keep postfix chroot
This commit is contained in:
parent
8d37b09347
commit
46611cf761
3 changed files with 11 additions and 16 deletions
|
|
@ -35,8 +35,7 @@ organisation. So I replaced resource-hungry components by more lightweight softw
|
||||||
A new Debian stable release comes with newer software versions. So I checked the changelogs to determine what we will
|
A new Debian stable release comes with newer software versions. So I checked the changelogs to determine what we will
|
||||||
have to change:
|
have to change:
|
||||||
|
|
||||||
- Postfix 3.7.6 -> 3.10.3. No breaking changes. In this guide we will turn off _chroot_ mode though to simplify
|
- Postfix 3.7.6 -> 3.10.3. No breaking changes.
|
||||||
things a bit. The author of Postfix does not recommend it anyway.
|
|
||||||
- Dovecot 2.3.19 -> 2.4.1. Various deprecations of the configuration. This guide uses the new syntax.
|
- Dovecot 2.3.19 -> 2.4.1. Various deprecations of the configuration. This guide uses the new syntax.
|
||||||
- PHP 8.2 -> 8.4. Roundcube has no issues with the newer PHP version.
|
- PHP 8.2 -> 8.4. Roundcube has no issues with the newer PHP version.
|
||||||
- rspamd 3.4.1 -> 3.12.1. No breaking changes.
|
- rspamd 3.4.1 -> 3.12.1. No breaking changes.
|
||||||
|
|
|
||||||
|
|
@ -19,8 +19,6 @@ DEBIAN_FRONTEND=noninteractive \
|
||||||
php-intl php-mbstring php-xml unzip certbot \
|
php-intl php-mbstring php-xml unzip certbot \
|
||||||
roundcube-mysql roundcube swaks ufw mutt \
|
roundcube-mysql roundcube swaks ufw mutt \
|
||||||
unattended-upgrades mariadb-server
|
unattended-upgrades mariadb-server
|
||||||
|
|
||||||
postfix chroot off
|
|
||||||
```
|
```
|
||||||
|
|
||||||
While the server is downloading and installing the packages, let me give you a quick explanation of each package:
|
While the server is downloading and installing the packages, let me give you a quick explanation of each package:
|
||||||
|
|
@ -60,11 +58,3 @@ While the server is downloading and installing the packages, let me give you a q
|
||||||
functionality of your mail server. Think of it as a text-based Thunderbird.
|
functionality of your mail server. Think of it as a text-based Thunderbird.
|
||||||
- **unattended-upgrades** \
|
- **unattended-upgrades** \
|
||||||
Installs security updates automatically.
|
Installs security updates automatically.
|
||||||
|
|
||||||
<Aside type="note" title="postfix chroot off?">
|
|
||||||
|
|
||||||
By default, Debian enables Postfix to run in chroot mode. While this may sound like a security improvement, even
|
|
||||||
Postfix’s author advises against it, arguing that it mostly creates a false sense of security. For this reason, we are
|
|
||||||
disabling chroot mode—which also simplifies some configuration later on.
|
|
||||||
|
|
||||||
</Aside>
|
|
||||||
|
|
|
||||||
|
|
@ -67,13 +67,19 @@ Create the database users:
|
||||||
|
|
||||||
```sql
|
```sql
|
||||||
grant all privileges on mailserver.* to 'mailadmin'@'localhost' identified by 'FIRST-PASSWORD-HERE';
|
grant all privileges on mailserver.* to 'mailadmin'@'localhost' identified by 'FIRST-PASSWORD-HERE';
|
||||||
grant select on mailserver.* to 'mailserver'@'localhost' identified by 'SECOND-PASSWORD-HERE';
|
grant select on mailserver.* to 'mailserver'@'127.0.0.1' identified by 'SECOND-PASSWORD-HERE';
|
||||||
```
|
```
|
||||||
|
|
||||||
<Aside type="note" title="Changed since Debian Bookworm">
|
<Aside type="note" title="127.0.0.1 versus localhost">
|
||||||
|
|
||||||
In the past, we used 127.0.0.1 instead of localhost because Postfix was running in a chroot environment. Starting with
|
Wait a minute. Why is there “127.0.0.1” instead of “localhost” in the second SQL command? Is that a typo? No, it’s not.
|
||||||
Debian Trixie, we’ve disabled chroot mode for Postfix, which means we can now use just `localhost`.
|
Well, in network terminology those two are identical. But MariaDB distinguishes between the two. If you initiate a
|
||||||
|
database connection to "localhost" then you talk to the socket file which lives at /var/run/mysqld/mysqld.sock on your
|
||||||
|
server. But if you connect to “127.0.0.1” it will create a network connection talking to the TCP socket on port 3306 on
|
||||||
|
your server. The difference is that any process on your server can talk to 127.0.0.1. But the socket file has certain
|
||||||
|
user/group/other permissions just like any other file on your file system. Postfix will be restricted to its
|
||||||
|
/var/spool/postfix directory and cannot by default access that socket file. So by using 127.0.0.1 we circumvent that
|
||||||
|
limitation.
|
||||||
|
|
||||||
</Aside>
|
</Aside>
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue