Re: getmail configuration problem with "%(recipient)" and "%(local)" in [destination] MDA_external

Apologies for this delayed response, but other stuff got in the way.

I revised my getmail script extensively: its destination is now a
MultiSorter with two MDA_external  branches: 

- the 'landout' branch uses procmail to deliver requests to my 'landout'
  user

- the default branch uses my original postfixfilter script to deliver
  everything else to my local postfix MTA for delivery on my LAN

The default branch is working perfectly but I'm having problems with the
'landout' branch. Initially it complained about being unable to access
the destination mailbox, so I added the 'user' and 'group' assignments,
but it is now complaining that it can't execute them:

"Delivery error (command procmail 858311 error (127, exec of command
 procmail failed (change UID/GID to 1528/100 failed ([Errno 1] 
 Operation not permitted))))".

I've assumed, because getmail accepts the user and group requests, that
it can therefore apply them to running procmail, but evidently this
isn't the case, so how should I make this happen?

I've attached this configuration file.      

Thanks,
Martin Gregorie


On Mon, 2020-02-10 at 09:07 -0600, Charles Cazabon wrote:
> Martin Gregorie <[email protected]> wrote:
> > Now, however, I want to direct incoming mail for the 'landout' user
> > to a
> > local user on the system that is running getmail. So, I modified the
> > configuration by replacing "kiwi" in the [destination] MDA_external
> > arguments, first with "(%recipient)" and, when that failed to
> > deliver
> > any incoming mail, I changed "%(recipient)" to "%(local)". This too
> > failed to work. So, I set "[options] verbose = 2" and got an error
> > report (attached as "error_report.txt"). As far as I can tell from
> > reading the configuration section of the manual, both versions
> > should
> > work, but don't.
> 
> You missed the part about those substitution variables:
> 
>   If the message is retrieved with a multidrop retriever class, the 
>   message recipient (and parts of it) are also available with the 
>   following replacement substrings: 
>   [... (local), (recipient), etc...]
> 
> Those substitutions don't exist if you don't use a multidrop retriever
> class.
> Note that such classes require your account to actually *be* a proper
> multidrop/domain mailbox.  See the FAQ for more on this.
> 
> > In case you're wondering, /usr/local/bin/postfixfilter is a locally
> > written shell script. It passes each received message through
> > Spamassassin, quarantines spam and uses the Postfix version of
> > sendmail
> > to pass ham to my local Postfix MTA for delivery in my LAN via
> > Dovecot.
> > The script expects four arguments in the order shown and has been
> > working well until I changed getmailrc as I described.
> 
> OT but probably needs looking at: within that script you appear to be
> constructing a shell command to pass to something else:
> 
> > SimplePOP3Retriever:[email protected]@shcp17.hosting.zen.n
> > et.uk:110:
> > command MDA_external postfixfilter (allow_root_commands="True",
> > arguments="('-f', '%(sender)', '--', '%(local)')",
> > command="postfixfilter", group="None", ignore_stderr="True",
> > path="/usr/local/bin/postfixfilter", unixfrom="False", user="None"):
> > sh: -c: line 0: syntax error near unexpected token `('
> 
> See the embedded shell command complaining about the string you're
> passing to
> the -c option?  That's probably *very* bad.  If you're doing passing
> any of
> the values getmail extracts from the message or metadata into this
> script, and
> that script then puts it in a string it passes to a shell, you're
> probably
> opening yourself up to a remote exploit.
> 
> > - should my requirement be rewritten as two getmail configuration
> >   files, one to filter off messages for 'landout' and the rest for
> >   delivery to 'kiwi'?
> 
> You're not going to be able to do this unless you have a
> multidrop/domain
> mailbox and change your retriever config.  If you want to filter based
> on the
> To:, cc:, etc fields, use a MultiGuesser destination, which can then
> handle
> landout and the rest differently.
> 
> Or you can always use a filtering MDA.
> 
> Charles

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

[retriever]
type =  MultidropPOP3Retriever
server = shcp17.hosting.zen.net.uk
username = [email protected]
password = cycloN06
envelope_recipient = Envelope-To:1

[destination]
type=MultiSorter
default = [kiwi-default]
locals = (
           ( 'landout', '[landout]' ),
         )

[landout]
type = MDA_external
path = /usr/bin/procmail
arguments = ("-f", "%(sender)", "-d", "[email protected]", )
allow_root_commands = true
user = landout
group = users

[kiwi-default] 
type = MDA_external 
path = /usr/local/bin/postfixfilter
arguments = ( "-f", "%(sender)", "kiwi", )
allow_root_commands = true
ignore_stderr = true

[options]
read_all = False
delete_after = 1
message_log_syslog = false
message_log_verbose = false
verbose = 0