1

I want to create some mailboxes for Sendmail and I am going to do it with the adduser system utility, so every mailbox will be a user in the system. How do I restrict the privileges of these accounts to a minimum since they are only going to be used for mail.

And BTW, is there any alternative with this same MTA to have mailboxes without having to create system user accounts ?

Improve this question

2 Answers 2

Reset to default
1

Both Dovecot and Cyrus IMAP+POP servers support mailboxes without per every mailbox OS account. Dovecot supports both virtual and system users. Cyrus supports virtual users.

Note: If you choose Dovecot then Postfix may be easier to integrate than Sendmail. Sendmail does not support Dovecot SASL so AFAIK integrating SMTP AUTH is tricky without using LDAP centered configuration.

URL(s):

Improve this answer
1

Set their shell to /bin/false. Let the usual privileges for normal users apply. As for completely virtual users, turns out that Artem Nosulchik has devised a clever scheme to do just that.

Whether the additional security (if any) outweighs the maintenance overhead (if any) I do not know - I never had a system breech occurring through mailbox only users. Note that any such scheme needs to take into account your MTA, MDA and MUA (i.e. imap/pop3 server) unless you just need file delivery (which sendmail can do on its own) and do not care about reading the mailboxes as different users (in other words, if you do not need a multiuser mailserver).

Improve this answer
2
  • 3
    One should be aware that a /bin/false or /sbin/nologin shell could allow access to some other services (like FTP for example) if such services are available on that box.
    – Laurentiu Roescu
    Mar 18, 2013 at 10:54
  • Actually, for ftp that's not true - unless you put /bin/false in /etc/shells also - beside doing a slew of other actions if your ftp server is something like vsftpd, as it's wont to do these days. It could be true for other services, though - in fact this is both one of the reasons to use system accounts or not to use system accounts, depending on which alternative you would rather have.
    – Alien Life Form
    Mar 18, 2013 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .