search

ClusterLabs / resource-agents

Combined repository of OCF agents from the RHCS and Linux-HA projects
GNU General Public License v2.0
489 stars 577 forks source link

Postfix RA continuously fails validate check #1881

Closed Tnthr closed 11 months ago

Tnthr commented 1 year ago

The postfix RA uses a few checks to confirm directories have the correct permissions. When it checks whether the data directory is writeable it uses su which fails with an authentication failure. Using sudo to perform the command as the postfix user is a more reliable way. See the sample below which runs through the checks performed by the script on an interactive shell and the difference in the su vs sudo commands.

root@node3:~# postconf $OPTION_CONFIG_DIR -h mail_owner
postfix
root@node3:~# postconf $OPTION_CONFIG_DIR -h data_directory
/var/lib/postfix
root@node3:~# sudo -u postfix test -w /var/lib/postfix/
root@node3:~# echo $?
0
root@node3:~# sudo -u postfix test -w /root
root@node3:~# echo $?
1
root@node3:~# su -s /bin/sh - postfix -c "test -w /var/lib/postfix"
su: Authentication failure
root@node3:~# echo $?
1

PR to fix this Update postfix probe from su to sudo #1880

Tested with resource-agents v4.11.0

Test machine specs Ubuntu Server 22.10 Linux node3 5.19.0-1022-raspi #29-Ubuntu SMP PREEMPT

Tnthr commented 11 months ago

Problem was actually caused by postfix user not existing in /etc/shadow. su fails with auth failure because of this. Should be fixed regardless with the merge of #1880 and its use of runuser.