Dovecot sieve forwards a copy to non authorized email addressPostfix — mail forwarding loopUnable to receive any emails using postfix, dovecot, mysql, and virtual domain/mailboxesWhy is Postfix trying to connect to other machines SMTP port 25?Postfix: Recipient address rejected: Invalid HELO/EHLOUnexpected failure, please try later (in reply to end of DATA command)Postfix: find out why mail bouncesContact form from ubuntu to Zoho email addresspostfix: Cannot assign requested addressStrange mails from my email serverWhy this email wasn't delivered by Postfix/Dovecot/Procmail?
Car headlights in a world without electricity
Do creatures with a listed speed of "0 ft., fly 30 ft. (hover)" ever touch the ground?
Fair gambler's ruin problem intuition
Should I tell management that I intend to leave due to bad software development practices?
How to stretch the corners of this image so that it looks like a perfect rectangle?
Why didn't Boeing produce its own regional jet?
What's the meaning of "Sollensaussagen"?
how do we prove that a sum of two periods is still a period?
How can I prove that a state of equilibrium is unstable?
Why was Sir Cadogan fired?
Getting extremely large arrows with tikzcd
What is the most common color to indicate the input-field is disabled?
Unlock My Phone! February 2018
Can I hook these wires up to find the connection to a dead outlet?
Ambiguity in the definition of entropy
Is this draw by repetition?
What exactly is ineptocracy?
Notepad++ delete until colon for every line with replace all
What reasons are there for a Capitalist to oppose a 100% inheritance tax?
How to travel to Japan while expressing milk?
Processor speed limited at 0.4 Ghz
What historical events would have to change in order to make 19th century "steampunk" technology possible?
Mathematica command that allows it to read my intentions
Placement of More Information/Help Icon button for Radio Buttons
Dovecot sieve forwards a copy to non authorized email address
Postfix — mail forwarding loopUnable to receive any emails using postfix, dovecot, mysql, and virtual domain/mailboxesWhy is Postfix trying to connect to other machines SMTP port 25?Postfix: Recipient address rejected: Invalid HELO/EHLOUnexpected failure, please try later (in reply to end of DATA command)Postfix: find out why mail bouncesContact form from ubuntu to Zoho email addresspostfix: Cannot assign requested addressStrange mails from my email serverWhy this email wasn't delivered by Postfix/Dovecot/Procmail?
Recently, dovecot started to resend a copy of all emails received on a few accounts to a non authorized email address: puncheseurope23@gmaiil.com. Aparently the message is generated locally (127.0.0.1) but I cannot find out where or how it is being generated.
Mar 26 19:37:44 sd-4XXXX postfix/cleanup[21014]: 64BA6E182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:44 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: from=<me@mydomain.com>, size=15412, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: connect from localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: E1743E1839D6: client=localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/cleanup[21014]: E1743E1839D6: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: from=<me@mydomain.com>, size=16476, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX amavis[32748]: (32748-11) Passed CLEAN RelayedInternal, ORIGINATING LOCAL [8X.8X.6X.3X]:55254 [8X.8X.6X.3X] <me@mydomain.com> -> <info@destindomain.com>, Queue-ID: 64BA6E182985, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: Buvs90Q9JFpr, Hits: -2.898, size: 15412, queued_as: E1743E1839D6, dkim_new=default:mydomain.com, 2353 ms
Mar 26 19:37:46 sd-4XXXX postfix/smtp[21015]: 64BA6E182985: to=<info@destindomain.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=2.6, delays=0.23/0.01/0/2.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10027): 250 2.0.0 Ok: queued as E1743E1839D6)
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: removed
Mar 26 19:37:47 sd-4XXXX postfix/pickup[831]: 0CA2BE1851F7: uid=5000 from=<me@mydomain.com>
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: forwarded to <puncheseurope23@gmaiil.com>
Mar 26 19:37:47 sd-4XXXX postfix/cleanup[21014]: 0CA2BE1851F7: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: from=<me@mydomain.com>, size=16711, nrcpt=1 (queue active)
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: stored mail into mailbox 'INBOX'
Mar 26 19:37:47 sd-4XXXX postfix/pipe[21023]: E1743E1839D6: to=<info@destindomain.com>, relay=dovecot, delay=0.27, delays=0.04/0.02/0/0.22, dsn=2.0.0, status=sent (delivered via dovecot service)
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: removed
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: connect from localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: 0113FE182985: client=localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/cleanup[21014]: 0113FE182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0113FE182985: from=<me@mydomain.com>, size=17040, nrcpt=1 (queue active)
Mar 26 19:37:49 sd-4XXXX amavis[32627]: (32627-11) Passed CLEAN RelayedOutbound, LOCAL [127.0.0.1] [8X.8X.6X.3X] <me@mydomain.com> -> <puncheseurope23@gmaiil.com>, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: 4g8Irz6LJmCW, Hits: -3.098, size: 16711, queued_as: 0113FE182985, dkim_sd=default:mydomain.com, 1985 ms
Mar 26 19:37:49 sd-4XXXX postfix/smtp[21015]: 0CA2BE1851F7: to=<puncheseurope23@gmaiil.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.1, delays=0.12/0/0/2, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 0113FE182985)
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: removed
Edit 1
I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address (puncheseurope23@gmaiil.com) in the cc field, I have removed those entries but the problem is still happening.
