How to deny root access to specific user's files

haariseshu · 09-04-2009, 12:18 AM

Hi Guys,

I'm running postfix server under RHEL-5 and users information are stored in the LDAP database.(openldap). Postfix fetching these users information from ldap using virtual relay.

And now I just want to know about restricting root user access to other user's mailbox.

As lot of confidential mails will flow across users I dont want to give root user with privilege to view users mailboxes.

Is it possible? If so how i can achieve this..??

Please help me with this...

Thanks a lot...

lazlow · 09-04-2009, 12:54 AM

Root is king. If the emails are that confidential you should probably be encrypting them.

haariseshu · 09-04-2009, 01:25 AM

Hello,

Thank you for your response...

But is there any encryption supported in RedHat by default and will it prevent the root user from viewing user's mailbox??

I like to have file and directory level encryption since it is not possible to have device level at this stage (as its required to format with that encryption prog. i hope).

lazlow · 09-04-2009, 01:34 AM

The sender of the email would encrypt it before he sent the email.

Assuming you are using thunderbird there are addons for it to do just this. Enigmail seems to be fairly popular.

JulianTosh · 09-04-2009, 01:42 AM

I'm not aware of any filesystem properties that can keep root from poking around once something is decrypted/mounted. The only thing that comes to mind is possibly an SELinux rule that blocks root from accessing files of a certain context.

JulianTosh · 09-04-2009, 01:46 AM

Quote:

Originally Posted by lazlow

Root is king. If the emails are that confidential you should probably be encrypting them.

No No.. Root supersedes kings. Root is god!

8^P

fotoguy · 09-04-2009, 02:39 AM

I wouldn't just worry about root, anyone can intercept an email and read the contents. Also every mail server it travels through can make copies before forward it on. If the information is that confidential, you definitely need to use encryption of some type. If it's just attachments that need to be secured, you can use GnuPG to encrypt the attachment.

haariseshu · 09-04-2009, 05:53 AM

Hello Guys,
Thank you for your responses...

Is their any way to do encryption from server side for all end user mails so that it sits in mailbox in encrypted format? So that it will not be human readable in the server location.

lazlow · 09-04-2009, 07:36 AM

No. Both ends of the email have to be involved with the encryption/decryption. If it were done just on the server then root(of that server) would have to be able to deal with it(root would be able to read it).