You will need to read the documentation for that lyris and those other tools to see how they manipulate the filesystem and see if you can exempt the SOGo install files from that. I looks like those tools have some settings in /etc/ that ensure binaries are chmod-ed to some values upon installation. I don't know IF SOGo installs any files with some special permissions set (like setuid, etc). On my system, the binaries install by SOGo have the usual executable bit: ``` root@debianPC:/# locate in/sogo | xargs -n1 ls -al -rwxr-xr-x 1 root root 1386 Dec 31 13:33 /usr/sbin/sogo-backup -rwxr-xr-x 1 root root 42656 Dec 31 13:33 /usr/sbin/sogo-ealarms-notify -rwxr-xr-x 1 root root 44336 Dec 31 13:33 /usr/sbin/sogo-slapd-sockd -rwxr-xr-x 1 root root 332792 Dec 31 13:33 /usr/sbin/sogo-tool -rwxr-xr-x 1 root root 84432 Dec 31 13:33 /usr/sbin/sogod root@debianPC:/# ``` If your hardening changes things on your system, perhaps you need to reverse all that? Look at the scripts and ensure you understand the consequences of the changes they make and limit some of those changes.
On Thu, Jan 22, 2026 at 12:33 PM "Oli Z." <[email protected]> wrote: > A little update. I installed sogo on my debian workstation, copied all > the configs and database stuff over to my workstation and it worked > nearly out of the box (with mariadb only, will test later with mixed > postgresql and mariadb). So whatever is blocking on the server must be > some sort of security configuration i did about 5 years ago. It is NOT: > > - a database problem > - a configuration problem > - a sogo bug > > The question is: how can i find out what is blocking this? IIRC i used > lynis and some other tools to scan the server and harden it as much as > possible. E.g. my umask is set to 0027 > > Am 20.01.26 um 15:09 schrieb Oli Z.: > > It is installed cleanly, the only thing that is "not clean" is the > > configuration file (sogo.conf), the apache2 config and the database > > configuration. > > > > I also highly doubt that it has anything to do with the database, > > because i see nothing related in any way with the database. If it > > would be anything related with the database, i would have expect a > > very different error when i was debugging with qhivert. > > > > MariaDB [postfixadmin]> describe sogo_mailbox; > > +------------+--------------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +------------+--------------+------+-----+---------+-------+ > > | c_uid | varchar(255) | NO | | NULL | | > > | c_name | varchar(255) | NO | | NULL | | > > | c_cn | varchar(255) | NO | | NULL | | > > | mail | varchar(255) | NO | | NULL | | > > | c_password | varchar(255) | NO | | NULL | | > > +------------+--------------+------+-----+---------+-------+ > > 5 rows in set (0,001 sec) > > > > My "users"-table is called "mailbox" inside the postfixadmin database. > > > > MariaDB [postfixadmin]> select * from mailbox where username = > > '[email protected]'; > > > +------------------------------------+--------------------------------------------------------------------------------------------------------------------------+-----------------+-------------------------------------+-----------+-----------------------+--------------+---------------------+---------------------+--------+-------+-------------------+-------+---------------------+---------------------+ > > > > > | username | password | name > > | maildir | quota | local_part | > > domain | created | modified | active | phone | > > email_other | token | token_validity | password_expiry | > > > +------------------------------------+--------------------------------------------------------------------------------------------------------------------------+-----------------+-------------------------------------+-----------+-----------------------+--------------+---------------------+---------------------+--------+-------+-------------------+-------+---------------------+---------------------+ > > > > > | [email protected] | > > {SHA512-CRYPT}$6$xxx.