Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a highly customized home-directory structure which restricts access as follows:

  • The server hosts a number of subdomains, which are grouped into seven "zones"
  • Home directories are /home/zone/domain/homes/user
  • Users must belong to a particular zone to navigate below that level.
  • In order to navigate below the domain level, a user must be a member of a particular zone group AND a member of the appropriate domain group.
  • To get around the need for apache to be a member of EVERY domain group (in order to see content under /home/zone/domain/public_html), I have made www-data the owner of all /home/zone/domain directories

Everything works very well for me this way, with the following exception:

My problem is that the postfix user cannot see the home directories, and therefore cannot read .forward files.

Unfortunately there can only be 1 owner and 1 group for each directory, so I can't use the apache solution (above) for postfix.

Does anybody have any other suggestions for allowing postfix to read my .forward files?

...or am I perhaps misunderstanding the permissions required for forwarding to work?

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Since Postfix's local delivery agent assumes the user's identity when delivering mail or checking for .forward files, the fact that the postfix user itself is unable to access the home areas should not cause any problems. At our site, the vast majority of .forward files are not directly readable by the postfix user.

share|improve this answer
    
This is the kind of information I was wanting - thanks. Why then, if the user can see his own home directory and read his own .forward file, do the .forward files not work here? Is something else besides the "local delivery agent" required to read this file? –  Brent Jun 4 '09 at 14:11
    
It's possible that Postfix is not looking in the correct location; what is the output when you run "postconf forward_path" on the mail server? –  Josh Steadmon Jun 4 '09 at 21:43
add comment

There can be more than one user and one group - take a look at POSIX ACLs.

What OS are you using? If Linux, man acl will get you started.

Don't forget to setup default ACLs to accomodate any future entries that get created.

share|improve this answer
add comment

Can you add the postfix user to all of the groups?

share|improve this answer
    
No, groups are added/removed too frequently - and there are issues when a user is in too many groups (16 I think) –  Brent Jun 4 '09 at 14:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.