Re: [SOLVED] Re: [gentoo-user] msmtp vs. nullmailer

[Marc Joliet]

Am Mon, 20 Jul 2015 10:23:30 -0400
schrieb "Walter Dnes" <waltdnes@××××××××.org>:

> On Mon, Jul 20, 2015 at 01:21:56PM +0200, Marc Joliet wrote
>
> > This choice came about because I switched from fcron to systemd-cron,
> > which runs its mail_on_failure script as user "nobody", which caused
> > my current "passwordeval" command ("cat somefile", somefile having
> > a mode mask of 0600)
>
>   That is the wrong, wrong, wrong way to do it.

I know, it somewhat defeats the purpose.  In my defense, it was supposed to be
temporary so that I could get msmtp working quickly until I was sure that I
wanted to keep it.

> > to fail due to insufficient access rights.  I really didn't want to
> > deal with how to properly solve that, and I don't think it's possible
> > (at least not with msmtp).  I mean, the problem statement is
> > basically "How do I securely give every user access to the password?".
> > Once stated that way, I think the difficulty with the problem becomes
> > fairly obvious.
>
>   The correct question is "how do I allow user 'nobody' to execute a
> one-off command as another user.

My thought was admittedly somewhat academic:  I didn't want to assume that only
root and nobody wanted to send emails.  However, I notice that the only
software I have installed that needs to be able to send email is (insofar that
there aren't any packages missing a dependency on virtual/mta or virtual/mailx):

- portage (though only if you configure it appropriately)
- smartd (via the "mail" program instead of sendmail)
- *cron
- sudo (though I don't know under what circumstances and as what user, though I
  expect it to send emails as root)

All run as root except for *cron, which in the case of systemd-cron sends mails
as "nobody" (I don't remember how fcron or any of the other implementations do
it).

So from a practical point of view, you are right that the problem was limited
to dealing with user "nobody".  Though who knows what will happen after an
upgrade or package migration?  Despite being a Gentoo user, I'm not interested
in micromanaging *every* aspect of my system (only the fun parts).

> The solution is sudoers.  Emerge sudo
> and set up a file in /etc/sudoers.d.  I use /etc/sudoers.d/001 because
> I'm not creative with filenames.  Here is an example entry...
>
> waltdnes  d531 = (root) NOPASSWD: /usr/sbin/hibernate
>
>   The explanation...
>
> waltdnes            (the user being allowed to run the command)
> d531                (the machine name in /etc/hosts)
> (root)              (the user privilege to run as)
> NOPASSWD:           (password is not required; no ugly "cat somefile" hack)
> /usr/sbin/hibernate (the command to run)
>
>   As regular user "waltdnes", I execute the command...
>
> sudo /usr/sbin/hibernate
>
> ...and I get the system to hibernate, which normally requires root level
> privileges.  I'm lazy, so I set up a script ~/bin/hb that runs the above
> command.  I only have to execute "hb" to hibernate.  This approach is
> very granular, because it can be set up to allow one user to execute one
> specifc command.  If you wish, you can use wildcards, and the special
> "ALL" word to open up privileges more widely.

I actually know about this and have a wildcard rule for cpupower.  I agree with
Mick's point, though, which partially ties into *my* point: I want to limit
access to the password (file) to as few users as possible, and "nobody" is used
as a catch-all, so I wouldn't fully know *what* exactly I'm giving access to my
email account password.

I just didn't see any sane way to handle this with msmtp, which to me seems
more and more like it's primarily designed for use by regular users as
opposed to system services (various hints point to this, such as that the
system-wide example [0] only defines a default account without a password, or
the Gentoo package description I mentioned before).

Anyway, I'm happy with nullmailer right now.

[0] http://msmtp.sourceforge.net/doc/msmtp.html#A-system-wide-configuration-file
-- 
Marc Joliet
--
"People who think they know everything really annoy those of us who know we
don't" - Bjarne Stroustrup