$24.xxx.xxx.v9Aa0 | | > > mydomain.de/test/ | 0 | test | > > mydomain.de | 2015-11-24 16:36:20 | 2021-01-15 16:12:15 | 1 | | > > [email protected] | | 2000-01-01 00:00:00 | 2000-01-01 00:00:00 | > > > > When i find some time i might try it on my workstation and not on the > > productive server, to set up everything and test further/again. I also > > wrote qhivert, maybe he has a clue whats going on. > > > > Am 20.01.26 um 10:47 schrieb Washington Odhiambo ([email protected]): > >> How about you wipe clean everything to do with SOGo and install it > >> cleanly? > >> Also, can you please share the output of 'select * from users' > >> (hoping your table that stores the usernames, passwords is called > >> users). Remember to mask the sensitive details. > >> Also the output of 'describe sogo_auth_view' or whatever you called it. > >> If it's working on mine, I suppose it should work on yours. > >> PS: Sorry, I couldn't look over the whole thread again for the above > >> details. It's already 36 thread elements. > >> > >> > >> On Tue, Jan 20, 2026 at 12:39 PM "Oli Z." <[email protected]> wrote: > >> > >> So the error is something else that is going wrong. Because there > >> is no > >> error in the log, except the error deep in the application that > >> leads to > >> the http 500, after i logged in successfuly. I hope someone from > >> Alinto > >> can take a look at that. > >> > >> Am 19.01.26 um 14:01 schrieb Washington Odhiambo > >> ([email protected]): > >> > For all the required fields, you'll see an error in sogo.log if > >> they > >> > are missing. > >> > > >> > On Mon, Jan 19, 2026 at 3:44 PM "Oli Z." <[email protected]> wrote: > >> > > >> > Hi, unfortunately that email went into my spam folder > >> because of that > >> > tinyurl link. Thats interesting, so it can not be the > >> objective-c > >> > library anymore. > >> > > >> > My view has c_uid, c_name, c_cn, mail and c_password. Are > >> the other > >> > fields _required_ or are they optional? Because the > >> documentation > >> > only > >> > states those i have as required. > >> > > >> > Am 16.01.26 um 17:46 schrieb Washington Odhiambo > >> ([email protected]): > >> > > Hi Oli, > >> > > > >> > > I installed Postfixadmin and decided to authenticate > >> against it > >> > while > >> > > also using it for SOGo to store its tables. > >> > > > >> > > I have put the configs (sogo.conf, sogo-nginx.conf) and the > >> > sogo.log here: > >> > > https://tinyurl.com/9pdnkcwr > >> > > > >> > > Under that path, you will also find a folder called > >> "Screenshots" > >> > > where you'll see proof that it is truly working. Nothing > >> stops you > >> > > from pointing your SOGoUserSources to your MySQL database, > >> IMHO, as > >> > > long as you create the VIEW there. > >> > > > >> > > Best regards, > >> > > > >> > > PS: The files will be deleted after a few days. > >> > > > >> > > > >> > > > >> > > On Tue, Jan 13, 2026 at 10:57 AM "Oli Z." <[email protected]> > >> wrote: > >> > > > >> > > I also do not use the package from Alinto, i have no > >> > subscription, > >> > > i use > >> > > the official debian packages. Have