Edit 2
After some research I found out that dovecot sieve was configured to redirect those emails to the offending address. I checked the files in /var/vmail/destindomain.com/info/.sieve and I could find the line redirect "puncheseurope23@gmaiil.com", apparently created from ispconfig, but not removed when I modified the entry through the ispconfig interface.
debian postfix dovecot
asked Mar 26 at 18:50
spacebikerspacebiker
293212
add a comment |
Recently, dovecot started to resend a copy of all emails received on a few accounts to a non authorized email address: puncheseurope23@gmaiil.com. Aparently the message is generated locally (127.0.0.1) but I cannot find out where or how it is being generated.
Mar 26 19:37:44 sd-4XXXX postfix/cleanup[21014]: 64BA6E182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:44 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: from=<me@mydomain.com>, size=15412, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: connect from localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: E1743E1839D6: client=localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/cleanup[21014]: E1743E1839D6: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: from=<me@mydomain.com>, size=16476, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX amavis[32748]: (32748-11) Passed CLEAN RelayedInternal, ORIGINATING LOCAL [8X.8X.6X.3X]:55254 [8X.8X.6X.3X] <me@mydomain.com> -> <info@destindomain.com>, Queue-ID: 64BA6E182985, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: Buvs90Q9JFpr, Hits: -2.898, size: 15412, queued_as: E1743E1839D6, dkim_new=default:mydomain.com, 2353 ms
Mar 26 19:37:46 sd-4XXXX postfix/smtp[21015]: 64BA6E182985: to=<info@destindomain.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=2.6, delays=0.23/0.01/0/2.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10027): 250 2.0.0 Ok: queued as E1743E1839D6)
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: removed
Mar 26 19:37:47 sd-4XXXX postfix/pickup[831]: 0CA2BE1851F7: uid=5000 from=<me@mydomain.com>
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: forwarded to <puncheseurope23@gmaiil.com>
Mar 26 19:37:47 sd-4XXXX postfix/cleanup[21014]: 0CA2BE1851F7: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: from=<me@mydomain.com>, size=16711, nrcpt=1 (queue active)
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: stored mail into mailbox 'INBOX'
Mar 26 19:37:47 sd-4XXXX postfix/pipe[21023]: E1743E1839D6: to=<info@destindomain.com>, relay=dovecot, delay=0.27, delays=0.04/0.02/0/0.22, dsn=2.0.0, status=sent (delivered via dovecot service)
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: removed
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: connect from localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: 0113FE182985: client=localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/cleanup[21014]: 0113FE182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0113FE182985: from=<me@mydomain.com>, size=17040, nrcpt=1 (queue active)
Mar 26 19:37:49 sd-4XXXX amavis[32627]: (32627-11) Passed CLEAN RelayedOutbound, LOCAL [127.0.0.1] [8X.8X.6X.3X] <me@mydomain.com> -> <puncheseurope23@gmaiil.com>, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: 4g8Irz6LJmCW, Hits: -3.098, size: 16711, queued_as: 0113FE182985, dkim_sd=default:mydomain.com, 1985 ms
Mar 26 19:37:49 sd-4XXXX postfix/smtp[21015]: 0CA2BE1851F7: to=<puncheseurope23@gmaiil.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.1, delays=0.12/0/0/2, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 0113FE182985)
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: removed
Edit 1
I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address (puncheseurope23@gmaiil.com) in the cc field, I have removed those entries but the problem is still happening.
