4

My centos server can send mail using the 'mail' command but not from php. Maillog says:

sendmail[18010]: NOQUEUE: SYSERR(nginx): can not chdir(/var/spool/clientmqueue/): Permission denied

My permissions are as follows:

lrwxrwxrwx 1 nginx nginx 30 Oct 30 20:27 /usr/lib/sendmail -> /etc/alternatives/mta-sendmail 
lrwxrwxrwx 1 nginx nginx 21 Oct 30 20:27 /usr/sbin/sendmail -> /etc/alternatives/mta

lrwxrwxrwx 1 nginx nginx 27 Oct 30  2012 /etc/alternatives/mta -> /usr/sbin/sendmail.sendmail
lrwxrwxrwx 1 nginx nginx 26 Oct 30  2012 /etc/alternatives/mta-sendmail -> /usr/lib/sendmail.sendmail

lrwxrwxrwx 1 nginx nginx     16 Oct 30  2012 /usr/lib/sendmail.sendmail -> ../sbin/sendmail
-rwxr-xr-x 1 root  smmsp 775064 Aug 11  2011 /usr/sbin/sendmail.sendmail

What would all these links be for?

Improve this question

3 Answers 3

Reset to default
9

Sendmail-8.12+ installation: file permissions

Sendmail-8.12+ binary should be installed as set GROUP id.
(/usr/sbin/sendmail.sendmail in your case)

It is described in SECURITY file in sendmail(.org) distribution:

-r-xr-sr-x  root   smmsp    ... /PATH/TO/sendmail
drwxrwx---  smmsp  smmsp    ... /var/spool/clientmqueue
Improve this answer
2
  • 1
    Great. I looked up s bits here faqs.org/docs/securing/chap5sec52.html, changed the permissions, and it works. Thanks.
    – Adripants
    Jul 4, 2013 at 2:10
  • 1
    @Adripants : Set group id sendmail is much better than previous set root id :-)
    – AnFi
    Jul 9, 2013 at 15:16
3

There's also an SELINUX boolean policy called httpd_can_sendmail.... I'm pretty sure this has to be set to true also.

Improve this answer
0

If you have inherited a system and you want to change the location of /var/spool/mqueue to someplace other than that and when you modify your sendmail.mc and re-make sendmail.cf or edit the sendmail.cf directory and you start sendmail and it complains "Permission denied" and none of the above helps-- try this. Even when you have completely disabled SELINUX, etc.

I have gone through all of the above suggestions on numerous systems over the years and no matter what the user is, what the setgid is on sendmail, or what the permissions and ownership information is on any directory I still get the error. In every case I found it was something with the existing installed version of sendmail. Even if it is the latest. In every case I was able to overcome the problem by:

  1. make a backup of sendmail.mc or sendmail.cf if you do not build from the mc file
  2. make a backup of aliases, virtusertable, etc... all of them because sometimes the reinstall over-writes them (it usually saves them, but...)
  3. uninstall sendmail (e.g., "yum remove sendmail -y" or "apt remove sendmail -y")
  4. reinstall sendmail (e.g., "yum install sendmail sendmail-cf -y" or "apt install sendmail sendmail-cf -y"

The reinstallation seems to fix the issue.

You might need to update /etc/sysconfig/sendmail with location of your sendmail.cf file with the changed QUEUEDIR and then possibly run "journalctl daemon-reload" to fix that, then it should work.

It is some kind of issue with the OEM install version of sendmail such as missing user/group smmsp, etc.... but this is the easiest way to overcome this problem on a modern linux installation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .