6

I am new to postfix and am trying to pipe a message to a particular email address to a bash script. I am running CentOS 6 in case that matters.

My script has 777 permission (for testing), and when I email to the test account I see that postfix tries to run the script. This is the relevant line from the maillog:

Feb 16 15:08:40 lserver2 postfix/local[19675]: F4045103000: to=, orig_to=, relay=local, delay=1737, delays=1737/0.01/0/0.01, dsn=4.3.0, status=deferred (temporary failure. Command output: local: fatal: execvp /data/scripts/testscript: Permission denied )*

This looks like a permissions issues. When I try to run my script as us 'postfix' or 'nobody' I get the error: This account is currently not available.

I'm not sure where to go from here....I've read several posts that don't give a clear next step. (I don't want to redirect ALL mail to a script, and one answer looks WAY to complicated for something so simple)

2 Answers 2

5

If your script is owned by foo, for example, try the following:

  1. Create /home/foo/.aliases and move the piping line from /etc/aliases to it.
  2. Run postalias /home/foo/.aliases.
  3. Add /home/foo/.aliases to the alias_maps of /etc/postfix/main.cf.
  4. Restart the postfix.

Note that the owner of /home/foo/.aliases and /home/foo/.aliases.db must be foo.

See http://www.postfix.org/ADDRESS_REWRITING_README.html#aliases. It says:

For security reasons, deliveries to command and file destinations are performed with the rights of the alias database owner.

2
  • 3
    I understand this answer is older now, but it was still relevant in 2017. I want to add that adding the /home/foo/.aliases file needs to be put in the /etc/postfix/main.cf file as 'alias_maps = hash:/home/foo/.aliases' AND 'alias_database = hash:/home/foo/.aliases'. I forgot on the initial try to add it to the databases, and postfix kept failing on me.
    – G Trawo
    Nov 9, 2017 at 19:45
  • When running SELinux both the alias and .db files need the etc_aliases_t type, and then you need to monitor the audit log for any permissions your script needs when running in the postfix context (even when running as the right user :( )
    – Hashbrown
    Feb 16, 2021 at 1:37
0

Refer to this answer in SO, there are 2 options, one is what Tsutomu has shared.

Another one would be setting default_privs = <owner of the executing script> in main.cf.

It help solved my permission denied issue.

1
  • postfix.org/postconf.5.html#default_privs :Notes: "The default rights used by the local(8) delivery agent for delivery to an external file or command. These rights are used when delivery is requested from an aliases(5) file that is owned by root, or when delivery is done on behalf of root. DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER." > In other words, be careful if you have to do this - if you do this at all..
    – B. Shea
    Jan 2, 2023 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .