Demo
Demo

Knowledge base

PMTA knowledge base›Mechanism§ 2.2

The group that grants management rights

pmta group
Membership instead of root rights

A way to allow node management without granting root rights.

The group’s numeric ID is worth setting in advance if it must match across machines: the package will create the group itself and choose an ID at its discretion, and changing it later means redoing permissions across all directories.

The main trap is choosing the group number too late. The package creates the group itself, with its own number; on several machines the numbers will diverge, and shared directories get foreign permissions. The number is set by creating the group before installation.
What the Hub does. It does not use it: the Hub goes to the node over SSH under the account set at connection — root by default — because it writes files to /etc/pmta, changes their owner and manages the service via systemctl. The pmta group is for those who work with the node by hand without root rights.
Recommended values

What membership gives:

Right Where it is stated
run pmta commands without root § 2.2
use the submission bindings § 2.2, § 7.1

Running the engine itself as non-root needs more: run-as-root false, listener ports above 1024 and file limits for the pmta user.

The group’s purpose, its automatic creation and choosing the number come from the manual (§ 2.2, § 7.1); the conditions for running as non-root are § 2.2.1. The summary is ours.
Example configuration
# create the group with the needed number before installing the package
groupadd -g 1500 pmtausermod -aG pmta operator
The number 1500 and the name operator are for illustration; what matters is that the number is the same on all machines.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · linux
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄

Related entries

1 relation

Works together with

Running without root privilegesThe procedure in which the mechanism is applied. § 2.2.1

Referenced from

Installing on LinuxThis is the very group that is created in advance when its numeric ID must match across machines. § 2.2What the submission bindings needA related mechanism: they work together. § 7.1

How to check on the node
Check the group and membership:
getent group pmta
id operator
The group number must be the same on all nodes where directories are shared.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.◇Headers the sender uses to control deliverySix control headers let the submitting side choose a stream, tag a message with a job, set signing options and the key, the envelope identifier and the schedule; each is allowed separately and per source.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security