Racker Hacker » postfix

SELinux and .forward files

Major Hayden — Mon, 02 Jan 2012 22:44:43 +0000

If you want to forward e-mail from root to another user, you can usually place a .forward file in root's home directory and your mail server will take care of the rest:

echo "user@example.com" > /root/.forward

With SELinux, you'll end up getting an AVC denial each time your mail server tries to read the contents of the .forward file:

type=AVC msg=audit(1325543823.787:7416): avc:  denied  { open } for  pid=9850 
  comm="local" name=".forward" dev=md0 ino=17694734 
  scontext=system_u:system_r:postfix_local_t:s0 
  tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file

The reason is that your .forward file doesn't have the right SELinux contexts. You can set the correct contest quickly with restorecon:

# ls -Z /root/.forward 
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 /root/.forward
# restorecon -v /root/.forward
restorecon reset /root/.forward context unconfined_u:object_r:admin_home_t:s0->system_u:object_r:mail_forward_t:s0
# ls -Z /root/.forward 
-rw-r--r--. root root system_u:object_r:mail_home_t:s0 /root/.forward

Try to send another e-mail to root and you should see the mail server forward the e-mail properly without any additional AVC denials.

SELinux and .forward files is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Basic procmail configuration with spamassassin filtering

Major Hayden — Wed, 13 Aug 2008 17:00:48 +0000

I've used this extremely basic procmail configuration a million times, and it's a great start for any server configuration. It passes e-mails through spamassassin (if they're smaller than 256KB) and then filters any e-mail marked as spam to /dev/null:

LOGFILE=/var/log/procmail.log DROPPRIVS=yes


:0fw

| /usr/bin/spamc

:0 * ^X-Spam-Status: Yes /dev/null

Of course, you can make this much more complicated with some additional customization.

Basic procmail configuration with spamassassin filtering is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

Enable submission port 587 in Postfix

Major Hayden — Thu, 05 Jul 2007 00:29:36 +0000

Enabling submission port support for Postfix is really easy. To have postfix listen on both 25 and 587, be sure that the line starting with submission is uncommented in /etc/postfix/master.cf:

smtp      inet  n       -       n       -       -       smtpd
submission inet n      -       n       -       -       smtpd

Enable submission port 587 in Postfix is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.