tlp recommends smartmontools which then pulls in Postfix mailserver

[Karl Stenerud]

Ubuntu budgie 18.04 beta1
Budgie desktop 10.4

The budgie-desktop dependency tree includes postfix.

Postfix in turn opens port 25 to the world:
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 16322/master

It shouldn't be necessary to install a full blown mail server and network-exposed attack surface just to use a desktop environment.

[fossfreedom (fossfreedom)]

Need to find which package is pulling in postfix and report against that package

[fossfreedom (fossfreedom)]

ok - in further discussion with slangasek and infinity today via #ubuntu-release

tlp has a recommends on smartmontools which in-turn smartmontools -> bsd-mailx -> postfix

slangasek was querying by smartmontools was on the Ubuntu Budgie ISO since no other desktop flavour pulls this in - more of a server package?

Thus maybe the "debian/control" recommends for smartmontools should be downgraded to at least Suggests

[Raphaël Halimi (raph)]

Hi, TLP Debian maintainer here.

I see three different problems here :

1/ TLP does "need" smartctl, to display info about HDD health. Not having it installed doesn't prevent TLP from working, it simply displays a message inviting the user to install it. So I guess smartmontools could be demoted to suggests.

2/ smartmontools actually contains two pieces of software, smartctl and smartd. The first one is a command-line utility, the second is a daemon. Only the daemon actually needs the mailx command to alert the administrator in case of problems. Maybe a bug with severity "wishlist" should be filed against smartmontools in Debian asking to separate smartctl and smartd in their own packages.

3/ The default configuration of Postfix in Debian, if you don't answer debconf questions, is "Internet site". I never understood why, the logical choice (from a security point of view) should be "Local only", where the daemon binds to the loopback interface only. Again, maybe a bug with severity "wishlist" should be filed against postfix asking to change the default answer to the main_mailer_type question.

[Raphaël Halimi (raph)]

By the way, I don't understand how this dependency chain resolves to postfix:

smartmontools recommends mailx | bsd-mailx

mailx is a virtual package provided by mailutils and bsd-mailx

Both mailutils and bsd-mailx depend on default-mta | mail-transport-agent

default-mta is a virtual package provided by exim4-daemon-light

mail-transport-agent is a virtual package provided by all SMTP servers in Debian (both full-blown and fake ones like ssmtp or nullmailer)

Knowing this, I don't understand how APT could have chosen Postfix to resolve this chain of dependency. Whichever one of bsd-mailx or mailutils was chosen to satisfy smartmontools dependencies, APT's first choice should have been exim4-daemon-light, not postfix.

[fossfreedom (fossfreedom)]

Hi @raph

We were looking at the following

http://people.canonical.com/~ubuntu-archive/germinate-output/ubuntu-budgie.bionic/desktop

So germinate & apt apparently doesnt see "mailx" - just bsd-mailx - and postfix installs from that according the the "why" column.

I will raise the Debian bug reports as you have recommended - cheers for the info.

Will you be making the Suggests change in Debian for TLP or should I pursue a Ubuntu only change (I believe Ubuntu policy is to remove as much "ubuntu" only stuff) ?

[Raphaël Halimi (raph)]

Hi @fossfreedom,

I already made the change in my local Git repository, but I don't know when I'll be able to release it, first because I don't have a lot of time available right now, and secondly because I'm not (yet) a Debian Maintainer so I have to rely on my sponsor for the actual upload. I'll try to do it this week, but I don't promise anything.

About germinate, I don't know at all what is it, but looking at the link you provided, I guess it's a tool which points to why each package was pulled in. mailx being a virtual package, like default-mta or mail-transport-agent, it may explain why none of them is shown in the output.

Also, thanks a lot for taking care of filing the bugs against smartmontools and postfix - I intended to do it, but given the workload I currently have, it takes a weight off my shoulders.

[fossfreedom (fossfreedom)]

enc is a debdiff that resolves this issue; it moves smartmontools from a Recommends: to a Suggests: so that TLP does not inadvertently install postfix mail-server.

[Simon Quigley (tsimonq2)]

Looks good to me; uploaded.

[Raphaël Halimi (raph)]

I hoped to avoid that. Now I'll have to request a sync when the bug is fixed in Debian. Couldn't you wait a few days ?

[Simon Quigley (tsimonq2)]

> Now I'll have to request a sync when the bug is fixed in Debian.

Don't worry about it, I'll keep an eye out and sync as soon as it's ready.

Sorry; and thanks.

[Raphaël Halimi (raph)]

Oh, in that case, no problem. I take it back. Thanks a lot !

[Launchpad Janitor (janitor)]

This bug was fixed in the package tlp - 1.1-1ubuntu1

---------------
tlp (1.1-1ubuntu1) bionic; urgency=medium

  * Bug-fix release
    - Do not install a mail-server for a standard install;
      smartmontools is a recommended package that also installs
      postfix mail server (LP: #1758798)
  * Packaging Changes
    - debian/control - move smartmontools from Recommends: to
      Suggests:

 -- David Mohammed <email address hidden> Mon, 26 Mar 2018 20:36:25 +0100

[Jeremy Bícha (jbicha)]

This bug was fixed in the package tlp - 1.1-2

---------------
tlp (1.1-2) unstable; urgency=medium

  * [59b316a] Demote smartmontools from Recommends to Suggests
    smartmontools dependencies end up pulling in a mail server, which may
    not be wanted on desktop installations (Closes: 894150) (LP: 1758798)
  * [56bc43f] debian/control: cosmetic changes
  * [b407a57] debian/control: update Vcs-* URLs for Salsa migration
  * [5538eec] README.Debian: fix mix up between stable/oldstable/oldoldstable
  * [a78888a] Override lintian warning about unusual WantedBy target
  * [7b94358] Override lintian warning about missing test suite

 -- Raphaël Halimi <email address hidden> Tue, 27 Mar 2018 15:02:15 +0200