Demo
Demo

Knowledge base

PMTA knowledge base›Procedure§ 2.2.1

Running without root privileges

Start PowerMTA as non-root user pmta
Writing “not root” is not enough — the engine has to be able to read its own files

Starting with 5.5r3, the engine, the web monitor and the command tool can run as the pmta user: sudo -u pmta pmtad, sudo -u pmta pmtahttpd, sudo -u pmta pmta. Right after installation pmta is a user without login.

The conditions are mandatory: run-as-root false and listeners above port 1024; on top of that the nofile and nproc limits in /etc/security/limits.conf may need raising.

A node that ran as root will trip over permissions: the owner of /etc/pmta, /var/lib/pmta, /var/log/pmta, /var/spool/pmta and /opt/pmta is changed by hand, for example with chown -R pmta:pmta.

The main trap is changing the line without changing the owner. A node that ran as root will not be able to write to its own directories after the switch: the manual explicitly warns about permission errors.
What the Hub does. It does not perform it. The run-as-root line was removed from the templates on Aug 29, 2026: one line did not move the node over, and the other steps were never done in full — the owner was changed on two directories out of five, limits were raised with ulimit inside the installation session, and the complaint and bounce listener stayed on port 25. Measurements on 27.08 and 29.08 showed that the engine on the nodes runs as root.

The Hub places configuration files with the owner pmta — that is file permissions, not a change of the user the engine runs as.

Recommended values

Conditions and how to check each:

Condition How Check
run-as-root false the line and a restart ps -o user= -C pmtad
ports above 1024 smtp-listener ss -ltnp
limits pmta hard nofile 100000, pmta hard nproc 100000 sudo -u pmta sh -c ‘ulimit -Hn’
directory owner chown -R pmta:pmta of the five directories ls -ld /var/spool/pmta
The conditions, limits, directories and start commands come from the manual (§ 2.2.1, § 3.3.1.9). The table is ours.
Example configuration
# limits for the pmta user, the manual's example
pmta hard nofile 100000
pmta hard nproc 100000
The lines are appended to /etc/security/limits.conf; they apply to new user sessions.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · linux
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄

Related entries

4 relations

Does not work without

run-as-rootGlobalThe directive this step sets. § 2.2.1

Works together with

The group that grants management rightsThe mechanism this step relies on. § 2.2.1Restrict who can reach the node at allA related procedure: they share some of the steps. § 1.6.1

Affects

Node backup and restoreA related procedure: they share some of the steps. § 1.8

Referenced from

Who took the portThe procedure in which the mechanism is applied. inferenceStarting and stopping the engineChanging the user is one of the few edits that cannot avoid a stop. § 4.1.3

How to check on the node
Check which user the engine runs as and who owns the directories:
ps -o user=,comm= -C pmtad
ls -ld /etc/pmta /var/lib/pmta /var/log/pmta /var/spool/pmta /opt/pmta
root on the process means the switch did not happen; root on a directory means the engine will not write to it after the switch.
◇

What else to read

3 articles

◇What protects the web monitor and what that protection is notThree different protections — an address list, encryption and advice not to expose the monitor to the internet; there is not a single account.◇How the node decides whether to let an HTTP request inTwo ways to identify yourself — an access level by address and a key; the key is stronger and works from any address.◇The activation key is a prerequisite for installation, not a step after itWithout an activation key from SparkPost support the engine neither installs nor runs, and the license tier sets the outbound connection ceiling: on Standard everything above 200 is ignored.

In the Hub
Cost of a mistake
disruptive: applying it interrupts the node
Scenarios
Prepare a node for sending · Node security