Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.9

run-as-root

Globalcriticalrestart required

Run as root or as the pmta user
in the configuration this is a linerun-as-root trueinside the block Global
Whose identity the mail server runs under

Chooses whether PowerMTA runs as root or as the unprivileged pmta user. To run as pmta the value must be false — and this is not an on-the-fly switch: changing it requires a service restart.

The default is root. A missing line means running with full privileges, not the other way around. When reading someone else’s configuration, remembering this matters more than it seems: unprivileged operation is enabled only explicitly.

A configuration reload does not pick up this line. The file will be updated and the value will become false, but the process stays the same, with the same privileges — until the service restarts. Hence nodes whose configuration says one thing while the system shows another.

What has to be fixed along with it. The manual lists three requirements at once: the value false, listener ports above 1024 and raised file and process limits via /etc/security/limits.conf. And when switching from root to pmta — also changing the owner of the engine’s five directories: settings, state, logs, spool and installation. The files there were created by root, and without this the node will run into permission denials.

The main trap. Ports. A node switched to pmta without moving its listeners above 1024 simply will not start — and it will say so in a separate startup error file, not in the regular log. The second most common case is quieter: the configuration was applied with a reload, it says no, and the process keeps running as root just as it did.
What the Hub does. It does not write it — the line was removed from the templates on Aug 29, 2026.

Why it was removed rather than finished. § 2.2.1 requires four things at once: false, listener ports above 1024, limits in /etc/security/limits.conf and changing the owner of the engine’s five directories. Only one was being done — the line itself. The complaint listener stayed on port 25, the installer raised limits with a ulimit command inside the connection session, which closes right away, and changed the owner of two directories out of five, and only for an rpm install. Measurements on 27.08 and 29.08 showed the result: the processes on the nodes ran as root, because a configuration reload does not pick up this line, and a reload is exactly how the Hub applies configuration.

Meanwhile the line lied: whoever opened the configuration read “the node is unprivileged.” What was removed was the appearance, not protection — the nodes’ behavior did not change.

Recommended values

One line is not enough. It switches on the intent, not the result. A working unprivileged installation is false plus ports above 1024 plus limits in limits.conf plus permissions on the engine’s directories.

A restart, not a reload. The only way to apply it is to stop and start the service; delivery stops for that time, so the value is worth changing in a maintenance window, not “in passing.”

Check by the process, not by the file. What is written in the configuration says nothing about whom the node is running as right now.

All from the manual: the default, the restart requirement and the three conditions for unprivileged operation from the installation section.
Example configuration
# switching to the pmta user — takes effect only after a restart
run-as-root no# the listener ports must then be above 1024
smtp-listener 0/0:2525
smtp-listener 0/0:2526
The directive line is from the manual; the neighboring ones show the requirement without which the node will not start under pmta — with such a switch, report receiving moves off port 25, and something has to forward it.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends4 mistakes▶

Applying the change with a configuration reload

§ 3.3.1.9

What it costsA reload updates the file but does not change the identity of the running process. The node stays with full privileges indefinitely while the configuration claims otherwise — and it gets read as the truth.
How to spot itThe configuration has run-as-root no, but the engine process runs as root. And there is not a single error.
How to do it rightRestart the service and check the process owner; without checking, what has been done cannot be told apart from what has been written.

Switching to pmta while leaving the listener on port 25

§ 2.2.1

What it costsAn unprivileged process cannot take ports below 1024. The reason for the failure goes into a separate startup error file, where nobody looks for it.
How to spot itAfter a restart the service does not come up, and the regular log is empty.
How to do it rightMove the listeners above 1024, and hand port 25 over to forwarding or to something that can hold a privileged port.

Changing the value without changing the directories' owner

§ 2.2.1

What it costsThe files in the engine’s five directories were created by root. The spool hurts most: the node will not be able to write the queue, that is, it will accept a message and lose it.
How to spot itThe service starts and immediately crashes on permission denials — or runs but does not write accounting and logs.
How to do it rightChange the owner of all five directories to pmta before the restart, not after.

Treating ulimit in a connection session as a node setting

§ 2.2.1

What it costsulimit applies only inside the shell where it was run and goes away when that shell closes. The service starts with its own limits — the ones recorded in the system.
How to spot itThe limits have been “raised,” yet the service still hits a little over a thousand descriptors.
How to do it rightWrite the limits into /etc/security/limits.conf (or into the service unit) and check them on the running process, not in your own session.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
run-as-root <boolean>
Values
yes | no | true | false; the default is true, that is, running as root
Default
true § 3.3.1.9
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
There is no inheritance: this is a property of the process as a whole, and it never has a narrower scope. The line lives at the root of the file. A reload (pmta reload) does not apply it — only a service restart does.
⇄

Related directives

3 relations

Conflicts with

Reloading settings versus restarting the serviceOne of the few directives for which a reload is not enough: changing it requires a service restart. § 3.3.1.9smtp-listenerGlobalFor an unprivileged user every listener has to sit above port 1024. § 2.2.1

Applies to

Running without root privilegesA related procedure: they share some of the steps. § 2.2.1

How to check on the node
Only the system knows whom the node actually runs as:
ps -o user= -C pmtad
pmta — the switch happened, root — it did not, no matter what the configuration says. Check after every apply that touched this line: a reload does not pick it up.
◇

What else to read

3 articles

◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.◇Accept, route, deliverA message’s path inside the node: accept, decide where, deliver — and all the settings live between these three steps.◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.

In the Hub
Managed at
Infrastructure → Node parameters
Cost of a mistake
disruptive: applying it interrupts the node
Scenarios
Configuration lifecycle · Node security
Priority
critical
Neighboring settings of the block Global:http-accesshttp-api-keyhttp-csrf-protectionhttp-redirect-to-httpslog-file-world-readableAll 108 directives of the block →