you been able to > >> authenticate > >> > > against > >> > > that? Can you share the log after successfull > >> authentication? > >> > > > >> > > Am 06.01.26 um 14:04 schrieb Washington Odhiambo > >> > ([email protected]): > >> > > > Please remember, I was responding to Quentin's > >> question about > >> > > "Debian > >> > > > repo directly -> > >> https://packages.debian.org/trixie/sogo"; > >> > > > This package is not from Alinto, as he stated. > >> > > > So in my case I suppose he doesn't need the debug > >> info, > >> > which I > >> > > > believe he only needed for the SOGo packaged by > >> Alinto. > >> > > > > >> > > > root@debianPC:/home/wash/public_html# cat > >> > /etc/apt/sources.list > >> > > > deb http://ftp.us.debian.org/debian trixie main > >> > > > > >> > > > The details you asked for are below: > >> > > > > >> > > > root@debianPC:/home/wash# uname -a > >> > > > Linux debianPC.wash.lan 6.12.57+deb13-amd64 #1 SMP > >> > PREEMPT_DYNAMIC > >> > > > Debian 6.12.57-1 (2025-11-05) x86_64 GNU/Linux > >> > > > > >> > > > root@debianPC:/home/wash# cat /etc/os-release > >> > > > PRETTY_NAME="Debian GNU/Linux 13 (trixie)" > >> > > > NAME="Debian GNU/Linux" > >> > > > VERSION_ID="13" > >> > > > VERSION="13 (trixie)" > >> > > > VERSION_CODENAME=trixie > >> > > > DEBIAN_VERSION_FULL=13.2 > >> > > > ID=debian > >> > > > HOME_URL="https://www.debian.org/"; > >> > > > SUPPORT_URL="https://www.debian.org/support"; > >> > > > BUG_REPORT_URL="https://bugs.debian.org/"; > >> > > > > >> > > > root@debianPC:/home/wash# cat /etc/debian_version > >> > > > 13.2 > >> > > > > >> > > > root@debianPC:/home/wash# dpkg -l | grep -i sogo > >> > > > ii sogo 5.12.1-3 > >> > > > amd64 Scalable groupware > >> > server > >> > > > ii sogo-activesync 5.12.1-3 > >> > > > amd64 Scalable groupware > >> > server - > >> > > > ActiveSync module > >> > > > ii sogo-common 5.12.1-3 > >> > > > all Scalable groupware > >> > server - > >> > > > common files > >> > > > > >> > > > root@debianPC:/home/wash# systemctl status sogo > >> > > > ● sogo.service - SOGo is a groupware server > >> > > > Loaded: loaded > >> (/usr/lib/systemd/system/sogo.service; > >> > enabled; > >> > > > preset: enabled) > >> > > > Active: active (running) since Tue 2026-01-06 > >> > 12:44:26 EAT; 2h > >> > > > 58min ago > >> > > > Invocation: b45caa89337948bda6b8450b3087dfed > >> > > > Docs: > >> > https://sogo.nu/files/docs/SOGoInstallationGuide.html > >> > > > Process: 1270846 ExecStart=/usr/sbin/sogod > >> -WOWorkersCount > >> > > > ${PREFORK} -WOPidFile /run/sogo/sogo.pid -WOLogFile > >> > > > /var/log/sogo/sogo.log (code=exited, status=0/SUCCESS) > >> > > > Main PID: 1270856 (sogod) > >> > > > Tasks: 4 (limit: 4460) > >> > > > Memory: 53M (peak: 55M) > >> > > > CPU: 11.297s > >> > > > CGroup: /system.slice/sogo.service > >> > > > ├─1270856 /usr/sbin/sogod > >> -WOWorkersCount 3 > >> > -WOPidFile > >> > > > /run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log > >> > > > ├─1270858 /usr/sbin/sogod > >> -WOWorkersCount 3 > >> > -WOPidFile > >> > > > /run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log > >> > > > ├─1270859 /usr/sbin/sogod > >> -WOWorkersCount 3 > >> > -WOPidFile > >> > > > /run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log > >> > > > └─1270860 /usr/sbin/sogod > >> -WOWorkersCount 3 > >> > -WOPidFile > >> > > > /run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log > >> > > > > >> > > > Jan 06 12:44:26 debianPC.wash.lan systemd[1]: Starting > >> > > sogo.service - > >> > > > SOGo is a groupware server... > >> > > > Jan 