0

I followed a step by step tutorial found on Digitalocean how to setup a mailserver on Ubuntu with Postfix, Dovecot, Mysql (I changed that last one to MariaDB).

The problem I'm facing is that I'm able to receive mails, but I cannot send any.

Perhaps it is good to know that I did the whole installation with my user and the keyword sudo.

So I'm already having this problem for 2 weeks now and tried so many things that it was time to tryout my luck here.

When running sudo service postfix status I see the following error returning

May 06 09:27:05 mailserver01 postfix/qmgr[8494]: 6AC1F2C093A: from=<info@mydomain.be>, size=652, nrcpt=1 (queue active)
May 06 09:27:05 mailserver01 postfix/postdrop[25691]: fatal: /etc/postfix/dynamicmaps.cf: file open failed: Permission denied
May 06 09:27:06 mailserver01 postfix/sendmail[25689]: warning: command "/usr/sbin/postdrop -r" exited with status 1
May 06 09:27:06 mailserver01 postfix/sendmail[25689]: fatal: info@purewebdesign.be(1001): unable to execute /usr/sbin/postdrop -r: Success
May 06 09:27:06 mailserver01 postfix/pipe[25688]: 6AC1F2C093A: to=<jav@gmail.com>, relay=spamassassin, delay=147723, delays=147722/0/0/1, dsn=4.3.0, status=deferred (temporary failure. Command output: postdrop: fatal: /etc/postfix/dynamicmaps.cf: file open failed: Permission denied sendmail: status=deferred (temporary failure. Command output: postdrop: fatal: /etc/postfix/dynamicmaps.cf: file open failed: Permission denied sendmail: warning: command "/usr/sbin/postdrop -r" exited with status 1 sendmail: fatal: info@purewebdesign.be(1001): unable to execute /usr/sbin/postdrop -r: Success )
May 06 09:33:48 mailserver01 postfix/submission/smtpd[25746]: connect from cust-228-37-109-94.dyn.as47377.net[94.109.37.228]

Perhaps it could be an issue with permissions I'm aware of that but just to be clear I did already try to make a new group with root, postfix, myuser, dovecot, spamd as users of that group. Then I gave that group read and write permissions on that postfix folder and subfolders. Without luck ...

here are the permissions on today:

-rw-r----- 1 root root      153 Apr 28 12:51 dynamicmaps.cf
-rw-r--r-- 1 root root     2674 May  5 09:05 main.cf
-rw-r----- 1 root root     1388 Apr 28 14:23 main.cf.orig
-rw-r----- 1 root root     6261 May  5 09:49 master.cf
-rw-r----- 1 root postfix   142 May  1 13:07 mysql-virtual-alias-maps.cf
-rw-r----- 1 root postfix   130 May  1 13:08 mysql-virtual-mailbox-domains.cf
-rw-r----- 1 root postfix   129 May  1 13:07 mysql-virtual-mailbox-maps.cf
-rw-r----- 1 root root    21233 Apr 13  2016 postfix-files
-rwxr-x--- 1 root root     9344 Apr 13  2016 postfix-script
-rwxr-x--- 1 root root    29446 Apr 13  2016 post-install
drwxr-x--- 2 root root     4096 Apr 13  2016 sasl

Anybody has an idea how to fix this?

  • 1
    If posting commands and similar stuff, post them exactly as you ran them. I'm pretty sure you did not execute an all-capital SUDO SERVICE on a Linux box. sudo is not a keyword, it is a command. Finally, you already realized that you have an issue with permissions -- consider what user postfix runs under, consider whether this user will be required read or write permissions for that file and adjust permissions accordingly. – Jens Erat May 6 '17 at 8:01
  • Thx for the answer, but I've already been that far. I adjust every possible permission file by file. Untill I'm in the current position where I don't know where to look anymore. – Peter May 6 '17 at 9:19
  • I am sorry, but quite frankly, the error message is abundantly clear and if you can't act on that, you really should consider to not run your own mail server. There are any numbers of alternatives available that offer to run this quite complex service for very little or no money. – Sven May 6 '17 at 9:47
  • It's not that I can't act on that It's just that when I navigate through the entire tutorial they were not talking about changing permissions on that particular file. I'm always very cautious with permissions... – Peter May 6 '17 at 9:51
2

postdrop usually has the setgid bit applied, which means when other processes like spamassasin use it to deliver mail, the process is executed under the other processes user (eg., spamassasin), but postdrop's group:

$ ls -la `which postdrop`
-r-xr-sr-x 1 root postdrop 14328 Feb  5  2015 /usr/sbin/postdrop
      ^               ^
      |               |
setgid bit set     executed with postdrop's privileges

Now the log tells you, that postdrop cannot access a configuration file it has to read:

May 06 09:27:05 mailserver01 postfix/postdrop[25691]: fatal: /etc/postfix/dynamicmaps.cf: file open failed: Permission denied

Looking at the file's permissions, the file is readable and writeable by the root user, and readable by the root group. It is not readable by anybody else (and that's a good thing).

-rw-r----- 1 root root      153 Apr 28 12:51 dynamicmaps.cf

To resolve the issue, change ownership of the file to the postdrop group (chown postdrop /etc/postfix/dynamicmaps.cf). Read permissions should be sufficient, so there is no reason to modify permissions. If other files also require adjusted privileges, do so one-by-one (or only with careful reconsideration of required privileges). Often, server processes deny performing any operations if they recognize privileges being issued broadly to notify you removing security issues caused by in especially read and write permissions to everybody on the system.

  • Wow what a progression! Perhaps my biggest issue here was that I did not see/know that it was the user postdrop that was the problem. I did try to add the user postfix instead. Thank you for that. The error is gone but when I do some testing now I see that I can send to only "some" domains. Gmail for example gives me connect to gmail-smtp-in.l.google.com[74.125.143.26]:25: Connection timed out. – Peter May 6 '17 at 9:45
  • Try connecting through telnet on port 25. Anyway: the Stack Exchange model does not fit unrelated follow-up questions in comments at all. Ask a new question instead. – Jens Erat May 6 '17 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.