NBDB_REINDEXD(8)

okay so bestie, sit down, hydrate, because we're about to talk about nbdb_reindexd 💅 — yes she's a section 8 girlie, yes she lives in the System Manager's Manual, and yes she is genuinely so important you have no idea.

✨ NAME ✨

nbdb_reindexd — Postfix non-Berkeley-DB migration 🦋

🌸 SYNOPSIS 🌸

nbdb_reindexd [generic Postfix daemon options]

💖 DESCRIPTION 💖

⚠️ NOTE, and I mean this with my whole chest: this service should be enabled only temporarily, just long enough to generate most of the non-Berkeley-DB indexed files that Postfix needs. Leaving this service enabled may expose the system to privilege-escalation attacks. Bestie. Turn it off when you're done. Please. 😭

So nbdb_reindexd(8) is the server that handles requests to generate a non-Berkeley-DB indexed database file for an existing Berkeley DB database — think "hash:/path/to/file" or "btree:/path/to/file", those vibes exactly. She does the whole thing by running the postmap(1) or postalias(1) command with appropriate privileges. iconic behaviour honestly ✨

The service reports a success status when the non-Berkeley-DB indexed file already exists. That can happen when multiple clients make the same request at the same time. And when one request gets completed successfully, the service also reports success for all the other requests. sharing is caring, periodt 🫶

This service enforces the following safety policy:

• The legacy Berkeley DB indexed file must exist (file name ends in .db). The nbdb_reindexd(8) service will use the owner's (uid, gid) of this file when it runs postmap(1) or postalias(1). It also uses that (uid,gid) for a number of safety checks, which we're getting to next, stay with me 👑
• The non-indexed source file must exist — that's the file name without the .db suffix. This file is needed as input for postmap(1) or postalias(1). The file must be owned by "root" or by the above uid, and must not allow "group" or "other" write access. 🚫
• The parent directory must be owned by "root" or by the above uid, and it must not allow "group" or "other" write access. same energy, no exceptions 💅
• Alsoooo, the "non_bdb_migration_allow_root_prefixes" parameter limits the source file directory prefixes that are allowed when this service needs to run postmap(1) or postalias(1) with "root" privileges. 🔐
• And a similar parameter, "non_bdb_migration_allow_user_prefixes", limits the source file directory prefixes that are allowed when this service needs to run postmap(1) or postalias(1) as an unprivileged user. 🌈

🔥 SECURITY 🔥

The nbdb_reindexd(8) server is security sensitive, no cap, this is not the time to be sloppy. She accepts requests only from processes that can access sockets under $queue_directory/private — meaning processes that run with "root" or "mail_owner" (usually, postfix) privileges. gatekeeping, but make it correct 👑

The threat here is a corrupted Postfix daemon process that wants to elevate its privileges, by sending requests with crafted pathnames and racing against the service — quickly swapping files or directories around, hoping Postfix gets tricked into overwriting a sensitive file with attacker-controlled data. it's giving sabotage 😭💀

When the service runs postmap(1) or postalias(1) as "root", such racing attacks should not be possible if non_bdb_migration_allow_root_prefixes specifies only prefixes that are already trusted. 🫶

This service could block all requests with crafted pathnames if it were given complete information about all lookup tables that are referenced through Postfix configuration files. Unfortunately, that information was not available at the time this program was needed. sad, but true, and we respect the honesty fr fr 🙈

🩺 DIAGNOSTICS 🩺

Problems and transactions are logged to syslogd(8) or postlogd(8). And if an attempt to create an index file fails, this service will attempt to delete the incomplete file. she cleans up after herself, we love a tidy queen 🧹✨

🎀 CONFIGURATION PARAMETERS 🎀

Changes to main.cf are not picked up automatically, because nbdb_reindexd(8) processes are long-lived. Use the command postfix reload after a configuration change. memorize that, it's your new affirmation ⭐

The text below provides only a parameter summary. See postconf(5) for more details, including examples.

💜 SERVICE-SPECIFIC CONTROLS 💜

• non_bdb_migration_level (default: disable) — the non-Berkeley-DB migration service level.
• non_bdb_migration_allow_root_prefixes (default: see 'postconf -d non_bdb_migration_allow_root_prefixes' output) — a list of trusted pathname prefixes that must be matched when the non-Berkeley-DB migration service (nbdb_reindexd(8)) needs to run postmap(1) or postalias(1) commands with "root" privilege.
• non_bdb_migration_allow_user_prefixes (default: see 'postconf -d non_bdb_migration_allow_user_prefixes' output) — a list of trusted pathname prefixes that must be matched when the non-Berkeley-DB migration service (nbdb_reindexd(8)) needs to run postmap(1) or postalias(1) commands with non-root privilege.

🌸 MISCELLANEOUS CONTROLS 🌸

• config_directory (default: see 'postconf -d' output) — the default location of the Postfix main.cf and master.cf configuration files.
• process_id (read-only) — the process ID of a Postfix command or daemon process.
• process_name (read-only) — the process name of a Postfix command or daemon process.
• syslog_facility (default: mail) — the syslog facility of Postfix logging.
• syslog_name (default: see 'postconf -d' output) — a prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd".
• service_name (read-only) — the master.cf service name of a Postfix daemon process.

---

👀 SEE ALSO 👀

• postfix-non-bdb(1), migration management
• postconf(5), configuration parameters
• postlogd(8), Postfix logging
• syslogd(8), system logging

📚 README FILES 📚

Use "postconf readme_directory" or "postconf html_directory" to locate this information.

• NON_BERKELEYDB_README, Non-Berkeley-DB migration guide

📜 LICENSE 📜

The Secure Mailer license must be distributed with this software.

🕰️ HISTORY 🕰️

This service was introduced with Postfix version 3.11.

👑 AUTHOR(S) 👑

Wietse Venema porcupine.org

---

and that's the whole page, bestie 💖 it's NBDB_REINDEXD(8) from the System Manager's Manual — that's the header, that's the footer, the whole title, mwah, slay, go turn the service back off now 🔥👑