1

I've created a new account svchk and via visudo granted it permission to run the following command /sbin/service postfix status:

Cmnd_Alias POSTFIXCMDS = /sbin/service postfix status
svchk ALL = NOPASSWD: POSTFIXCMDS

But when I su svchk and run /bin/service postfix status I get the following error:

su svchk
/sbin/service postfix status
master status unknown due to insufficient privileges.

Why am I getting this and how can I properly grant svchk permission to check the status of the postfix service?

1

To run commands via sudo you have to prefix it with sudo like that:

sudo /sbin/service postfix status
2
  • If I do sudo -u svchk /sbin/service postfix status I still get the following: master status unknown due to insufficient privileges. – Brad Apr 11 '14 at 14:36
  • 1
    No, when you do sudo -u svchk you switch from your current user to svchk (and you want to switch from svchk to root). What you need to do is first login to svchk (using su svchk or sudo -u svchk), then sudo /sbin/service postfix status. – dnt Apr 11 '14 at 22:07
0

I couldn't figure out the right combination of commands to place in visudo to allow a non privileged user to check the postfix status.

Checking the /etc/init.d/postfix script it seems like the status command might call a bunch of other commands. In addition to that it seems the service is started using chroot which may be causing issues granting my account permission to check the service status.

Instead I've opted to check the service a different way. I setup the following in visudo:

 # Allow the unprivileged account svchk run wc, ps, grp so that we can check if postfix is running
 Cmnd_Alias POSTFIXCMDS = /usr/bin/wc,/bin/ps,/bin/grep
 svchk ALL = NOPASSWD: POSTFIXCMDS

Then from my health checking script I ran the following: ps aux | grep /usr/libexec/postfix/master | wc -l

If the results of the above command return 2 (two processes with the word "/usr/libexec/postfix/master" then postfix is running. If it returns 1 then the postfix command is not running.

I'm not overly satisfied with this solution, so if someone else has a better way of getting the actual service postfix status command to work as a non-privelaged user I'd love to hear and I'll gladly mark your response as the answer.

Thanks Brad

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.