06 12:44:26 debianPC.wash.lan systemd[1]: Started > >> > > sogo.service - > >> > > > SOGo is a groupware server. > >> > > > root@debianPC:/home/wash# > >> > > > > >> > > > root@debianPC:/home/wash/public_html# systemctl stop > >> sogo > >> > > > root@debianPC:/home/wash/public_html# cp /dev/null > >> > > /var/log/sogo/sogo.log > >> > > > root@debianPC:/home/wash/public_html# systemctl > >> start sogo > >> > > > root@debianPC:/home/wash/public_html# less > >> > /var/log/sogo/sogo.log > >> > > > Jan 06 16:01:17 sogod [1358483]: version 5.12.1 -- > >> starting > >> > > > Jan 06 16:01:17 sogod [1358483]: vmem size check > >> enabled: > >> > shutting > >> > > > down app when vmem > 4096 MB. Currently at 94 MB > >> > > > *Jan 06 16:01:17 sogod [1358483]: > >> > > > <0x0x556965133650[SOGoProductLoader]> SOGo products > >> loaded > >> > from > >> > > > '/usr/lib/x86_64-linux-gnu/GNUstep/SOGo':* > >> > > > Jan 06 16:01:17 sogod [1358483]: > >> > > <0x0x556965133650[SOGoProductLoader]> > >> > > > MailPartViewers.SOGo, PreferencesUI.SOGo, > >> CommonUI.SOGo, > >> > > > AdministrationUI.SOGo, MailerUI.SOGo, > >> SchedulerUI.SOGo, > >> > > > ActiveSync.SOGo, Contacts.SOGo, MainUI.SOGo, > >> ContactsUI.SOGo, > >> > > > Mailer.SOGo, Appointments.SOGo > >> > > > Jan 06 16:01:17 sogod [1358483]: All products loaded > >> - current > >> > > memory > >> > > > usage at 102 MB > >> > > > Jan 06 16:01:17 sogod [1358483]: > >> > <0x0x556965156c90[WOWatchDog]> > >> > > > listening on 127.0.0.1:20000 > >> <http://127.0.0.1:20000> <http://127.0.0.1:20000> > >> > <http://127.0.0.1:20000> > >> > > <http://127.0.0.1:20000> > >> > > > Jan 06 16:01:17 sogod [1358483]: > >> > <0x0x556965156c90[WOWatchDog]> > >> > > > watchdog process pid: 1358483 > >> > > > Jan 06 16:01:17 sogod [1358483]: > >> > > <0x0x7fb5de2b20e0[WOWatchDogChild]> > >> > > > watchdog request timeout set to 10 minutes > >> > > > Jan 06 16:01:17 sogod [1358483]: > >> > <0x0x556965156c90[WOWatchDog]> > >> > > > preparing 3 children > >> > > > Jan 06 16:01:17 sogod [1358483]: > >> > <0x0x556965156c90[WOWatchDog]> > >> > > child > >> > > > spawned with pid 1358484 > >> > > > Jan 06 16:01:17 sogod [1358483]: > >> > <0x0x556965156c90[WOWatchDog]> > >> > > child > >> > > > spawned with pid 1358485 > >> > > > Jan 06 16:01:17 sogod [1358483]: > >> > <0x0x556965156c90[WOWatchDog]> > >> > > child > >> > > > spawned with pid 1358486 > >> > > > Jan 06 16:01:22 sogod [1358485]: > >> > <0x0x5569651934a0[WOHttpAdaptor]> > >> > > > notified the watchdog that we are ready > >> > > > Jan 06 16:01:22 sogod [1358486]: > >> > <0x0x5569651934a0[WOHttpAdaptor]> > >> > > > notified the watchdog that we are ready > >> > > > Jan 06 16:01:23 sogod [1358484]: > >> > <0x0x5569651934a0[WOHttpAdaptor]> > >> > > > notified the watchdog that we are ready > >> > > > /var/log/sogo/sogo.log > >> > > > > >> > > > > >> > > > I am using the same. With MySQL for authentication and > >> > > PostgreSQL for > >> > > > SOGo stuff storage. > >> > > > I am using Nginx, not Apache. My Nginx.conf: > >> > > > https://paste.ubuntu.com/p/fDrZtX5FQ5/ > >> > > > My sogo.conf: I already shared it - > >> > > > > >> > > > > >> > > > On Tue, Jan 6, 2026 at 3:36 PM "Oli Z." > >> <[email protected]> wrote: > >> > > > > >> > > > Could you add those debug flags, run it and then > >> send > >> > them to > >> > > > Quentin? > >> > > > IMO this should not be possible that it runs > >> for you > >> > when its a > >> > > > problem > >> > > > in the ObjectiveC-Library. Can you tell me what > >> you > >> > exactly