[Solved] Users smtpd and smtpq: can I delete them?

Xwang · 2021-08-09 09:47:20

Executing a system audit with Lynis, it complains that home directories for smtpd and smtpq are not strict enough:

2021-08-06 17:15:23 ====
2021-08-06 17:15:23 Performing test ID HOME-9304 (Check if users' home directories permissions are 750 or more restrictive)
....
2021-08-06 17:15:23 Test: checking directory '/' for user 'smtpd'
2021-08-06 17:15:23 Result: permissions of home directory / of user smtpd are not strict enough. Should be 750 or more restrictive. Change with: chmod 750 /
2021-08-06 17:15:23 Test: checking directory '/var/spool/smtpd' for user 'smtpq'
2021-08-06 17:15:23 Result: permissions of home directory /var/spool/smtpd of user smtpq are not strict enough. Should be 750 or more restrictive. Change with: chmod 750 /var/spool/smtpd
....
2021-08-06 17:15:23 Suggestion: Double check the permissions of home directories as some might be not strict enough. [test:HOME-9304] [details:-] [solution:-]

Can I safely delete these users?
What are they for?

Last edited by Xwang (2021-08-09 14:22:00)

Trilby · 2021-08-09 12:15:31

They are precisely whatever you created them to be. From the name, they would be for running a mail server, but it doesn't appear that postfix uses this user name (anymore?).

Are you running a mail server? How old / new is this installation? Is this vanilla arch linux, or which spinoff / derivative distro is this?

That said, given that this is a mail server spool directory, it should probably not have the same permissions as an actual user directory, so the "security" tool you are using is giving a pretty silly false positive. But the fact that you don't know why this user and directory exists is indicative of a problem. If you didn't create them, someone with root access on your machine did.

Last edited by Trilby (2021-08-09 12:20:29)

Xwang · 2021-08-09 13:23:57

Trilby wrote:

They are precisely whatever you created them to be. From the name, they would be for running a mail server, but it doesn't appear that postfix uses this user name (anymore?).
Are you running a mail server? How old / new is this installation? Is this vanilla arch linux, or which spinoff / derivative distro is this?
That said, given that this is a mail server spool directory, it should probably not have the same permissions as an actual user directory, so the "security" tool you are using is giving a pretty silly false positive. But the fact that you don't know why this user and directory exists is indicative of a problem. If you didn't create them, someone with root access on your machine did.

I installed archlinux on this pc at the beginning of 2016.
So maybe since then I've installed a lot of things that I've forgotten.
Indeed I've msmtp and msmtp-mta installed because I've a script which send me an email every time it is executed.
When I installed it I had it to send me an email to a google mail because I didn't manage to send me an email to my local user.
So is it better to uninstall those packages (removing those users) and install postfix instead?

Trilby · 2021-08-09 13:31:48

Xwang wrote:

So is it better to uninstall those packages (removing those users) and install postfix instead?

No.

Postfix would create it's own user and directory which your "security" tool would have similar complaints about. I just referred to postfix as I believed (maybe assumed) that it was the typical mail server used. I know of no reason to prefer it over msmtp. If you are using msmtp, that explains what that user and user dir is for - so there is no problem.

(I just checked out Lynis as I found it odd that a security tool would not be aware of common mail servers. It has a config file that is only root-readable which requires the program to be run as root for no valid reason when the config file should be at least world readable. That's not security, that's stupidity. Like most "security testing" tools, it seems that the real test is whether or not you use it. I wont.)

Last edited by Trilby (2021-08-09 13:39:16)

Xwang · 2021-08-09 14:21:42

Thank you.
Anyway I've removed those users since the msmtp's wiki page does not mention them.
The script keeps sending emails. So probably they were two user left from a previously installed smtp like program.

Arch Linux

#1 2021-08-09 09:47:20

[Solved] Users smtpd and smtpq: can I delete them?

#2 2021-08-09 12:15:31

Re: [Solved] Users smtpd and smtpq: can I delete them?

#3 2021-08-09 13:23:57

Re: [Solved] Users smtpd and smtpq: can I delete them?

#4 2021-08-09 13:31:48

Re: [Solved] Users smtpd and smtpq: can I delete them?

#5 2021-08-09 14:21:42

Re: [Solved] Users smtpd and smtpq: can I delete them?

Board footer