5

I am trying to use ssmtp as my command line mail application as proposed in this answer.

One of the steps is to put my mail account password in a file /etc/ssmtp/ssmtp.conf. Since the file has read permission for all users, it undermines the secrecy of my password.

How to overcome this? I tried to remove the read permission for group and others but then ssmtp does not work anymore.

3 Answers 3

7

The answer is contained within the sample ssmtp.conf file - it reads as follows (taken from http://wiki.debian.org/sSMTP);

#### VERY IMPORTANT !!! If other people have access to this computer
# Your GMAIL Password is left unencrypted in this file
# so make sure you have a strong root password, and make sure
# you change the permissions of this file to be 640:
# chown root:mail /etc/ssmtp/ssmtp.conf
# chmod 640 /etc/ssmtp/ssmtp.conf"
1
  • 1
    i am getting this error: "ssmtp: Cannot open mailhub:25"
    – bubble
    Jan 2, 2013 at 17:28
5

I think the best way is to create a technical user for ssmtp. There is a nice tutorial for that on https://wiki.freebsd.org/SecureSSMTP

Here is an excerpt from it, step 4,5,6,8,9 is what you're looking for (the paths may differ according to your linux distribution, I've customized it for Debian now):

[Step 4] Create an ssmtp user:

sudo useradd -g nogroup -M -s /bin/false -c "sSMTP pseudo-user" ssmtp

This will stick the ssmtp user in the nogroup group, disallowing password-based logins (-h).

[Step 5] Set the correct owner and permissions on the sSMTP configuration directory. We set the setuid bit (see chmod(1) to make sure new files in the directory will be owned by the user ssmtp as well:

cd /etc/ssmtp
chown ssmtp:wheel .
chmod 4750 .

[Step 6] Create the sSMTP configuration file with the correct permissions:

sudo cp ssmtp.conf.sample ssmtp.conf
sudo chown ssmtp:wheel . ssmtp.conf
sudo chmod 640 ssmtp.conf

[Step 8] Make the ssmtp executable owned by the ssmtp user and mark it SUID:

chown ssmtp:nogroup /usr/sbin/ssmtp
chmod 4555 /usr/sbin/ssmtp

[Step 9] Run some tests as an unprivileged user:

$ cat /etc/ssmtp/ssmtp.conf
cat: /etc/ssmtp/ssmtp.conf: Permission denied
$ sendmail [email protected] < /etc/rc.conf
3

Try invoking ssmtp as a regular user instead and specifying a custom configuration file location.

From the manpage of ssmtp(8):

-Cfile Use alternate configuration file.

Put your configuration file in a safe place in your home directory without read permission for others. Then run ssmtp like this:

user@host:~$ ssmtp -C/path/to/somesecuredir/ssmtp.conf [options]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .