Use higher uid/gid for Vexim by default

[rimas-kudelis]

In README.md, we currently instruct our users to create a system (low-uid) user for Vexim. This might not be such a good idea after all (e.g. Dovecot disallows logging in for users with uid lower than 500 by default – and for a good reason!). I think we should update the readme to instruct how to create a user with higher uid by by default, e.g. with uid between 500 and 999, or something.

At least in Debian, normal users get uid's starting from 1000. We probably want our user to be a bit special, but not as special as to have a really low uid.

[Udera]

Are there other consequences related with the UID (remote login, ...)?

[rimas-kudelis]

Don't really know, I can only quote some sources. For example, LSB specifies the following:

The system User IDs from 0 to 99 should be statically allocated by the system, and shall not be created by applications.

The system User IDs from 100 to 499 should be reserved for dynamic allocation by system administrators and post install scripts using useradd.

Meanwhile Debian Policy Manual extends the second group up until uid 1000. But Dovecot as shipped by Debian still allows us to log in with uid's starting at 500, so I thought why not exploit that gap for our purpose.

Other than that, our user should not be able to log in to the shell anyway (we should use --disabled-password and --disabled-login when creating it).

[Udera]

CentOS/Redhat give user-ids starting from 500 (https://en.wikipedia.org/wiki/User_identifier). We would be compatible with all systems if we chose a uid between 100-499.

[Z3po]

So we can't match all Systems/Services policies...still I think we may stay between 100 and 499.

[rimas-kudelis]

The thing is, we don't really need a special uid, it looks better, but there's nothing other than that. I wonder what's worse: having a non-special uid for special use, or (effectively) disabling this protective setting in Dovecot (and potentially other applications).

On 2015 m. spalis 20 d. 23:54:33 EEST, Sebastian Cabrera notifications@github.com wrote:

So we can't match all Systems/Services policies...still I think we may
stay between 100 and 499.

[Udera]

It's more important that the new user can't login via ssh. The actual UID, you could even mention in the documentation to use a 99<UID<500 on RHEL/CentOS.

[rimas-kudelis]

The user won't be able to log in via ssh if its password hash field in /etc/shadow contains either * or !, so that is not a problem. At least in debian, adduser takes care of this when either --disabled-password or --disabled-login is used (or both).

[Udera]

Perfect.

[rimas-kudelis]

What's perfect? I still think we should use an uid of 500 or higher.

[Udera]

For me it would be OK to use a gid > 500.

[xoyteam]

First I do not understand why it is necessary to use a specific UID?
This setting is specific to each operating system.
I think, because this user is not a real man. It must be allocated a system UID. And what and how it will solve the range of the system.
Enough to make the instructions - how to create a system user, how do you know its UID and how to enter in the configuration.

p.s. Debina Polycy Manual https://www.debian.org/doc/debian-policy/ch-opersys.html#s9.2

0-99:

Globally allocated by the Debian project, the same on every Debian system.
These ids will appear in the passwd and group files of all Debian systems,
new ids in this range being added automatically as the base-passwd package is updated.

Packages which need a single statically allocated uid or gid should use one of these;
their maintainers should ask the base-passwd maintainer for ids.

100-999:

Dynamically allocated system users and groups. Packages which need a user or group,
but can have this user or group allocated dynamically and differently on each system,
should use adduser --system to create the group and/or user. adduser will check for the existence of the user or group, and if necessary choose an unused id based on the ranges specified in adduser.conf.

1000-59999:

Dynamically allocated user accounts. By default adduser will choose UIDs and GIDs
for user accounts in this range, though adduser.conf may be used to modify this behavior.

[rimas-kudelis]

First I do not understand why it is necessary to use a specific UID?
This setting is specific to each operating system.

We do not supply a specific UID or GID. What we do though is tell the users to create a system user (which might fall anywhere between 100 and 999 in Debian, or which we specify to be between 1 and 100 for FreeBSD, I suppose).

I think, because this user is not a real man. It must be allocated a system UID. And what and how it will solve the range of the system.
Enough to make the instructions - how to create a system user, how do you know its UID and how to enter in the configuration.

In general, I would agree. But if you have read my rationale above, you know that Dovecot does not allow anyone with UID lower than 500 to log in. Since all virtual users are treated as having the UID we create here, we have to take that into account, hence my suggestion to limit the possible UID's with 500 from below. It doesn't mean we're going to specify a particular UID to use, it just means we're setting some limits.

[xoyteam]

But if you have read my rationale above, you know that Dovecot does not allow anyone with UID lower than 500 to log in.

It also applies in the Debian installation of Dovecot package?
Maybe it was a mistake debian maintainer?