Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently setting up e-mail piping to a PHP script in a directory not accessible by others (it's set to 750). Postfix runs the pipe command under the user 'nobody', who naturally won't be able to access the script. I'm a bit hesitant in adding execute permissions to that folder, since I don't want other users to be able to access it (even if they don't know the path). So, what I do want, is to have the pipe command run under a different user, that does have access to that folder.

The server I want to do this on has Virtualmin installed. I've set everything up with Virtualmin, including the alias that is fed to the PHP script. There's several threads on the Virtualmin forum about this issue, but there's no solution there yet other than making the folder executable by others.

So, how can I let the pipe command run under a different user than nobody?

share|improve this question
cmd1 | sudo -u otheruser cmd2, if you setup sudo to allow nobody to run cmd2. – forcefsck Nov 29 '12 at 13:04
You don't really know what postfix is, do you ? :) – adaptr Nov 29 '12 at 13:31

As documented, pipe(8) can execute as any user you tell it to - except root.
That, and only that, will execute as nobody.

yourscript unix - - n - - pipe user=<uid> argv=<yourexecutable>

The user= takes any existing unix user, and runs the pipe(8) instance under those credentials.

share|improve this answer
Thanks for your response. It doesn't completely answer my question, though. How do I "link" (for the lack of a better word) my alias to that command? So when an e-mail is sent to, that specific command gets executed? I've already got an alias in /etc/aliases which looks like: "|php -q /home/user/public_html/subfolder/script.php". – mpkossen Nov 29 '12 at 14:01
If you alias that to the user you want the script to run under, you can then pipe it to PHP in their .forward file. – adaptr Nov 29 '12 at 14:22

This is because the user in which Postfix runs for piping is by default nobody.

That line changes the user under which piping runs and you should be aware that in the Postfix documentation it warns about this: DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER

Just be aware of the security implications of piping emails via a privileged user on the server.

share|improve this answer

This was just brought up over on StackOverflow a few days ago, with slightly different wording, but the problem is the same and the solution is the same:

In short, the solution is to login to Usermin as the user you need to pipe as, and create the pipe there. Virtualmin does setup users to run things as the user when piped from Postfix, but not in the context of Virtualmin...only when you create them under Usermin.

You can also create the pipe manually within the .procmailrc of the user in question.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.