On Sun, Jan 19, 2020 at 1:37 PM Michael Orlitzky <m...@gentoo.org> wrote: > > On 1/19/20 12:42 PM, Rich Freeman wrote: > > > > Typically you wouldn't share service accounts across multiple hosts. > > I'd think that something like amavisd is going to go on a mail server. > > You're not going to be logging into that account to do typical > > desktop-oriented functions. > > > > If you had three mail servers, you probably would want to share > > /home/mjo across all of them, but you probably wouldn't want to share > > your amavisd config across them. That is why the config goes in /etc. > > I don't see how stuff it launches would be any different. > > The stuff it launches is different because the stuff it launches is > different. SpamAssassin, for example, can be run by normal users in a > traditional UNIX mail setup. So its configuration goes in $HOME, because > that's how it works. When amavis runs spamassassin, the SA configuration > comes from $HOME, because that's how it works.
Sure, I completely understand that and have no issues with it. Ditto with having some apache module running sendmail, which has some plugin which gpg signs emails, which requires a ~/.gnupg for the apache user. > If you're sharing /home, you also have to be sharing user accounts, > unless you want everyone to be assigned a random set of files. I imagine that most people setting up something like this would only be sharing high-value UIDs (>1000 in our case). There is no need for postfix on your Gentoo box and postfix on your Debian box to have the same UID. You wouldn't be sshing from postfix on the one to postfix on the other and expecting to have the same home directory contents. > And if > you're sharing user accounts, you have to start each instance of amavis > as a different user, because its configuration is per-user. That's just > the way it works. Since it is a local account, not in /home, then it would be a separate user even if the UID is the same (or otherwise). You'd set up amavis on each mail server. They might be running different distros. They would be using local users. Don't get me wrong, it would be cleaner if POSIX users had a scope the way that an OS like Windows does it, but it isn't a big deal if you use high-numbered UIDs for shared users, and low-numbered UIDs for local users. > Everything is fine here, this all works and has worked for 20 years. Sure, it works fine if you have a single host, or do nothing to share your home directories, which I imagine is what 95% of Gentoo users do. I doubt most Gentoo users even encrypt /home, even though this has been standard for most of those 20 years on just about every major distro out there. If a user wants to put this stuff in /home we should certainly support that, and it would work fine if the user sets up the account properly before installing the package. They might get a QA warning, but that is the user's concern. -- Rich
