sendmail, 4th Edition

RunAsUser

Run as non-root (on a firewall) V8.8 and later

On firewalls, for reasons of additional security, it is often desirable to run sendmail as a user other than root. Beginning with V8.8 sendmail, you can accomplish this by using the RunAsUser option:

O RunAsUser=user: group                       ← configuration file (V8.8 and
later)
-ORunAsUser=user: group                       ← command line (V8.8 and later)
define(`confRUN_AS_USER', `user: group')      ← mc configuration (V8.8 and later)

Here, user is either the uid number of the identity you want sendmail to run under, or a symbolic name for that identity. If a symbolic name is specified and if that name cannot be looked up in the passwd(5) file, sendmail prints the following error:

readcf: option RunAsUser: unknown user bad symbolic name here

If the symbolic name is found in the passwd(5) file, the uid and gid that sendmail will run under are set from that file.

The :, if it is present, signals to sendmail that you also intend to specify a group identity.

The group is either the numeric gid that you want sendmail to run as, or a symbolic name for a group. If it is a symbolic name, that name is looked up in the group(5) file. If it is not found in that file, the following error is printed:

readcf: option RunAsUser: unknown group bad group name here

If the symbolic name is in that file, sendmail will run under the gid found there.

The sendmail program assumes the identity specified just after the configuration file is read for all but the daemon mode. As a daemon, sendmail remains ...