1

Postfix installation procedure created a system user postfix and it's primary group postfix while installation procedure for OpenDKIM created a system user opendkim and it's primary group opendkim.

To enable Postfix and OpenDKIM to work together most of the administrators do two things:

A

They append a secondary group opendkim to Postfix.

B

They set OpenDKIM configuration file /etc/opendkim.conf to create a UNIX socket using these three (two) lines:

UMask                   002
PidFile                 /var/run/opendkim/opendkim.pid
Socket                  local:/var/spool/postfix/opendkim/opendkim.sock

Official OpenDKIM documentation states this for the configuration parameter UMask:

Requests a specific permissions mask to be used for file creation. This only really applies to creation of the socket when Socket specifies a UNIX domain socket, and to the PidFile (if any);

I know that UNIX sockets are convenient because they can limit user privileges. In my case I want OpenDKIM to work with Postfix as safe as possible. But with UMask set to 002 UNIX socket will be created with ownership opendkim:opendkim and privileges 664 = rw-rw-r--.

I understand that group members (Postfix) need to read and write to the UNIX socket, but I don't understand why almost all tutorials online (A, B, C...) leave read permissions for others?

Is this a general missconception? Wouldn't a reasonable value for UMask be 007? Also the PID file is created using the same privileges...

If I check any other UNIX socket on my system some also have rights for others... Why is that important to have?

┌───┐
│ # │ root > mailer > ~
└─┬─┘
  └─> ss -x -l | head -n 10
Netid State  Recv-Q Send-Q                               Local Address:Port                                   Peer Address:Port                                 
u_dgr UNCONN 0      0                              /run/systemd/notify 14848                                             * 0                                    
u_str LISTEN 0      128               /var/run/dovecot/director-userdb 13957121                                          * 0                                    
u_str LISTEN 0      128                           /run/systemd/private 14852                                             * 0                                    
u_str LISTEN 0      100                          /var/run/dovecot/dict 13957125                                          * 0                                    
u_str LISTEN 0      128                    /var/run/dovecot/dict-async 13957129                                          * 0                                    
u_str LISTEN 0      1                      /var/run/irqbalance568.sock 17673                                             * 0                                    
u_dgr UNCONN 0      0                      /run/systemd/journal/syslog 14859                                             * 0                                    
u_str LISTEN 0      128                        /var/run/dovecot/config 13957133                                          * 0                                    
u_str LISTEN 0      128                   /var/run/dovecot/login/login 13957135                                          * 0                                    

┌───┐
│ # │ root > mailer > ~
└─┬─┘
  └─> ls -l /var/run/dovecot/config 
srw------- 1 root root 0 Dec 31 07:35 /var/run/dovecot/config

┌───┐
│ # │ root > mailer > ~
└─┬─┘
  └─> ls -l /var/run/dovecot/login/login 
srw-rw-rw- 1 root root 0 Dec 31 07:35 /var/run/dovecot/login/login
1
  • 1
    In Debian, the default opendkim.conf sets umask to 007 (the wiki page also discusses setting up the socket).
    – glts
    Jan 2, 2021 at 7:49

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.