Take the 2-minute tour ×

I'm using ssmtp, and I would like to not make my /etc/ssmtp/ssmtp.conf world-readable, because it has my gateway password in cleartext. But if it is mode 600, then ssmtp run as an unprivileged user errors out with "ssmtp: Cannot open mailhub:25", because it cannot read the config file.

This article recommend creating a special ssmtp user and making it SUID, but before I add that kind of complexity to my deployment script, I want to ask:

Is it safe (barring security holes in ssmtp) to just make the ssmtp binary SUID root, so it can read the config file?

(I'm aware of the dangers of SUID in general -- no general answers please! My question is about ssmtp in particular, because I'm wondering if it has been written with being safe for SUID-root in mind.)

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Read the article again. It does not recommend running ssmtp as root. It says to chown the file to a special ssmtp user and use SUID to run the program as that user. This isn't even close to the same as what you're proposing.

Also: be aware you're reading a guide for FreeBSD; which is not Linux. You should not blindly assume those directions will work for a Linux system (they almost certainly will not).

share|improve this answer
+1: (a) No, do not run this as root. Bad and Wrong. ; (b) FreeBSD != Linux - Find a guide for the OS (and distribution) you're using...) –  voretaq7 Jul 31 '11 at 19:28
I know what the article says (I wasn't claiming that it recommends SUID root), and I did see the "FreeBSD" in the title too -- it's kinda hard to miss. ;-) I also know it's generally better practice to use an unprivileged special user account, but my question is: Has ssmtp been written so that it's safe (barring security holes) to make it SUID root (like sendmail for instance)? –  Jo Liss Aug 1 '11 at 12:46
No; SSMTP will not change it's own process user as some daemons will. –  Chris S Aug 1 '11 at 12:53
I see -- thanks! (I'd upvote your answer, but serverfault won't let me at this point.) –  Jo Liss Aug 23 '11 at 14:22

Your Answer


