1

I have installed ssmtp on an raspberry pi running Raspbian 10 Buster. Email from the command line, e.g. using mail works fine. However, I have also configured a user's cron job to send email by adding the MAILTO variable to the file.

# Edit this file to introduce tasks to be run by cron.
# 
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
# 
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').
# 
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# 
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).

MAILTO="person1@myredacteddomain.tld,person2@myredacteddomain.tld"

# we need to set the user path to add the system scripts directory /usr/local/sbin
# I tried with PATH=$PATH:/usr/local/sbin but it used this verbatim in the path
PATH=/usr/sbin:/usr/bin:/bin:/usr/local/sbin:

# 
# For example, you can run a backup of all your user accounts
# at 5 a.m every week with:
# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/

# For more information see the manual pages of crontab(5) and cron(8)
# 
# m h  dom mon dow   command

26 3 * * * cronic python3 ~/redacted_directory_name/redacted_script_name.py
24 22 * * * echo "Testing cron email"

as I understand from other online searches (correct me if I'm wrong), cron uses sendmail by default to send emails.

Sendmail is available on the system, but it is really ssmtp

$ which sendmail
/usr/sbin/sendmail
$ ls -l /usr/sbin/sendmail 
lrwxrwxrwx 1 root root 5 Jul 20  2014 /usr/sbin/sendmail -> ssmtp

On this machine I have configured ssmtp to use an external SMTP server to send mail.

cron doesn't send email either for root or another non-sudo user.

In the logs for mail I see the following

$ tail /var/log/mail.log
Jan 17 16:43:02 ed-mh-pi01 sSMTP[25679]: Cannot open mailhub:25
Jan 18 03:22:24 ed-mh-pi01 sSMTP[9846]: Creating SSL connection to host
Jan 18 03:22:25 ed-mh-pi01 sSMTP[9846]: SSL connection using ECDHE_RSA_AES_256_GCM_SHA384
Jan 18 03:22:26 ed-mh-pi01 sSMTP[9846]: Sent mail for root@redactedhostname@myredacteddomain.tld (221 2.0.0 Bye) uid=0 username=root outbytes=638
Jan 18 22:20:02 ed-mh-pi01 sSMTP[6924]: /etc/ssmtp/ssmtp.conf not found
Jan 18 22:20:02 ed-mh-pi01 sSMTP[6924]: Unable to locate mailhub
Jan 18 22:20:02 ed-mh-pi01 sSMTP[6924]: Cannot open mailhub:25
Jan 18 22:24:01 ed-mh-pi01 sSMTP[6988]: /etc/ssmtp/ssmtp.conf not found
Jan 18 22:24:01 ed-mh-pi01 sSMTP[6988]: Unable to locate mailhub
Jan 18 22:24:01 ed-mh-pi01 sSMTP[6988]: Cannot open mailhub:25

The entries for Jan 18 22:20:02 and Jan 18 22:24:02 appear to be related to the cron job email. I did a couple of tests at these times.

It states that whatever process is sending the email does not have access to /etc/ssmtp/ssmtp.conf. On the Arch linux wiki it states that

The /usr/bin/ssmtp binary runs as the mail group and can read this file. There is no reason to add yourself or other users to the mail group.

I don't know if that is true for raspbian, but it made me think that perhaps this was the problem. I experimented with changing the group ownership of /etc/ssmtp/ and its contents to mail, like so:

$ ls -l /etc/ssmtp/
total 8
-rw-r--r-- 1 root mail 200 Jul 20  2014 revaliases
-rw-r----- 1 root mail 764 Jan 17 12:03 ssmtp.conf

However, the problem persists

[root] ~ $ tail /var/log/mail.log
<snip>
Jan 18 22:39:01 ed-mh-pi01 sSMTP[7559]: /etc/ssmtp/ssmtp.conf not found
Jan 18 22:39:01 ed-mh-pi01 sSMTP[7559]: Unable to locate mailhub
Jan 18 22:39:01 ed-mh-pi01 sSMTP[7559]: Cannot open mailhub:25

So, why is cron not sending email, and how can I fix it?

EDIT

If I change (temporarily) the permissions on /etc/ssmtp/ssmtp.conf to allow any user to read, the emails are sent. This is not a solution as this file contains the plain text password for the email account, and also doesn't explain why normal users can send from the command line, but cron cannot.

EDIT 2

$ ls -l /usr/sbin/ssmtp
-rwxr-xr-x 1 root root 30588 Jul 20  2014 /usr/sbin/ssmtp
5
  • 4
    Are you referring to the echo "Testing cron email" job? You're redirecting the output for that job, so cron has nothing to send.
    – Haxiel
    Jan 18 at 10:42
  • @Haxiel, good point, indeed I am, let me stop the redirection and check again. However, the problem was first noticed by not getting output from other jobs.
    – crobar
    Jan 18 at 13:25
  • @Haxiel, as far as I can tell, it really isn't sending the emails, I modified the script and tested. I also added more information to the question, e.g. log output.
    – crobar
    Jan 18 at 22:50
  • Please add ls -l /usr/sbin/ssmtp. It should be setgid mail but I suspect it isn't
    – roaima
    Jan 18 at 23:48
  • @roaima, I added the info you requested
    – crobar
    Jan 19 at 1:51

1 Answer 1

1

You've written that,

The /usr/bin/ssmtp binary runs as the mail group and can read this file

But you have shown that this is not the case for your binary:

-rwxr-xr-x 1 root root 30588 Jul 20 2014 /usr/sbin/ssmtp

What the Wiki says is,

Because your email password is stored as cleartext in /etc/ssmtp/ssmtp.conf, it is important that this file is secure. By default, the entire /etc/ssmtp directory is accessible only by root and the mail group. The /usr/bin/ssmtp binary runs as the mail group and can read this file. There is no reason to add yourself or other users to the mail group.

So you need to correct the broken permissions:

chown -R root:mail /etc/ssmtp /usr/sbin/ssmtp
chmod -R g=u,g-w,o= /etc/ssmtp
chmod a=rx,g+s /usr/sbin/ssmtp

However I should also point out that the first thing the Arch wiki says is,

sSMTP is unmaintained. Consider using something like msmtp or OpenSMTPD instead

3
  • Thanks, the point about ssmtp being unmaintained is also noted, I'll look for alternatives after implementing this workaround.
    – crobar
    Jan 19 at 10:05
  • This isn't a workaround so much as fixing a broken installation
    – roaima
    Jan 19 at 11:30
  • yes, but i installed the apt official package, and I didn't change any of these permissions, so I mean a workaround for the broken package really. I assume it might break again if the package is updated.
    – crobar
    Jan 19 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.