showq permissions failure

[GoneWestCoast]

After a server restart, I keep getting:

Jan 30 12:17:30 prmx055 postfix/postqueue[26041]: fatal: Connect to the Postfix showq service: Permission denied

After a zmfixperms as root and a service restart:

[zimbra@email ~]$ mailq
postqueue: fatal: Connect to the Postfix showq service: Permission denied

RHEL5 here-- any suggestions?

EDIT: Upon further observation, it's been doing this since I built the server. What's my next logical troubleshooting step?

[iggy]

check your /etc/sudoers file for:

%zimbra ALL=NOPASSWD:/opt/zimbra/postfix-2.2.9/sbin/postfix, /opt/zimbra/postfix-2.2.9/sbin/postalias, /opt/zimbra/postfix 2.2.9/sbin/qshape.pl, /opt/zimbra/postfix 2.2.9/sbin/postconf,/opt/zimbra/postfix-2.2.9/sbin/postsuper

[GoneWestCoast]

%zimbra ALL=NOPASSWD:/opt/zimbra/postfix-2.4.3.3z/sbin/postfix, /opt/zimbra/postfix-2.4.3.3z/sbin/postalias, /opt/zimbra/postfix-2.4.3.3z/sbin/qshape.pl, /opt/zimbra/postfix-2.4.3.3z/sbin/postconf,/opt/zimbra/postfix-2.4.3.3z/sbin/postsuper


My version numbers are different than yours, but should be correct-- I'm on 5.0.1.

[czaveri]

Perhaps you have already checked this. But wanted to confirm that you have SELinux disabled.

[brian]

Rerun /opt/zimbra/libexec/zmfixperms as root. Sounds like your postfix/spool and postfix/sbin/* files don't have the right perms.

[GoneWestCoast]

Originally Posted by brian

Rerun /opt/zimbra/libexec/zmfixperms as root. Sounds like your postfix/spool and postfix/sbin/* files don't have the right perms.

Done so, issue continues.

SELinux is disabled.

postfix/spool is owned by postfix, and the group is postfix for everything except maildrop and public, where it's postdrop.

postfix/sbin:
lrwxrwxrwx 1 root root 53 Jan 23 12:15 mailq -> ../../../../opt/zimbra/postfix-2.4.3.3z/sbin/sendmail
lrwxrwxrwx 1 root root 53 Jan 23 12:15 newaliases -> ../../../../opt/zimbra/postfix-2.4.3.3z/sbin/sendmail
-rwxr-xr-x 1 root root 715796 Jan 2 22:24 postalias
-rwxr-xr-x 1 root root 406653 Jan 2 22:24 postcat
-rwxr-xr-x 1 root root 822822 Jan 2 22:24 postconf
-rwxr-sr-x 1 root postdrop 639202 Jan 2 22:24 postdrop
-rwxr-xr-x 1 root root 359377 Jan 2 22:24 postfix
-rwxr-xr-x 1 root root 396827 Jan 2 22:24 postkick
-rwxr-xr-x 1 root root 386626 Jan 2 22:24 postlock
-rwxr-xr-x 1 root root 365802 Jan 2 22:24 postlog
-rwxr-xr-x 1 root root 684349 Jan 2 22:24 postmap
-rwxr-sr-x 1 root postdrop 731520 Jan 2 22:24 postqueue
-rwxr-xr-x 1 root root 424747 Jan 2 22:24 postsuper
-r-xr-xr-x 1 root root 12846 Jan 9 19:17 qshape.pl
-rwxr-xr-x 1 root root 735940 Jan 2 22:24 sendmail

[brian]

Post the output of the following.

zmcontrol status
postqueue -p
netstat -an | grep showq

[GoneWestCoast]

[root@prmx055 ~]# su - zimbra
[zimbra@prmx055 ~]$ zmcontrol status
Host prmx055.reachlocal.com
antispam Running
antivirus Running
ldap Running
logger Running
mailbox Running
mta Running
snmp Running
spell Running
stats Running
[zimbra@prmx055 ~]$ postqueue -p
postqueue: fatal: Connect to the Postfix showq service: Permission denied
[zimbra@prmx055 ~]$ netstat -an | grep showq
unix 2 [ ACC ] STREAM LISTENING 780736 public/showq
[zimbra@prmx055 ~]$

[brian]

The postqueue binary should be setgid to the postdrop group so that it has permissions to view the maildrop directory. So a couple things could be happening.

- setguid bit on the postqueue binary is not set
- your filesystem is mounted without setuid support

Your perms should look something like this.

ls -ld /opt/zimbra/postfix/sbin/postqueue /opt/zimbra/postfix/spool/public/* /opt/zimbra/postfix/spool/maildrop
-rwxr-sr-x 1 root postdrop 730361 Jan 22 14:38 /opt/zimbra/postfix/sbin/postqueue
drwx-wx--- 2 postfix postdrop 4096 Jan 22 14:38 /opt/zimbra/postfix/spool/maildrop
srw-rw-rw- 1 postfix postfix 0 Jan 24 22:19 /opt/zimbra/postfix/spool/public/cleanup
srw-rw-rw- 1 postfix postfix 0 Jan 24 22:19 /opt/zimbra/postfix/spool/public/flush
prw--w--w- 1 postfix postfix 0 Jan 31 09:15 /opt/zimbra/postfix/spool/public/pickup
prw--w--w- 1 postfix postfix 0 Jan 31 09:16 /opt/zimbra/postfix/spool/public/qmgr
srw-rw-rw- 1 postfix postfix 0 Jan 24 22:19 /opt/zimbra/postfix/spool/public/showq

[GoneWestCoast]

Originally Posted by brian

The postqueue binary should be setgid to the postdrop group so that it has permissions to view the maildrop directory. So a couple things could be happening.

- setguid bit on the postqueue binary is not set
- your filesystem is mounted without setuid support

Your perms should look something like this.

That's exactly what I have--

[root@prmx055 log]# ls -ld /opt/zimbra/postfix/sbin/postqueue /opt/zimbra/postfix/spool/public/* /opt/zimbra/postfix/spool/maildrop
-rwxr-sr-x 1 root postdrop 731520 Jan 2 22:24 /opt/zimbra/postfix/sbin/postqueue
drwx-wx--- 2 postfix postdrop 4096 Jan 2 22:24 /opt/zimbra/postfix/spool/maildrop
srw-rw-rw- 1 postfix postfix 0 Jan 31 05:30 /opt/zimbra/postfix/spool/public/cleanup
srw-rw-rw- 1 postfix postfix 0 Jan 31 05:30 /opt/zimbra/postfix/spool/public/flush
prw--w--w- 1 postfix postfix 0 Jan 31 09:47 /opt/zimbra/postfix/spool/public/pickup
prw--w--w- 1 postfix postfix 0 Jan 31 09:48 /opt/zimbra/postfix/spool/public/qmgr
srw-rw-rw- 1 postfix postfix 0 Jan 31 05:30 /opt/zimbra/postfix/spool/public/showq