Question /usr/lib64/plesk-9.0/postfix-sendmail-wrapper - what does it do?

[DanCermak]

Hi everyone,

I am running a server under CentOS7 with Plesk 12.5. It is used also as a mailserver with Postfix as the MTA, however it was created by migrating from a very old Ubuntu based server (also with plesk) but running Qmail.
Anyway, my question is, what is exactly the postfix-sendmail-wrapper doing, which is set by Plesk as the MTA via /etc/alternatives?

For further context: I am having issues with the local delivery of emails to unix user accounts (see https://talk.plesk.com/threads/postfix-local-delivery-issue.321255/) and my guess is that the sendmail wrapper is doing something wrongly. Is using the postfix-sendmail-wrapper the canonical way of doing things with plesk? Or went something wrong in the migration (would be my guess, since the version number in the path is << 12)? Are there any config files for this executable? I tried running it with strace, but couldn't find any.

Thanks for your input,
Dan

 

[SimonG]

Is the "postfix-sendmail-wrapper" a binary executable, or just a script?

It's common to use wrapper scripts to get more information, such as when trying to find the origin of SPAM.

https://support.plesk.com/hc/en-us/articles/213914405

 

[DanCermak]

It is an executable and not a script:
file /usr/lib64/plesk-9.0/postfix-sendmail-wrapper
/usr/lib64/plesk-9.0/postfix-sendmail-wrapper: setuid ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=a75e8df93907c15d2653d6863ae5282e3396f04d, stripped

 

[Bitpalast]

Plesk sw-engine runs under psa user which does not have root privileges for security reasons. sw-engine calls a wrapper that has an suid bit set. That wrapper escalates permissions to root so that further processing of commands can be done on root level.

 

[DanCermak]

Thanks for the reply, that makes sense. Do you happen to know if the usage of the plesk supplied postfix-sendmail-wrapper is the way to do things or if it could be done with the upstream sendmail.postfix? I found for instance this page: https://support.plesk.com/hc/en-us/articles/213382389# , where sendmail.postfix is recommended.

 

[Bitpalast]

I think the issue is rather that "root" is a reserved address and should not be used by services other than OS or Plesk owned. Local mail delivery is absolutely no problem. If a domain is configured on the system, Plesk will automatically deliver mails locally. But it might not work correctly if reserved system recipients are used.

 

[DanCermak]

Well I am only using the address for root from OS daemons and it is not working, I do need or want it to be accessible from the outside. My issue with the postfix-sendmail-wrapper is, that it is _not_ delivering messages to root properly. But I cannot really experiment allot with the postfix supplied sendmail alternative, since the mailserver is live and I do not want a lot of down time. I basically would like to know if I can use sendmail.postfix instead of postfix-sendmail-wrapper (and ideally which one is the canonical way of doing things), since sendmail.postfix is properly delivering messages to root.

 

[Bitpalast]

Using sendmail.postfix as a drop-in replacement for postfix-sendmail-wrapper? No, that probably will not work. sw-engine should not be able to start that directly as it is missing the proper permissions, that's why it is using the wrapper which escalates permissions.

 

[DanCermak]

Well, it is really not that hard to set the setuid bit in sendmail.postfix, so I do not really see the point of this executable.
Do you know if there is any documentation about how Plesk sets the MTA up?