Edit 2
After some research I found out that dovecot sieve was configured to redirect those emails to the offending address. I checked the files in /var/vmail/destindomain.com/info/.sieve and I could find the line redirect "puncheseurope23@gmaiil.com", apparently created from ispconfig, but not removed when I modified the entry through the ispconfig interface.
debian postfix dovecot
asked Mar 26 at 18:50
spacebikerspacebiker
293212
1
I'm not familiar with Dovecot. Just wanted to note, though, that if your organization sends any purchase orders, invoices or anything else financial via email, you'll want to warn everyone who might receive such things that your email has been compromised and to be on the lookout for financial requests that look legitimate but send money to new account numbers. I know a guy who had $90k siphoned off his company's account in this fashion.
– ceejayoz
Mar 26 at 19:01
add a comment |
Recently, dovecot started to resend a copy of all emails received on a few accounts to a non authorized email address: puncheseurope23@gmaiil.com. Aparently the message is generated locally (127.0.0.1) but I cannot find out where or how it is being generated.
Mar 26 19:37:44 sd-4XXXX postfix/cleanup[21014]: 64BA6E182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:44 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: from=<me@mydomain.com>, size=15412, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: connect from localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: E1743E1839D6: client=localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/cleanup[21014]: E1743E1839D6: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: from=<me@mydomain.com>, size=16476, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX amavis[32748]: (32748-11) Passed CLEAN RelayedInternal, ORIGINATING LOCAL [8X.8X.6X.3X]:55254 [8X.8X.6X.3X] <me@mydomain.com> -> <info@destindomain.com>, Queue-ID: 64BA6E182985, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: Buvs90Q9JFpr, Hits: -2.898, size: 15412, queued_as: E1743E1839D6, dkim_new=default:mydomain.com, 2353 ms
Mar 26 19:37:46 sd-4XXXX postfix/smtp[21015]: 64BA6E182985: to=<info@destindomain.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=2.6, delays=0.23/0.01/0/2.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10027): 250 2.0.0 Ok: queued as E1743E1839D6)
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: removed
Mar 26 19:37:47 sd-4XXXX postfix/pickup[831]: 0CA2BE1851F7: uid=5000 from=<me@mydomain.com>
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: forwarded to <puncheseurope23@gmaiil.com>
Mar 26 19:37:47 sd-4XXXX postfix/cleanup[21014]: 0CA2BE1851F7: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: from=<me@mydomain.com>, size=16711, nrcpt=1 (queue active)
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: stored mail into mailbox 'INBOX'
Mar 26 19:37:47 sd-4XXXX postfix/pipe[21023]: E1743E1839D6: to=<info@destindomain.com>, relay=dovecot, delay=0.27, delays=0.04/0.02/0/0.22, dsn=2.0.0, status=sent (delivered via dovecot service)
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: removed
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: connect from localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: 0113FE182985: client=localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/cleanup[21014]: 0113FE182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0113FE182985: from=<me@mydomain.com>, size=17040, nrcpt=1 (queue active)
Mar 26 19:37:49 sd-4XXXX amavis[32627]: (32627-11) Passed CLEAN RelayedOutbound, LOCAL [127.0.0.1] [8X.8X.6X.3X] <me@mydomain.com> -> <puncheseurope23@gmaiil.com>, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: 4g8Irz6LJmCW, Hits: -3.098, size: 16711, queued_as: 0113FE182985, dkim_sd=default:mydomain.com, 1985 ms
Mar 26 19:37:49 sd-4XXXX postfix/smtp[21015]: 0CA2BE1851F7: to=<puncheseurope23@gmaiil.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.1, delays=0.12/0/0/2, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 0113FE182985)
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: removed
Edit 1
I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address (puncheseurope23@gmaiil.com) in the cc field, I have removed those entries but the problem is still happening.
Edit 2
After some research I found out that dovecot sieve was configured to redirect those emails to the offending address. I checked the files in /var/vmail/destindomain.com/info/.sieve and I could find the line redirect "puncheseurope23@gmaiil.com", apparently created from ispconfig, but not removed when I modified the entry through the ispconfig interface.
debian postfix dovecot
asked Mar 26 at 18:50
spacebikerspacebiker
293212
Recently, dovecot started to resend a copy of all emails received on a few accounts to a non authorized email address: puncheseurope23@gmaiil.com. Aparently the message is generated locally (127.0.0.1) but I cannot find out where or how it is being generated.
