy-gnused-4.9/sbin:/nix/store/0jl30l5q1xf26pfh1pzyvm33gjpg5qwy-systemd-254.6/sbin"
Environment="TZDIR=/nix/store/h61j4lsxw9jpzqbjassciqjkwh55w2ip-tzdata-2024a/share/zoneinfo"
AmbientCapabilities=CAP_NET_BIND_SERVICE
EnvironmentFile=/nix/store/1rk11vyfnd5rh0fg2x7sqy3525qwqji4-vaultwarden.env
EnvironmentFile=/var/lib/bitwarden_rs/secrets.env
ExecStart=/nix/store/f8b5r5dikrxlfvz1gz81jn01isd63fci-vaultwarden-1.30.1/bin/vaultwarden
Group=vaultwarden
LimitNOFILE=1048576
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/var/spool/nullmailer/queue/
Restart=always
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_LOCAL AF_NETLINK
StateDirectory=bitwarden_rs
StateDirectoryMode=0700
User=vaultwarden

Steps to reproduce

Go to admin page -> SMTP Email Settings -> Send test email

Expected behaviour

Expect email to be sent successfully.

Actual behaviour

Error sending SMTP test email
Sendmail client error: internal client error: nullmailer-inject: nullmailer-queue failed: 1

Troubleshooting data

I'm able to run echo "Subject: sendmail test" | sudo -u vaultwarden sendmail -v [email protected] and get the email.
vaultwarden log has the same error message as in the admin page alert.

Any help troubleshooting the issue is very much appreciated.

[stefan0xC]

ReadWritePaths=/var/spool/nullmailer/queue/

Are you sure that this is the only directory that needs to be writable? Can you try with /var/spool/nullmailer?

[shishkin]

Thanks for the suggestion @stefan0xC! Indeed, this helped to move forward. Now vaultwarden reports successful send.

However, nullmailer is unable to pickup the email created by vaultwarden because it has 600 permissions and is owned by vaultwarden user with vaultwarden group:

# ls -la /var/spool/nullmailer/queue/
total 28
drwxrws--- 2 nullmailer  nullmailer   4096 Mar 11 14:05 .
drwxr-xr-x 5 nullmailer  nullmailer   4096 Mar 11 14:04 ..
-rw------- 1 vaultwarden vaultwarden 18112 Mar 11 14:05 1710162305.73815

What is strange, is that even setting chmod g+s on the queue directory doesn't seem to have effect. And I also don't understand how vaultwarden user identity is used despite the sendmail having setuid and setgid bits set and vaultwarden user being in the nullmailer group 🤷‍♂️

# ls -la /run/wrappers/bin/sendmail
-r-s--s--x 1 nullmailer nullmailer 149896 Mar 11 13:25 /run/wrappers/bin/sendmail

[lorenzleutgeb]

@shishkin were you able to resolve this? I am also trying to configure Vaultwarden with nullmailer on NixOS, so it'd be great if you could share a *.nix snippet! Thanks!

[shishkin]

@lorenzleutgeb unfortunately, not. I've configured the real mail server in vaultwarden for now.

[bwlang]

I was able to get outgoing mail working with this config:

  services.vaultwarden = {
    enable = true;
    # Store your variables like admin password here
    environmentFile = "/root/vaultwarden/.env";
    config = {
      SIGNUPS_ALLOWED = false;
      DOMAIN = "https://vault.example.org";
      USE_SENDMAIL = true;
      SENDMAIL_COMMAND = "/run/wrappers/bin/sendmail";
      SMTP_FROM = "[email protected]";
      ROCKET_PORT = 8222;
    };
  };
  systemd.services.vaultwarden = {
    serviceConfig = {
      ReadWritePaths = [ "/var/spool/nullmailer/" ];
    };
  };