chriswayg / ansible-msmtp-mailer

:a: This ansible role deploys msmtp as a mailer for Debian, Ubuntu, Arch & Alpine
https://galaxy.ansible.com/chriswayg/msmtp-mailer/
Apache License 2.0
15 stars 17 forks source link

Make permissions on /etc/msmtprc configurable #6

Closed jordemort closed 3 years ago

jordemort commented 3 years ago

This pull request makes the ownership and permissions of /etc/msmtprc configurable. I want this so that I can make the group of the file msmtp and the permissions 0640, so random processes can't get at my SMTP credentials.

colans commented 3 years ago

While it sounds great in theory, I can't get it work with those file permissions:

$ echo "Test mail from new/updated mSTMP\n\n $(uname -a)" | mail -s "Test mSMTP at $(hostname -f)" root
send-mail: account default not found: no configuration file available
Can't send mail: sendmail process failed with error code 78

As soon as I change it back to the defaults, it works again.

jordemort commented 3 years ago

@colans Works for me on Ubuntu 20.04 machines - I think msmtp-mta there sets things up to run with setgid msmtp

colans commented 3 years ago

That was on 20.04. :)

jordemort commented 3 years ago

@colans On my 20.04 machine, mstmp is installed setgid mstmp:

ansible@wolfgang:~$ ls -al /usr/bin/msmtp
-rwxr-sr-x 1 root msmtp 139160 Aug 20 16:24 /usr/bin/msmtp

Not sure why it isn't on yours, I didn't do anything special to make that happen. However, this PR doesn't change the default permissions; if you don't set msmtprc_owner / msmtprc_group / msmtprc_mode, then everything should continue to work as it did before. Assuming you know you have a configuration where more restrictive permissions will work, this PR allows you to opt-in to more restrictive permissions.

colans commented 3 years ago

Thanks for clarifying. Turns out that mine is the same so there must be something else going on. 👍 then.

chriswayg commented 3 years ago

thanks for your PR