Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 12 Apr 2012 09:51:09 +0200
From:      Polytropon <freebsd@edvax.de>
To:        Matthew Seaman <matthew@freebsd.org>
Cc:        freebsd-questions@freebsd.org
Subject:   Re: Sendmail recommended permissions for apache/php server
Message-ID:  <20120412095109.63ce0715.freebsd@edvax.de>
In-Reply-To: <4F86818D.8000402@FreeBSD.org>
References:  <AC28A3ECE8FFEA4CAE20B2B79FDB8F709B6DDB@server01.msdi.local> <20120412034932.b6b7de0a.freebsd@edvax.de> <4F86818D.8000402@FreeBSD.org>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On Thu, 12 Apr 2012 08:17:33 +0100, Matthew Seaman wrote:
> On 12/04/2012 02:49, Polytropon wrote:
> > On Wed, 11 Apr 2012 23:57:51 +0000, Ian Lord wrote:
> >> > I then got a different error in /var/log/messages
> >> > Apr 11 19:38:40 dev sendmail[41170]: NOQUEUE: SYSERR(www): can not write to queue directory /var/spool/clientmqueue/ (RunAsGid=0, required=25): Permission denied
> 
> >> > I found very old threads saying to change the group of apache
> >> > to "smmsp" but I doubt it's a good idea.
> 
> > No, not "change to", but you can _add_ apache (or whatever is
> > originating the error) to the smmsp group. Add it to "smmsp:*:25:"
> > in /etc/group.
> 
> You should not be changing the ownership and permissions on any of the
> directories used by sendmail(8), or the group membership of any of the
> groups used by sendmail.  Not even if you think you know what you are
> doing.  This is extremely security sensitive, and getting it wrong means
> at minimum unprivileged users can forge e-mails untraceably[*].

You're right - as long as sendmail works properly (and is invoked
by whatever means sends e-mail out of apache / PHP), the present
group settings and permissions should be okay. Sendmail will
then properly run "as the smmsp group member" which will enable
it to properly access the queue directory.



> There is no reason for apache to have any sort of write permissions to
> /var/spool/clientmqueue -- that should only be accessible to sendmail,
> and sendmail is the only program that should ever use it.

I'm not aware of why a program should directly access the mail
queues, but maybe that's a "special" PHP feature. :-)




-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?20120412095109.63ce0715.freebsd>