At 7:19 PM -0500 9/25/07, Rich Winkel imposed structure on a stream of electrons, yielding:

Ok, I've ALMOST got this working ... I can run deliver as a user, but when I try using it as the default delivery agent from sendmail, I get deliver(userid): net_connect(/var/run/dovecot/auth-master) failed: Permission denied

Does deliver run as root, as the recipient's ID, sendmail's ID or sendmail's GID? (I'm running freebsd)

Ideally, it should run SUID+SGID to a user and group that exist to make mail delivery permissions work. See http://wiki.dovecot.org/LDA/Sendmail and http://wiki.dovecot.org/LDA

The key bit is on the main LDA page where it describes the master socket config and on the Sendmail page where it discusses 'non-root' sendmail setups, which is really applicable to all common setups of modern Sendmail.

Or am I totally clueless ??

Well, the Mizzou address argues one way, but I'll give you the benefit of the doubt and say maybe not... :)

The bottom line: make up a user and group to own the master socket, structure your inbox permissions so that deliver can run that way and write to them, and make deliver SUID/SGID.

Structuring inbox permissions so that can work is a potentially complex problem.

Here is dovecot -n:

# 1.0.3: /usr/local/etc/dovecot.conf base_dir: /var/run/dovecot/ listen: localhost:996 ssl_disable: yes login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login login_greeting_capability: yes first_valid_uid: 100 mail_extra_groups: mail mail_location: mbox:~/mail:INBOX=/var/mail/%u:INDEX=/var/spool/dovecot_indexes/%u lock_method: flock mbox_read_locks: flock mbox_write_locks: flock auth default: passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 master: path: /var/run/dovecot/auth-master mode: 432

Thanks!!!!! Rich

-- Bill Cole bill@scconsult.com