[CentOS] Sendmail with TLS, permission problem

Hello, list,

I have a problem with Sendmail configuration.

I'm building (on CentOS 5) a "dual-MTA" setup with amavisd-new (as specified
in amavisd-new documentation, file README.sendmail-dual).

So far so good. But when I tried to add server SMTP-AUTH and TLS, I get a
strange, permission-related error, and STARTTLS will not start.

In my .mc conf, the Sendmail user is now the usual - mail:mail
    define(`confDEF_USER_ID', ``8:12'')dnl
...though when I have cleared this problem, I'm going to add a definition
for a non-privileged Sendmail user like this (for the receiving Sendmail
daemon): 
    define(`confRUN_AS_USER', `smmsp:smmsp')dnl

Ok, when I try to start Sendmail, I get this in the maillog:

Aug 11 15:25:24 mail sm-mta-tx[12782]: starting daemon (8.13.8):
SMTP+queueing at 00:01:00
Aug 11 15:25:24 mail sm-mta-rx[12785]: starting daemon (8.13.8):
SMTP+persistent-queueing at 00:00:01
Aug 11 15:25:24 mail sm-mta-rx[12785]: STARTTLS=server: file
/etc/mail/certs/sendmail.pem unsafe: Permission denied

This is strange, because the permissions should be ok - right?

[root at mail ~]# ls -ld / /etc /etc/mail /etc/mail/certs
drwxr-xr-x 24 root root  4096 Mar 29  2007 /
drwxr-xr-x 96 root root 12288 Aug 12 04:02 /etc
drwxr-xr-x  5 root root  4096 Aug 11 15:44 /etc/mail
dr-xr-xr-x  2 mail mail  4096 Aug 11 14:42 /etc/mail/certs

[root at mail ~]# ls -l /etc/mail/certs
-rw------- 1 mail mail    1371 Aug 11 12:15 cacert.pem
-rw------- 1 mail mail     963 Aug 11 12:15 cakey.pem
-rw-r--r-- 1 root root 1952422 Aug 11 14:26 revoke.crl
-rw------- 1 mail mail    2258 Aug 11 12:16 sendmail.pem

Any ideas, what I should check next?

This might be a Sendmail bug - it resembles this Debian bug, which also
gives a "unsafe - no permission" error as a symptom.

http://www.mail-archive.com/debian-bugs-closed@lists.debian.org/msg01560.htm
l

. Jussi Hirvi

--
Jussi Hirvi * Green Spot
Topeliuksenkatu 15 C * 00250 Helsinki * Finland
Tel. & fax +358 9 493 981 * Mobile +358 40 771 2098 (only sms)
jussi.hirvi at greenspot.fi * http://www.greenspot.fi