I have a highly customized home-directory structure which restricts access as follows:

  • The server hosts a number of subdomains, which are grouped into seven "zones"
  • Home directories are /home/zone/domain/homes/user
  • Users must belong to a particular zone to navigate below that level.
  • In order to navigate below the domain level, a user must be a member of a particular zone group AND a member of the appropriate domain group.
  • To get around the need for apache to be a member of EVERY domain group (in order to see content under /home/zone/domain/public_html), I have made www-data the owner of all /home/zone/domain directories

Everything works very well for me this way, with the following exception:

My problem is that the postfix user cannot see the home directories, and therefore cannot read .forward files.

Unfortunately there can only be 1 owner and 1 group for each directory, so I can't use the apache solution (above) for postfix.

Does anybody have any other suggestions for allowing postfix to read my .forward files?

...or am I perhaps misunderstanding the permissions required for forwarding to work?


Since Postfix's local delivery agent assumes the user's identity when delivering mail or checking for .forward files, the fact that the postfix user itself is unable to access the home areas should not cause any problems. At our site, the vast majority of .forward files are not directly readable by the postfix user.

  • This is the kind of information I was wanting - thanks. Why then, if the user can see his own home directory and read his own .forward file, do the .forward files not work here? Is something else besides the "local delivery agent" required to read this file? – Brent Jun 4 '09 at 14:11
  • It's possible that Postfix is not looking in the correct location; what is the output when you run "postconf forward_path" on the mail server? – Josh Steadmon Jun 4 '09 at 21:43

There can be more than one user and one group - take a look at POSIX ACLs.

What OS are you using? If Linux, man acl will get you started.

Don't forget to setup default ACLs to accomodate any future entries that get created.


Can you add the postfix user to all of the groups?

  • No, groups are added/removed too frequently - and there are issues when a user is in too many groups (16 I think) – Brent Jun 4 '09 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.