Re: Unit for getmail (was: daemontools)

Hi

Looks like I've tripped over an expert. :-)

Am Mittwoch, 31. Januar 2018, 21:27:14 CET schrieb Daniel Kahn Gillmor:
> On Thu 2018-02-01 03:12:48 +0100, Volker Wysk wrote:
> > [Unit]
> > Description=Getmail für [email protected]
> > Wants=dovecot.service
> > After=dovecot.service
> >
> > [Service]
> > ExecStart=/usr/bin/getmail --getmaildir=/etc/getmail --rcfile=verteilerrc --idle INBOX
> > Restart=always
> >
> > [Install]
> > WantedBy=multi-user.target
> > ----snip----
> >
> > This goes to /etc/systemd/system/getmail-verteiler.service. Then, it needs to be activated:
> >
> > systemctl enable verteilerrc.service
> > systemctl start verteilerrc.service
> 
> this installs the service as a sytsem service, and it looks like it's
> running as the superuser.  
> 
> That seems ill-advised.
> 
> I recommend making it a per-user service (not a system service).  in
> that case, it would run as the user whose service it is.

I know next to nothing about Systemd. I've just taken this unit file from https://joel.porquet.org/wiki/hacking/getmail_dovecot/, and modified it a little. 

I have my own Dovecot mail server, which is installed system-wide, with accounts for my local users (umm, thats exactly one user for now). So I thought, getmail should be system-wide too. 

> Alternately, if you really need it to be a system service, you could
> constrain its privileges by providing a User= directive (at least).  On
> the principle of least privilege, you probably want to try to make sure
> that such a system service can *only* inject mail into a specific
> account, 

This would need a feature of dovecot-lda (the Dovecot LDA, which is called by getmail). I don't think it's supported.

> and is otherwise constrained by the local operating system from
> doing any other (mis)behavior.

Should I configure getmail to run as my local user? That wouldn't be right, if I should have several users in the future... Introduce a dedicated getmail user? But the local users should have their own getmaildir, which they can write, and store their getmail configuration in... So setting up a per-user service looks like the clean way. Do you know a short guide for this?

> Additionally, the explicit dependency on the local dovecot service also
> seems strange to me.  It's not clear to me that everyone who uses
> getmail will want it to interact with dovecot.  if that's unique to your
> setup, that's fine; but as an example for other people to use it seems
> odd.

I'm using getmail to feed my dovecot mail server, nothing else...

 
> finally, can you explain why you use both --getmaildir and --rcfile ?
> why not just --rcfile=/etc/getmail/verteilerrc ?

I think getmail needs to know in which directory to store its "oldmail-*" files. I had tried it with just --rcfile, but it doesn't work:

desktop ~ % getmail --rcfile=/etc/getmail/verteilerrc
Error: Default config/data dir "/root/.getmail/" does not exist - create or specify alternate directory with --getmaildir option


Bye
Volker