did? > >> > > > How did > >> > > > you install SOGo? > >> > > > > >> > > > Please provide: > >> > > > uname -a > >> > > > dpkg -l | grep -i sogo > >> > > > your apache2 config > >> > > > your sogo config > >> > > > > >> > > > Thanks! > >> > > > > >> > > > Am 06.01.26 um 10:56 schrieb Washington Odhiambo > >> > > ([email protected]): > >> > > > > I tested it on a Debian Trixie VM and it's > >> working > >> > fine - > >> > > so far. > >> > > > > > >> > > > > > >> > > > > > >> > > > > On Mon, Jan 5, 2026 at 6:32 PM qhivert > >> > <[email protected]> wrote: > >> > > > > > >> > > > > Hello, > >> > > > > > >> > > > > After some exchange with Oli and new logs > >> files, > >> > it seems > >> > > > there is > >> > > > > a problem > >> > > > > with a method defined by the gnustep > >> objective-c > >> > > library. I know > >> > > > > there has > >> > > > > been some changes with > >> Gnustep/objective-c in > >> > Debian 13. > >> > > > > > >> > > > > Alinto doesn't provide a Sogo package for > >> Debian 13 > >> > > yet but > >> > > > there > >> > > > > is one in > >> > > > > Debian repo directly -> > >> > > https://packages.debian.org/trixie/sogo > >> > > > > > >> > > > > Has anyone use it successfully ? > >> > > > > > >> > > > > Cheers, > >> > > > > -- > >> > > > > Quentin Hivert || Alinto || R&D Lead > >> Developer > >> > > > > 19 Quai Perrache 69002 Lyon > >> > > > > www.alinto.com <http://www.alinto.com> > >> <http://www.alinto.com> > >> > <http://www.alinto.com> > >> > > <http://www.alinto.com> <http://www.alinto.com> > >> > > > > > >> > > > > -----Original Message----- > >> > > > > From: [email protected] > >> > <[email protected]> On > >> > > Behalf Of > >> > > > > qhivert > >> > > > > Sent: lundi 5 janvier 2026 14:41 > >> > > > > To: [email protected] > >> > > > > Subject: RE: [SOGo] Debian 13 / SOGo / 500 > >> error > >> > > > > > >> > > > > Well, no errors in your log, I've tested > >> your > >> > > sogo.conf and it > >> > > > > works well... > >> > > > > > >> > > > > Either there is something very obvious > >> that I don't > >> > > see, or you > >> > > > > found a very > >> > > > > peculiar bug. > >> > > > > > >> > > > > Put that in your sogo.conf and reproduce the > >> > problem. > >> > > > > > >> > > > > SoObjectRequestHandlerDebugEnabled = YES; > >> > > > > SoSelectorInvocationDebugEnabled = YES; > >> > > > > SoDebugRequestClassification = YES; > >> > > > > SoDebugObjectTraversal = YES; > >> > > > > SOGoDebugRequests = YES; > >> > > > > ImapDebugEnabled = YES; > >> > > > > ImapLogEnabled = YES; > >> > > > > MySQL4DebugEnabled = YES; > >> > > > > SOGoUIxDebugEnabled = YES; > >> > > > > SoObjectMethodDispatcherDebugEnabled = YES; > >> > > > > SoPageInvocationDebugEnabled = YES; > >> > > > > SoRendererDebugEnabled = YES; > >> > > > > WOLogComponents = YES; > >> > > > > WODebugComponentLookup = YES; > >> > > > > WODebugResourceLookup = YES; > >> > > > > SoProductResourceManagerDebugEnabled = YES; > >> > > > > WOResourceURLAssociationDebugEnabled = YES; > >> > > > > WEResourceManagerDebugEnabled = YES; > >> > > > > NGLogDefaultLogLevel = "ALL"; > >> > > > > > >> > > > > Then send me the log directly (not here) > >> in an > >> > attachment > >> > > > file please. > >> > > > > > >> > > > > Regards, > >> > > > > -- > >> > > > > Quentin Hivert || Alinto || R&D Lead > >> Developer > >> > > > > 19 Quai Perrache 69002 Lyon > >> > > > > www.alinto.com <http://www.alinto.com> > >> <http://www.alinto.com> > >> > <http://www.alinto.com> > >> > > <http://www.alinto.com> <http://www.alinto.com> > >> > > > > > >> > > > > -----Original