keep postfix chroot

This commit is contained in:
Christoph Haas 2025-08-27 00:54:00 +02:00
parent 8d37b09347
commit 46611cf761
3 changed files with 11 additions and 16 deletions

View file

@ -35,8 +35,7 @@ organisation. So I replaced resource-hungry components by more lightweight softw
A new Debian stable release comes with newer software versions. So I checked the changelogs to determine what we will A new Debian stable release comes with newer software versions. So I checked the changelogs to determine what we will
have to change: have to change:
- Postfix 3.7.6 -> 3.10.3. No breaking changes. In this guide we will turn off _chroot_ mode though to simplify - Postfix 3.7.6 -> 3.10.3. No breaking changes.
things a bit. The author of Postfix does not recommend it anyway.
- Dovecot 2.3.19 -> 2.4.1. Various deprecations of the configuration. This guide uses the new syntax. - Dovecot 2.3.19 -> 2.4.1. Various deprecations of the configuration. This guide uses the new syntax.
- PHP 8.2 -> 8.4. Roundcube has no issues with the newer PHP version. - PHP 8.2 -> 8.4. Roundcube has no issues with the newer PHP version.
- rspamd 3.4.1 -> 3.12.1. No breaking changes. - rspamd 3.4.1 -> 3.12.1. No breaking changes.

View file

@ -19,8 +19,6 @@ DEBIAN_FRONTEND=noninteractive \
php-intl php-mbstring php-xml unzip certbot \ php-intl php-mbstring php-xml unzip certbot \
roundcube-mysql roundcube swaks ufw mutt \ roundcube-mysql roundcube swaks ufw mutt \
unattended-upgrades mariadb-server unattended-upgrades mariadb-server
postfix chroot off
``` ```
While the server is downloading and installing the packages, let me give you a quick explanation of each package: While the server is downloading and installing the packages, let me give you a quick explanation of each package:
@ -60,11 +58,3 @@ While the server is downloading and installing the packages, let me give you a q
functionality of your mail server. Think of it as a text-based Thunderbird. functionality of your mail server. Think of it as a text-based Thunderbird.
- **unattended-upgrades** \ - **unattended-upgrades** \
Installs security updates automatically. Installs security updates automatically.
<Aside type="note" title="postfix chroot off?">
By default, Debian enables Postfix to run in chroot mode. While this may sound like a security improvement, even
Postfixs author advises against it, arguing that it mostly creates a false sense of security. For this reason, we are
disabling chroot mode—which also simplifies some configuration later on.
</Aside>

View file

@ -67,13 +67,19 @@ Create the database users:
```sql ```sql
grant all privileges on mailserver.* to 'mailadmin'@'localhost' identified by 'FIRST-PASSWORD-HERE'; grant all privileges on mailserver.* to 'mailadmin'@'localhost' identified by 'FIRST-PASSWORD-HERE';
grant select on mailserver.* to 'mailserver'@'localhost' identified by 'SECOND-PASSWORD-HERE'; grant select on mailserver.* to 'mailserver'@'127.0.0.1' identified by 'SECOND-PASSWORD-HERE';
``` ```
<Aside type="note" title="Changed since Debian Bookworm"> <Aside type="note" title="127.0.0.1 versus localhost">
In the past, we used 127.0.0.1 instead of localhost because Postfix was running in a chroot environment. Starting with Wait a minute. Why is there “127.0.0.1” instead of “localhost” in the second SQL command? Is that a typo? No, its not.
Debian Trixie, weve disabled chroot mode for Postfix, which means we can now use just `localhost`. Well, in network terminology those two are identical. But MariaDB distinguishes between the two. If you initiate a
database connection to "localhost" then you talk to the socket file which lives at /var/run/mysqld/mysqld.sock on your
server. But if you connect to “127.0.0.1” it will create a network connection talking to the TCP socket on port 3306 on
your server. The difference is that any process on your server can talk to 127.0.0.1. But the socket file has certain
user/group/other permissions just like any other file on your file system. Postfix will be restricted to its
/var/spool/postfix directory and cannot by default access that socket file. So by using 127.0.0.1 we circumvent that
limitation.
</Aside> </Aside>