Is my external maildir secure?

gelcom

Hi all, sorry for NOOB question but here I go.

First of all I’d like to thank to all MailCow supporters as this is a wonderfull resource.

My issue is the following:

I have a working MailCow setup but I changed MailDir to an external SAMBA share folowing this official guide.

Instead of pointing to a bind mount I directly pointed maildir volume to my samba share as follows:

I included on /opt/mailcow-dockerized/docker-compose.override.yml

version: '2.1'
volumes:
  vmail-vol-1:
    driver_opts:
      type: cifs
      device: "\\192.168.1.1\tank"
      o: "username=user,password=passwd,uid=5000,gid=5000,forceuid,forcegid"

So far so good. All works as expected.

Problem is:
if I go to any subdirectory in maildir volume I get all files with different permissions from the same directory if maildir was not mounted on external share. Please note:

Without volume external mount:

root@mail:# ls -la /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/myemail.com.br/lixo/Maildir/
total 48
drwx------ 10 5000 5000 4096 Oct 19 12:04 .
drwx------  3 5000 5000 4096 Oct 19 12:04 ..
drwx------  5 5000 5000 4096 Oct 19 12:04 .Archive
drwx------  2 5000 5000 4096 Oct 19 12:04 cur
-rw-------  1 5000 5000    0 Oct 19 12:04 dovecot-acl-list
-rw-------  1 5000 5000  143 Oct 19 12:04 dovecot-uidlist
drwx------  5 5000 5000 4096 Oct 19 12:04 .Drafts
drwx------  5 5000 5000 4096 Oct 19 12:04 .Junk
-rw-------  1 5000 5000    0 Oct 19 12:04 maildirfolder
drwx------  2 5000 5000 4096 Oct 19 12:04 new
drwx------  5 5000 5000 4096 Oct 19 12:04 .Sent
-rw-------  1 5000 5000   36 Oct 19 12:04 subscriptions
drwx------  2 5000 5000 4096 Oct 19 12:04 tmp
drwx------  5 5000 5000 4096 Oct 19 12:04 .Trash

All files are -rw——- and all dirs are drwx——

With external mount:

root@mail:# ls -la /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/myemail.com.br/lixo/Maildir/
total 2
drwxr-xr-x 2 5000 5000   0 Oct 19 11:52 .
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 ..
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Archive
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 cur
-rwxr-xr-x 1 5000 5000   0 Oct 19 11:45 dovecot-acl-list
-rwxr-xr-x 1 5000 5000 106 Oct 19 11:45 dovecot-uidlist
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Drafts
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Junk
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 new
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Sent
-rwxr-xr-x 1 5000 5000  36 Oct 19 11:45 subscriptions
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 tmp
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Tras

All files are -rwxr-xr-x and all dirs are drwxr-xr-x

I also noted then when I mount the external volume I cannot CHMOD any file. If I try to chmod any file it silently fails. Please see:

root@mail:# chmod 700 /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/myemail.com.br/lixo/Maildir/subscriptions
root@mail:# ls -la /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/myemail.com.br/lixo/Maildir/
total 2
drwxr-xr-x 2 5000 5000   0 Oct 19 11:52 .
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 ..
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Archive
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 cur
-rwxr-xr-x 1 5000 5000   0 Oct 19 11:45 dovecot-acl-list
-rwxr-xr-x 1 5000 5000 106 Oct 19 11:45 dovecot-uidlist
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Drafts
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Junk
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 new
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Sent
-rwxr-xr-x 1 5000 5000  36 Oct 19 11:45 subscriptions
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 tmp
drwxr-xr-x 2 5000 5000   0 Oct 19 11:45 .Trash

Note that subscriptions still -rwxr-xr-x even after chmod 700 that silent fails.

Is it safe these “new” permissions on mounted share?
Why can’t I chmod external mounted share?

My smb.conf on remote host is very permissive:

[tank]
   browseable = yes
   read only = no
   hosts allow = 192.168.0.0/16
   path = /tank/j
   create mask = 0775

kind regards

aaronsmith

Samba has its own permissions separate from the server mounting it. Individual file permissions are now managed on the SMB host, not the mailcow host mounting the share. An SMB share will be subject to both SMB permissions and the local file permissions set on the SMB host itself.

Hard to say if your configuration is secure per this thread’s subject line. First thing that comes to my mind is why you are moving the maildir to an external share?

Another option to consider is using your SMB share for regular backups of your mailcow data vs. adding a layer of complexity to your design (e.g. if the SMB host/share goes down, so does your mail system.)

https://docs.mailcow.email/backup_restore/b_n_r-backup/

gelcom

Hi, thanks for the reply.

I understand now that samba share has its own permissions and they are fixed so I cannot change them after the share is mounted. A few days ago I found this relevant information on man cifs that confirms: “The core CIFS protocol does not provide unix ownership information or mode for files and directories. Because of this, files and directories will generally appear to be owned by whatever values the uid= or gid= options are set, and will have permissions set to the default file_mode and dir_mode for the mount.”

So as far as I understand there is no way I can mount an external samba share to accomodate my maildir.

The big problem I face and I humbly assume that is the problem a lot of other people is that hosting a mail server is a storage resource heavy task altough it’s not a heavy task from a processing power point of view so I assume it’s possible to run the mail server on a thin server but with the need of big storage. In this case the optimal approach would be a thin server with a big external storage so I/we can keep the costs balanced. A lot of people run mail servers on 1-2 vCPUs VPSs with not so big storages and sooner or later it will get into problems not because of processing/memory power but because of storage limits. Running mailcow with external storage can unleash this limits very easy.

I also tryed to mount an external NFS share to host my maildir with no luck either as docker needs root privileges to chmod his maildir sobdirectories (what’s not so secure wise) or mount NFS share with “all_squash” and map all users to the same anonuid/anongid which brings me to the same fixed permission problems I have with CIFS.

I’m in a dead end here.

Please kindly note my problem does not relate at all with backups.

Advices are welcomed.

Ps. sorry for my poor English

kind regards

aaronsmith

I see, so you need to move your Maildir because of disk capacity.

I came across this, I would put in context with the filesystem used by your mailcow server (may not be ext4):
mailcow/mailcow-dockerized2184

I store the vmail and attachment volume of mailcow on a samba share. On a samba share is no real permission managment possible and so I created a sparse image with ext4 inside. There I created a directory and use this for mailcow. Some overhead is being added through the additional filesystem but I didn’t noticed anything bad yet.

Note the final sentence in case you decide to try the above:

The database shouldn’t be stored remotely for performance reasons.

gelcom

Thanks for the reply. Can you help me understand how to achieve this? It’s not clear to me yet.

Kind regards

aaronsmith

I’ve never created a sparse image myself, so I don’t know. Recommend searching the web for guides on this. Reason I don’t want to try and point you to specific articles is because I don’t know (1) your Linux distro (2) the filesystem you’re using.