Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What prevents an attack on Postfix through its named pipes by writing bogus data to them? I see on my system that they permit write access to other. I wonder if that opens Postfix to DoS or some other form of attack.

prw--w--w- 1 postfix postdrop 0 Nov 28 21:13 /var/spool/postfix/public/pickup
prw--w--w- 1 postfix postdrop 0 Nov 28 21:13 /var/spool/postfix/public/qmgr

I reviewed the pickup(8) and qmgr(8) man pages, and searched here and elsewhere, but failed to turn up any answers. I found no information about the named pipes themselves: not even what’s normally written to them, much less how they are secured. The words pipe or fifo do not even appear in the documentation.

share|improve this question

At least on my Debian system, the /var/spool/postfix/public directory is only accessible to the postfix user and the postdrop group (and root of course):

# ls -ld /var/spool/postfix/public
drwx--s--- 2 postfix postdrop 4096 Sep  5 14:02 /var/spool/postfix/public

Also, as the directory name indicates those pipes are meant to be public, as such they would be written to mistrust data that they receive. This may not completely avoid a DoS attack, but there isn't really a good way to do that. And, access to the services should be logged, allowing the system administrator to determine who attacked the system.

No matter how the permissions are setup for the system, there needs to be a publicly available entry point in order for it to take in messages from non-trusted users.

share|improve this answer
It is of course true that you need an interface to non-trusted users. The question is how to best secure it against attack. – MετάEd Nov 28 '12 at 22:50
This is wrong in several regards. First of all, postfix offers the option to run any daemon that doesn't require outside interaction inside a chroot, thus limiting any damage the "insecure" service may do to the rest of the system. Second, the public services are fairly limited; pickup only accepts mail sent to it by the pickup(8) daemon, which is itself not public, and the qmgr only allows harmless queue commands when not accessed by root. – adaptr Nov 29 '12 at 13:43
I don't understand, what is wrong? You seem to agree with the answer you're commenting on. – gparent Dec 3 '12 at 14:43

As documented here and here, these particular public interfaces are very limited in what they will accept from non-root users.

Each postfix man page has a SECURITY section that precisely details potential risk factors.

share|improve this answer
I don't actually see in either of the linked man pages any information about the named pipes themselves: not even what's normally written to them, much less how they are secured; not even the words "pipe" or "fifo". I read these before asking the question. I suppose I may not be reading them properly, I don't know. – MετάEd Nov 29 '12 at 22:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.