0

I've just spent several hours in the middle of the night trying to migrate a Maildir setup from Centos 5.6 to Centos 7.2. I found dozens of hits on how to do this, all completely useless - a few gave specific permissions, but without file ownership, for example. A straight copy of the Maildir directory structure didn't work.

I've now got a working setup (no SELinux), through trial and error, but with various question marks, and possibly some holes. I'd appreciate feedback on whether this can be improved.

In this setup Maildir is in the user's home directory (say, /home/joe, or ~):

  1. ~ must have o+x (on this system, owner is joe:joe, perms 711)
  2. ~/Maildir must be owned by joe:vmail, perms 775. The perms are important - the g 7 appears to be copied to newly-created messages (as 6)
  3. the procmailrc UMASK is completely irrelevant, unless it takes away any of these permissions - just ignore it
  4. everything under Maildir must be owned by joe:vmail, with directories given perms 775, and regular files 660
  5. When procmail eventually creates a file under, for example, Maildir/cur it creates it with owner joe:mail (not vmail), perms 664
  6. practically any change to the above will cause either a sendmail, dovecot or procmail failure at some point in the delivery process.

Quick hack script below - run from /home, supply a username.

#!/bin/bash
if [ ! -d "$1" ]; then
    exit 1
fi
echo "Fixing $1..."
chmod o+x "$1"
cd "$1"
chown -R "$1":vmail Maildir
find Maildir -type d -exec chmod 775 {} \;
find Maildir -type f -exec chmod 660 {} \;
  • Why do you use procmail for deliveries to dovecot? [ Are dovecot's lmtp and dovecot's sieve are insufficient? ] – AnFi Sep 1 '16 at 13:06
  • @AAF - history, mainly - this is a server migration. I looked at LDA, but the sendmail configuration looks fragile, and could take a long time to get right. I looked at LMTP, but the wiki says only that "it's somewhat easier to configure (especially related to permissions) and gives better performance" [than LDA]. Not great reasons to change what had previously been a working setup. – EML Sep 1 '16 at 14:27
  • IMHO required group ownership means some non standard configuration you have not mentioned. – AnFi Sep 2 '16 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.