Message----- > >> > > > > From: [email protected] > >> > <[email protected]> On > >> > > Behalf Of > >> > > > > "Oli Z." > >> > > > > Sent: lundi 5 janvier 2026 12:37 > >> > > > > To: [email protected] > >> > > > > Subject: Re: [SOGo] Debian 13 / SOGo / 500 > >> error > >> > > > > > >> > > > > update: it added now that table (empty) > >> after > >> > setting > >> > > > > SOGoEnableEMailAlarms > >> > > > > to YES, but still the same error. > >> > > > > > >> > > > > Am 05.01.26 um 12:17 schrieb "Oli Z." > >> > ([email protected]): > >> > > > > > Thanks, that sounds reasonable, but the > >> > > documentation says > >> > > > this is > >> > > > > > only required if SOGoEnableEMailAlarms > >> is set. > >> > I did not > >> > > > set this > >> > > > > > flag. I added now: > >> > > > > > OCSEMailAlarmsFolderURL = > >> > > > > > > >> > "mysql://xx:xxx@localhost/sogo/sogo_alarms_folder"; > >> > > - and: > >> > > > > > OCSAdminURL = > >> > > "mysql://xx:xxx@localhost/sogo/sogo_admin"; > >> > > > > > > >> > > > > > Because i also found an error because of > >> missing > >> > > OCSAdminURL. > >> > > > > > Unfortunately, the error still exists. It > >> > added now the > >> > > > sogo_admin > >> > > > > > table but not the sogo_alarms_folder > >> > > > > > > >> > > > > > Am 05.01.26 um 10:35 schrieb qhivert > >> > > ([email protected]): > >> > > > > >> Hello, > >> > > > > >> I think the table for alarm is missing in > >> > this case: > >> > > > > >> OCSEMailAlarmsFolderURL > >> > > > > >> > >> > > > > > >> > > > > > >> > > > > > >> > > > > -- > >> > > > > Best regards, > >> > > > > Odhiambo WASHINGTON, > >> > > > > Nairobi,KE > >> > > > > +254 7 3200 0004/+254 7 2274 3223 > >> > > > > In an Internet failure case, the #1 suspect > >> is a > >> > > constant: DNS. > >> > > > > "Oh, the cruft.", egrep -v '^$|^.*#' > >> ¯\_(ツ)_/¯ :-) > >> > > > > [How to ask smart questions: > >> > > > > > >> http://www.catb.org/~esr/faqs/smart-questions.html] > >> > > > > >> > > > > >> > > > > >> > > > -- > >> > > > Best regards, > >> > > > Odhiambo WASHINGTON, > >> > > > Nairobi,KE > >> > > > +254 7 3200 0004/+254 7 2274 3223 > >> > > > In an Internet failure case, the #1 suspect is a > >> > constant: DNS. > >> > > > "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) > >> > > > [How to ask smart questions: > >> > > > http://www.catb.org/~esr/faqs/smart-questions.html] > >> > > > >> > > > >> > > > >> > > -- > >> > > Best regards, > >> > > Odhiambo WASHINGTON, > >> > > Nairobi,KE > >> > > +254 7 3200 0004/+254 7 2274 3223 > >> > > In an Internet failure case, the #1 suspect is a > >> constant: DNS. > >> > > "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) > >> > > [How to ask smart questions: > >> > > http://www.catb.org/~esr/faqs/smart-questions.html] > >> > > >> > > >> > > >> > -- > >> > Best regards, > >> > Odhiambo WASHINGTON, > >> > Nairobi,KE > >> > +254 7 3200 0004/+254 7 2274 3223 > >> > In an Internet failure case, the #1 suspect is a constant: DNS. > >> > "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) > >> > [How to ask smart questions: > >> > http://www.catb.org/~esr/faqs/smart-questions.html] > >> > >> > >> > >> -- > >> Best regards, > >> Odhiambo WASHINGTON, > >> Nairobi,KE > >> +254 7 3200 0004/+254 7 2274 3223 > >> In an Internet failure case, the #1 suspect is a constant: DNS. > >> "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) > >> [How to ask smart questions: > >> http://www.catb.org/~esr/faqs/smart-questions.html] > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
