I have a highly customized home-directory structure which restricts access as follows:
- The server hosts a number of subdomains, which are grouped into seven "zones"
- Home directories are /home/zone/domain/homes/user
- Users must belong to a particular zone to navigate below that level.
- In order to navigate below the domain level, a user must be a member of a particular zone group AND a member of the appropriate domain group.
- To get around the need for apache to be a member of EVERY domain group (in order to see content under /home/zone/domain/public_html), I have made www-data the owner of all /home/zone/domain directories
Everything works very well for me this way, with the following exception:
My problem is that the postfix user cannot see the home directories, and therefore cannot read .forward files.
Unfortunately there can only be 1 owner and 1 group for each directory, so I can't use the apache solution (above) for postfix.
Does anybody have any other suggestions for allowing postfix to read my .forward files?
...or am I perhaps misunderstanding the permissions required for forwarding to work?