Mar 26 19:37:44 sd-4XXXX postfix/cleanup[21014]: 64BA6E182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:44 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: from=<me@mydomain.com>, size=15412, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: connect from localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: E1743E1839D6: client=localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/cleanup[21014]: E1743E1839D6: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: from=<me@mydomain.com>, size=16476, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX amavis[32748]: (32748-11) Passed CLEAN RelayedInternal, ORIGINATING LOCAL [8X.8X.6X.3X]:55254 [8X.8X.6X.3X] <me@mydomain.com> -> <info@destindomain.com>, Queue-ID: 64BA6E182985, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: Buvs90Q9JFpr, Hits: -2.898, size: 15412, queued_as: E1743E1839D6, dkim_new=default:mydomain.com, 2353 ms
Mar 26 19:37:46 sd-4XXXX postfix/smtp[21015]: 64BA6E182985: to=<info@destindomain.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=2.6, delays=0.23/0.01/0/2.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10027): 250 2.0.0 Ok: queued as E1743E1839D6)
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: removed
Mar 26 19:37:47 sd-4XXXX postfix/pickup[831]: 0CA2BE1851F7: uid=5000 from=<me@mydomain.com>
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: forwarded to <puncheseurope23@gmaiil.com>
Mar 26 19:37:47 sd-4XXXX postfix/cleanup[21014]: 0CA2BE1851F7: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: from=<me@mydomain.com>, size=16711, nrcpt=1 (queue active)
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: stored mail into mailbox 'INBOX'
Mar 26 19:37:47 sd-4XXXX postfix/pipe[21023]: E1743E1839D6: to=<info@destindomain.com>, relay=dovecot, delay=0.27, delays=0.04/0.02/0/0.22, dsn=2.0.0, status=sent (delivered via dovecot service)
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: removed
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: connect from localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: 0113FE182985: client=localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/cleanup[21014]: 0113FE182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0113FE182985: from=<me@mydomain.com>, size=17040, nrcpt=1 (queue active)
Mar 26 19:37:49 sd-4XXXX amavis[32627]: (32627-11) Passed CLEAN RelayedOutbound, LOCAL [127.0.0.1] [8X.8X.6X.3X] <me@mydomain.com> -> <puncheseurope23@gmaiil.com>, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: 4g8Irz6LJmCW, Hits: -3.098, size: 16711, queued_as: 0113FE182985, dkim_sd=default:mydomain.com, 1985 ms
Mar 26 19:37:49 sd-4XXXX postfix/smtp[21015]: 0CA2BE1851F7: to=<puncheseurope23@gmaiil.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.1, delays=0.12/0/0/2, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 0113FE182985)
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: removed
Edit 1
I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address (puncheseurope23@gmaiil.com) in the cc field, I have removed those entries but the problem is still happening.
Edit 2
After some research I found out that dovecot sieve was configured to redirect those emails to the offending address. I checked the files in /var/vmail/destindomain.com/info/.sieve and I could find the line redirect "puncheseurope23@gmaiil.com", apparently created from ispconfig, but not removed when I modified the entry through the ispconfig interface.
debian postfix dovecot
debian postfix dovecot
asked Mar 26 at 18:50
spacebikerspacebiker
293212
asked Mar 26 at 18:50
spacebikerspacebiker
293212
edited Mar 26 at 21:59
spacebiker
asked Mar 26 at 18:50
spacebikerspacebiker
293212
asked Mar 26 at 18:50
spacebikerspacebiker
293212
asked Mar 26 at 18:50
spacebikerspacebiker
293212
293212
1
I'm not familiar with Dovecot. Just wanted to note, though, that if your organization sends any purchase orders, invoices or anything else financial via email, you'll want to warn everyone who might receive such things that your email has been compromised and to be on the lookout for financial requests that look legitimate but send money to new account numbers. I know a guy who had $90k siphoned off his company's account in this fashion.
– ceejayoz
Mar 26 at 19:01
add a comment |
1
I'm not familiar with Dovecot. Just wanted to note, though, that if your organization sends any purchase orders, invoices or anything else financial via email, you'll want to warn everyone who might receive such things that your email has been compromised and to be on the lookout for financial requests that look legitimate but send money to new account numbers. I know a guy who had $90k siphoned off his company's account in this fashion.
