Qmail
[Top] [All Lists]

Re: running (outbound) qmail without root

To: qmail@list.cr.yp.to
Subject: Re: running (outbound) qmail without root
From: Kyle Wheeler <kyle-qmail@memoryhole.net>
Date: Wed, 6 Jun 2007 19:26:36 -0600
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
Delivered-to: sp-com-lists@consult.net
Delivered-to: gmail-qmail@securepoint.com
Delivered-to: sp.com.list@gmail.com
Delivered-to: mailing list qmail@list.cr.yp.to
Dkim-signature: v=0.5; a=rsa-sha1; c=relaxed; d=memoryhole.net; h=received:received:date:from:to:subject:message-id:mail-followup-to:references:mime-version:content-type:content-disposition:in-reply-to:user-agent; q=dns/txt; s=default; bh=R4sq0smC7jvoYJtA5j+5s0zv9pM=; b=KxaYFc8g3hn0rt1rBpZmwTPPfE5Ytkr+oa3BU685Pgfmc5Kzyu6z3AWb4cQF6bBLtULqK78OCdHUNKCNtkqE61KaUAg5hrEIq7U9+VKMid+f1bb5Dxm5i3XK7dAf4tY3xaIkUyOCPWYeVY0MralJGVYGG0AcBAyIuAqnBOBbVyg=
Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=memoryhole.net; b=Iv8T1gaIZuDRwAkvLTuhimog+A1ikTjhrH+9d+qdyCPnKVG/Ah4USlzvmEtPiVOnWMghx/ay3VV4JoWBc5kgyPvhHTC7HiN2Q+grB9Fx87jj4jMSiR3cj0nFDNPVT7v90WOoGhxuZ8BrdYEcDc4Z1N/JpRkpO8MTJfY1zw7wERE=; h=Received:Received:Date:From:To:Subject:Message-ID:Mail-Followup-To:References:MIME-Version:Content-Type:Content-Disposition:In-Reply-To:User-Agent;
Domainkey-status: good
In-reply-to: <web-14394966@imb.uq.edu.au>
Mail-followup-to: qmail@list.cr.yp.to
Mailing-list: contact qmail-help@list.cr.yp.to; run by ezmlm
References: <web-14394966@imb.uq.edu.au>
User-agent: Mutt/1.5.15 (2007-05-20)
On Thursday, June  7 at 04:06 AM, quoth Michael Pheasant:
I maintain a Dive club website on a hosted server and need to maintain a mailing list.
The server runs sendmail and accepts smtp mail to our domain.
Incoming mail can be piped through unix commands, eg. |/path/to/qmail-inject

Wow. So subversive.

I don't suppose you have an actual reason for wanting qmail, other than inherent geek points?

I should point out that sendmail will deliver malformed messages; if possible, you probably want to use new-inject instead.

Also we only have a single unix userid and group 'unidive'.

I mean, by using a single group, you're foregoing most of qmail's security architecture.

I would like to use qmail for the mailing list - easy with a single file eg. '.qmail-members' listing our member emails.
All mail will be remote deliveries.

... I think you can achieve the same with the .forward file in sendmail.

Now I want to deliver the mail:
- When I try and run qmail-start, the process just silently exits.

So, qmail-start does several things right away:

1. chdir to /
2. runs setgroups() (requires CAP_SETGID capability)
3. runs setgid() (requires CAP_SETGID capability)
4. copies a bunch of file descriptors (requires free file descriptors)
5. runs setuid() (requires CAP_SETUID)

Then it does a bunch more things that should all work. Any one of those things failing can kill it.

- When I try and run qmail-send, the process just stops (but doesnt exit).

It's probably waiting for qmail-lspawn and qmail-rspawn to read from their appropriate file descriptors. There's a reason you're supposed to use qmail-start rather than running qmail-send directly.

Any advice on how I can run a 'send-only' qmail without root would be appreciated.

If you don't have permissions to run setgid/setgroups/setuid, then you may be kinda screwed. You may be able to hack qmail to remove that kind of stuff from qmail-start and friends...

~Kyle
--
In all matters of opinion, our adversaries are insane.
                                                        -- Oscar Wilde

Attachment: pgpvyLYMpxroA.pgp
Description: PGP signature

<Prev in Thread] Current Thread [Next in Thread>