Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to implement an anti-spam solution and according to advices I get here from answers to my other questions, I have decided to go for sendmail+mimedefang+spamassassin.

But currently I'm stuck with quite simple permission problem:

  1. By default, MIMEdefang is run as "defang" user, so it creates it's socket with following permissions:

    srwxr-x--- 1 defang defang 0 Mar 3 16:42 /var/spool/MIMEDefang/mimedefang.sock

  2. If sendmail is run as root, there is no problem, but if it is run as unprivileged user, then it complain about lack of permissions for mimedefang socket:

    NOQUEUE: SYSERR(root): /etc/mail/sendmail.cf: line 1870: Xmimedefang: local socket name /var/spool/MIMEDefang/mimedefang.sock unsafe: Permission denied

I have already tried following solutions for this problem:

  1. run sendmail as root. Works ok, but is rather unacceptable, as I want to avoid running my daemons as root

  2. run sendmail as defang or run mimedefang as the same user as sendmail. Seems ok, but also want to avoid this, as there are too many configurations files, directories, etc., which would require changing permissions and/or ownership, so whole process became much error prone.

  3. Simply change permission of socket file, but it is recreated every time mimedefang starts. I could modify accordingly appropriate scripts in /etc/init.d but again wan't to avoid this because my changes may be loosed with future updates of those packages.

Could you suggest any other solution? Are there available any options in sendmail or mimedefang, which are related with permissions?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Sendmail runs as root and forks whenever needed processes to run as another user (smmsp, smmta, etc). So yes, run it as root and make sure you are running the latest version. If you want to run sendmail as non-root, make that user part of the defang group. Notice that the defang group also has read rights on the socket.

EDIT: (after reading the comments bellow) To make the socket group read-write you have to use umask appropriately before starting the milter (See the Notes section in the link provided).

share|improve this answer
    
Thank, you for your answer, but this dosn't solve problem, as adding sendmail to defang group gives sendmail only read permissions while it require also write permissions. I have workarounded this problem using inet socket (f.e. inet:2222@127.0.0.1) instead of unix one, but I'm wonder whether there could be any negative consequences of this. –  user71061 Mar 4 '11 at 12:28
    
Duh! I should have read my comment more closely before submitting it! Of course it needs write access too! How else are they supposed to exchange information? Using the network socket is not a problem. It is there as a means to have the milter running on a machine different from the mail servers querrying it. –  adamo Mar 4 '11 at 12:42
    
BTW, read milter.org/developers/api/smfi_setconn to see how to create the socket 0660 using umask when starting the milter. –  adamo Mar 4 '11 at 12:55
    
Thank you, for pointing to right info! –  user71061 Mar 4 '11 at 17:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.