[Dovecot] ownership/perms on DC file objects

[Stewart Dean]

Back in late March I asked what ownership and permissions Dovecot's own 
directories and files should have; I have an obsessive nature, and 
wanted to get things right :(..  On April Fool's Day :), Timo responded:
> Dovecot opens pretty much all the configuration etc. files as root 
> before dropping the privileges. So in general they could all be 0600 
> owned by root
In my typical turtle-crawl fashion, I got around to today, but the 
onership/perms came out somewhat differently, which I put down here for 
anyone that wants to know.........

I set everything under /var/run/dovecot to 600, owned by root:dovecot
> 4242 root at mercury:/var/run/dovecot ## ls -alR                
> total 24
> drw-------   3 root     dovecot         512 Mar 06 15:27 ./
> drwxr-xr-x   3 root     system          512 Apr 18 2006  ../
> drw-------   2 root     dovecot         512 May 09 10:37 login/
> ./login:
> total 24
> drw-------   2 root     dovecot         512 May 09 10:37 ./
> drw-------   3 root     dovecot         512 Mar 06 15:27 ../
> srw-------   1 root     dovecot           0 May 09 10:37 default=
> -rw-------   1 root     dovecot         230 May 09 10:36 ssl-parameters.dat
>   
And restarted dovecot
> 4243 root at mercury:/var/run/dovecot ## dovecot
>   
but apparently /var/run/dovecot/login should be 750, but DC dealt with 
that automagically
> Warning: Corrected permissions for login directory /var/run/dovecot/login
> 4244 root at mercury:/var/run/dovecot ## ls -alR
> total 24
> drw-------   3 root     dovecot         512 Mar 06 15:27 ./
> drwxr-xr-x   3 root     system          512 Apr 18 2006  ../
> drwxr-x---   2 root     dovecot         512 May 10 12:47 login/
> ./login:
> total 24
> drwxr-x---   2 root     dovecot         512 May 10 12:47 ./
> drw-------   3 root     dovecot         512 Mar 06 15:27 ../
> srwxrwxrwx   1 root     dovecot           0 May 10 12:47 default=
> -rw-------   1 root     dovecot         230 May 09 10:36 ssl-parameters.dat
>   
...but then got in the syslog
> May 10 12:49:51 mercury mail:err|error dovecot: imap-login: Can't open SSL param
> eter file ssl-parameters.dat: Permission denied
> May 10 12:49:51 mercury mail:err|error dovecot: child 1380384 (login) returned error 89
>
>   
So I made it 640 which seems to do.
> 4246 root at mercury:/var/run/dovecot ## chmod 640 login/ssl-parameters.dat
> 4247 root at mercury:/var/run/dovecot ## ls -alR login                          
> total 24
> drwxr-x---   2 root     dovecot         512 May 10 12:47 ./
> drw-------   3 root     dovecot         512 Mar 06 15:27 ../
> srwxrwxrwx   1 root     dovecot           0 May 10 12:47 default=
> -rw-r-----   1 root     dovecot         230 May 09 10:36 ssl-parameters.dat
So it seems this will do (for others who obsess over things small)::
a) /var/run/dovecot can be 600, root:dovecot
b) /var/run/dovecot/login should be 750, root:dovecot
c) /var/run/dovecot/login/ssl-parameters.dat might be 640, root: dovecot

-- 
====
Stewart Dean, Unix System Admin, Henderson Computer Resources 
Center of Bard College, Annandale-on-Hudson, New York  12504  
sdean at bard.edu  voice: 845-758-7475, fax: 845-758-7035