Knowledge base
A node that really runs without root privileges
Writing “not root” is not enough — it also has to be able to read its own files
The task. A sending node where the engine should not run as root — while fleet measurements showed that it does.
What it is made of:
- run-as-root — false selects the pmta user; it takes effect only after a restart;
- smtp-listener — for an unprivileged user every listener must sit above port 1024;
- log-file — a log path the pmta user can write to.
The parts have different scopes. All three are node-level. The file side — the owner of /etc/pmta, /var/lib/pmta, /var/log/pmta and the other node directories — is outside the configuration and belongs to the procedure.
How they interact. The manual states the port requirement and the restart requirement in different sections, and neither mentions the other. Together they explain why one line changes nothing. On top of that the manual advises raising the open file and process limits for the pmta user.
The main trap is writing run-as-root false and reloading the configuration. The line takes effect only after a restart, and an unprivileged engine cannot bring up a listener on ports 25 and 587: the node either stays under root or stops accepting mail.
What the Hub does. It does not apply it. The run-as-root line was removed from the templates on Aug 29, 2026: without the other parts of the pattern it changed nothing, and the complaint and bounce listener sits on port 25. Measurements on 27.08 and 29.08 showed that the engine on the nodes runs as root.
Recommended values
Three conditions and how to check each:
| Condition | Line or action | How to make sure |
|---|---|---|
| the pmta user | run-as-root false and a restart | ps -o user= -C pmtad |
| ports above 1024 | smtp-listener | ss -ltnp |
| file permissions | node directories owned by pmta | ls -ld /etc/pmta /var/lib/pmta /var/log/pmta |
The conditions for running without root, the restart and the limits come from the manual (§ 2.2.1, § 3.3.1.9, § 3.3.1.27). The setup itself is our hypothesis.
Example configuration
run-as-root false smtp-listener 0/0:2525log-file /var/log/pmta/pmta.log
Port 2525 is an example; after the edit the service needs a restart, not pmta reload.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
How to check on the node
Check which user the engine actually runs as:
ps -o user=,comm= -C pmtad
root in the first column means the line did not take effect or the node was not restarted.