Add information about how to set postfix permissions

[danielnelson]

closes #3591

Required for all PRs:

• Signed CLA.
• Associated README.md updated.
• Has appropriate unit tests.

[danielnelson]

@dynek Can you review?

[phemmer]

One caveat about these methods is that the directories in deferred are created on first use. So if they're created after these commands are run, then they'll need to be run again.

However in the case of ACL, you can set a default ACL, which should get inherited by the new directories (unless postfix is doing something silly like explicitly performing a chown instead of using a umask).

[phemmer]

It'll need execute as well to be able to read the dir. setfacl supports X (upper case) to only set execute bit on dirs, not files.

[danielnelson]

I added the +X to setfacl, and the setgid bit to chmod

[dynek]

Now getting:
Dec 16 08:02:52 server.host.tld postfix/postdrop[7766]: warning: mail_queue_enter: create file maildrop/6997.7766: Permission denied

Trying to fix it :-/

[dynek]

OK fixed it with a previous dump or permissions (ls -lsaR) and postfix check.

Will check it a bit later.

Apparently we should not be overriding chgrping of postdrop for some dirs.

[phemmer]

yeah, looks like the maildrop directory does utlize group permissions. So the chgrp should be targetted at just the active, deferred, hold, incoming, & maildrop dirs.

[dynek]

Not 100% tested but that seems OK

sudo chgrp -R telegraf /var/spool/postfix/{active,hold,incoming,deferred}
sudo chmod -R g+rXs /var/spool/postfix/{active,hold,incoming,deferred}
sudo usermod -a -G postdrop telegraf
sudo chmod g+r /var/spool/postfix/maildrop
sudo setfacl -Rdm u:telegraf:rX /var/spool/postfix/{active,hold,incoming,deferred,maildrop}

@phemmer what do you think?
What about adding telegraf to group postdrop, not sure about this one.

[danielnelson]

Updated proposed docs, can you review again?