starred/anonaddy

Fork 0

mirror of https://github.com/anonaddy/anonaddy.git synced 2026-04-25 06:05:55 +03:00

[GH-ISSUE #272] Possible rspamd permission issue in SELF-HOSTING.md #795

New issue

Closed

opened 2026-03-14 10:39:02 +03:00 by kerem · 3 comments

kerem commented

2026-03-14 10:39:02 +03:00

Owner

Originally created by @makua104 on GitHub (Feb 24, 2022).
Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/272

I ran into an issue when moving from OpenDKIM and OpenDMARC to Rspamd. A few instructions in the SELF-HOSTING.md file seem to create files owned by root, such as

sudo cp /etc/rspamd/local.d/dkim_signing.conf /etc/rspamd/local.d/arc.conf

and

echo "enabled = false;" | sudo tee -a /etc/rspamd/override.d/module_name.conf

This results in errors similar to

rspamd_config_read: failed to load config: ucl parser error: cannot open file /etc/rspamd/local.d/arc.conf: Permission denied

when rspamd.service is run as the _rspamd user, which I think is done by default. Rspamd fails to start and errors like connect to Milter service inet:localhost:11332: Connection refused appear in /var/log/mail.log when sending from a recipient address, which led to AnonAddy thinking they were spoofed.

Originally created by @makua104 on GitHub (Feb 24, 2022). Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/272 I ran into an issue when moving from OpenDKIM and OpenDMARC to Rspamd. A few instructions in the `SELF-HOSTING.md` file seem to create files owned by root, such as ``` sudo cp /etc/rspamd/local.d/dkim_signing.conf /etc/rspamd/local.d/arc.conf ``` and ``` echo "enabled = false;" | sudo tee -a /etc/rspamd/override.d/module_name.conf ``` This results in errors similar to ``` rspamd_config_read: failed to load config: ucl parser error: cannot open file /etc/rspamd/local.d/arc.conf: Permission denied ``` when `rspamd.service` is run as the `_rspamd` user, which I think is done by default. Rspamd fails to start and errors like `connect to Milter service inet:localhost:11332: Connection refused` appear in `/var/log/mail.log` when sending from a recipient address, which led to AnonAddy thinking they were spoofed.

kerem closed this issue

2026-03-14 10:39:08 +03:00

kerem commented

2026-03-14 10:39:13 +03:00

Author

Owner

@willbrowningme commented on GitHub (Mar 3, 2022):

All files in the /etc/rspamd directory are owned by root with group root. The Rspamd main process should start as root and then drops privileges. Have you checked for any solutions on the Rspamd repo?

@willbrowningme commented on GitHub (Mar 3, 2022): All files in the `/etc/rspamd` directory are owned by `root` with group `root`. The Rspamd main process should start as root and then drops privileges. Have you checked for any solutions on the [Rspamd repo](https://github.com/rspamd/rspamd/issues?q=is%3Aissue+root+permission)?

kerem commented

2026-03-14 10:39:19 +03:00

Author

Owner

@makua104 commented on GitHub (Mar 3, 2022):

I didn't see anything there other than a few older solved issues (1, 2) related to permission errors. It seems like they say the files should be owned by _rspamd:_rspamd, which is what I did to solve it. Is your rspamd.service also using User=_rspamd?

@makua104 commented on GitHub (Mar 3, 2022): I didn't see anything there other than a few older solved issues ([1](https://github.com/rspamd/rspamd/issues/3131), [2](https://github.com/rspamd/rspamd/issues/1996)) related to permission errors. It seems like they say the files should be owned by `_rspamd:_rspamd`, which is what I did to solve it. Is your `rspamd.service` also using `User=_rspamd`?

kerem commented

2026-03-14 10:39:24 +03:00

Author

Owner

@willbrowningme commented on GitHub (Mar 4, 2022):

Yes the rspamd.service is run by _rspamd. Following the exact instructions in the self-hosting instructions worked for me with no issues. Closing this issue, since it seems you've resolved it now.

@willbrowningme commented on GitHub (Mar 4, 2022): Yes the rspamd.service is run by `_rspamd`. Following the exact instructions in the self-hosting instructions worked for me with no issues. Closing this issue, since it seems you've resolved it now.

kerem referenced this issue

2026-03-14 11:45:16 +03:00

[GH-ISSUE #795] Mass re-check domain feature #1109

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/anonaddy#795

No description provided.

Rows
Columns