– ceejayoz
Mar 26 at 19:01
1
1
I'm not familiar with Dovecot. Just wanted to note, though, that if your organization sends any purchase orders, invoices or anything else financial via email, you'll want to warn everyone who might receive such things that your email has been compromised and to be on the lookout for financial requests that look legitimate but send money to new account numbers. I know a guy who had $90k siphoned off his company's account in this fashion.
– ceejayoz
Mar 26 at 19:01
I'm not familiar with Dovecot. Just wanted to note, though, that if your organization sends any purchase orders, invoices or anything else financial via email, you'll want to warn everyone who might receive such things that your email has been compromised and to be on the lookout for financial requests that look legitimate but send money to new account numbers. I know a guy who had $90k siphoned off his company's account in this fashion.
– ceejayoz
Mar 26 at 19:01
add a comment |
1 Answer
1
active
oldest
votes
I finally found the answer:
I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address in the cc field. Somehow ISPConfig got compromissed and they logged in and changed those values. After changing the value in the ISPConfig interface the issue was still happening so I grep all files in /etc to find something and voila! I could find the rule in /var/vmail/destdomain.com/info/.sieve:
# Send a copy of email to
redirect "puncheseurope23@gmaiil.com";
Removing that line solved it.
I am inspecting right now to see if there is some more damage, meanwhile, I have added a fail2ban regex to the ISPConfig Logins.
answered Mar 26 at 19:27
spacebikerspacebiker
293212
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f960106%2fdovecot-sieve-forwards-a-copy-to-non-authorized-email-address%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I finally found the answer:
I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address in the cc field. Somehow ISPConfig got compromissed and they logged in and changed those values. After changing the value in the ISPConfig interface the issue was still happening so I grep all files in /etc to find something and voila! I could find the rule in /var/vmail/destdomain.com/info/.sieve:
# Send a copy of email to
redirect "puncheseurope23@gmaiil.com";
Removing that line solved it.
I am inspecting right now to see if there is some more damage, meanwhile, I have added a fail2ban regex to the ISPConfig Logins.
answered Mar 26 at 19:27
spacebikerspacebiker
293212
add a comment |
I finally found the answer:
I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address in the cc field. Somehow ISPConfig got compromissed and they logged in and changed those values. After changing the value in the ISPConfig interface the issue was still happening so I grep all files in /etc to find something and voila! I could find the rule in /var/vmail/destdomain.com/info/.sieve:
# Send a copy of email to
redirect "puncheseurope23@gmaiil.com";
Removing that line solved it.
I am inspecting right now to see if there is some more damage, meanwhile, I have added a fail2ban regex to the ISPConfig Logins.
answered Mar 26 at 19:27
spacebikerspacebiker
293212
add a comment |
I finally found the answer:
I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address in the cc field. Somehow ISPConfig got compromissed and they logged in and changed those values. After changing the value in the ISPConfig interface the issue was still happening so I grep all files in /etc to find something and voila! I could find the rule in /var/vmail/destdomain.com/info/.sieve:
# Send a copy of email to
redirect "puncheseurope23@gmaiil.com";
Removing that line solved it.
I am inspecting right now to see if there is some more damage, meanwhile, I have added a fail2ban regex to the ISPConfig Logins.
answered Mar 26 at 19:27
spacebikerspacebiker
293212
I finally found the answer:
I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address in the cc field. Somehow ISPConfig got compromissed and they logged in and changed those values. After changing the value in the ISPConfig interface the issue was still happening so I grep all files in /etc to find something and voila! I could find the rule in /var/vmail/destdomain.com/info/.sieve:
# Send a copy of email to
redirect "puncheseurope23@gmaiil.com";
Removing that line solved it.
I am inspecting right now to see if there is some more damage, meanwhile, I have added a fail2ban regex to the ISPConfig Logins.
answered Mar 26 at 19:27
spacebikerspacebiker
293212
edited yesterday
answered Mar 26 at 19:27
spacebikerspacebiker
293212
answered Mar 26 at 19:27
spacebikerspacebiker
293212
answered Mar 26 at 19:27
spacebikerspacebiker
293212
293212
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f960106%2fdovecot-sieve-forwards-a-copy-to-non-authorized-email-address%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
I'm not familiar with Dovecot. Just wanted to note, though, that if your organization sends any purchase orders, invoices or anything else financial via email, you'll want to warn everyone who might receive such things that your email has been compromised and to be on the lookout for financial requests that look legitimate but send money to new account numbers. I know a guy who had $90k siphoned off his company's account in this fashion.
– ceejayoz
Mar 26 at 19:01