change default permissions (600) of postfix mailboxes

make world readable to enable backups

[jamie]

hi,

postfix defaults to 600 permissions on /var/mail/mailboxes

is there anyway i can allow world read access (chmod o+r) to allow rsync running as a non-root user to read the mailboxes. everytime i try this, postfix overwrites the permissions back to 600

i can not find anywhere in master.cf or main.cf

does anyone have any suggestions? or should i first run rsync as root to copy all mailboxes to another directory, and then chmod o+r?

many thanks

[wheel]

Somewhat ignorant reply here - this isn't my strength - but are you sure that it's postfix overwriting the permissions? In my linux distro there's some program that runs everynight that server wide resets permissions. Can be very annoying :), but the fix is simply to find the list of files it's checking and remove the postfix files.

Sorry, I don't recall the name of the program in my distro.

[jamie]

hi wheel,

i am pretty sure it is postfix, i can see in the maillog that it complains about permissions on 644 mailboxes and then chmods them back to 600.

i'll bear what you say in mind though, cos i have another issue with permissions on user home dirs.

thanks for input

[MattyMoose]

Resetting permissions to o+r is a bad idea, especially if you care anything about the sensitivity of users' email. If other people are hosting their email on your server, or even if it's employees using the local mail system, you're now opening it up so that any user can read any users' email.

Admittedly, the options available are a little tricky. You could run your backups as root in its crontab. Not an ideal situation, since root isn't *supposed* to run crons of that nature, but that's what you have to do sometimes. The other option is to run the backups as the postfix user. Looking at my system, it looks like postfix doesn't have a proper shell. You can always change that and make it so that it's a "real" user that can interact with the system. Again, not a fantastic solution.

The best way to get around this sort of predicament is really to do full-system backups using dump. It's straight-forward and reliable, and can be restored to nearly any other *NIX system.

My 0.02,
MM

[jamie]

hi matty,

many thanks for thoughts, i understand what you mean about permissions. at the moment i am using root's crontab. i've never looked into dump as a solution, that sounds interesting.

cheers