Now granted, this message is SPAM, but have a look at these headers:
Return-Path: <autos.comtricycletricks.com>
Received: from blah ([unix socket])
by blah-b (Cyrus v2.2.12) with LMTPA;
Mon, 09 Jan 2006 15:32:49 -0500
X-Sieve: CMU Sieve 2.2
Received: from localhost (localhost.localdomain [127.0.0.1])
by blah.ivytech.edu (Postfix) with ESMTP id E840DA608
for <fakeduserivytech.edu>; Mon, 9 Jan 2006 15:32:48 -0500 (EST)
Received: from blah.ivytech.edu ([127.0.0.1])
by localhost (blah-b [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
id 23161-02 for <fakeduserivytech.edu>; Mon, 9 Jan 2006 15:32:43 -0500 (EST)
Received: from candle.tricycletricks.com (candle.tricycletricks.com
[72.29.19.12
by blah.ivytech.edu (Postfix) with ESMTP id 3732435A8
for <fakeduserivytech.edu>; Mon, 9 Jan 2006 15:32:40 -0500 (EST)
What's odd is that the message was actually supposed to be delivered to some
other
user, called "realuser." According to the MTA's logs, we have:
Jan 9 15:32:49 blah-b postfix/lmtp[19897]: E840DA608:
to=<fakeduserivytech.edu>, relay=/var/imap/socket/lmtp[/var/imap/socket/lmtp],
delay=1, status=sent (250 2.1.5 Ok)
"fakeduser," according to Postfix, is the envelope recipient (specified in RCPT
TO), yet when Cyrus gets this message, it's delivered to realuser's mailbox.
What's going on here? This is 2.2.12 on Debian 3.1.
imapd.conf:
configdirectory: /var/imap
partition-default: /var/imap/store
sasl_pwcheck_method: saslauthd
sasl_passwd_check: saslauthd
sasl_mech_list: PLAIN
singleinstancestore: 1
duplicatesuppression: 0
admins: cyrus
allowanonymouslogin: no
lmtp_downcase_rcpt: true
berkeley_cachesize: 10240
duplicate_db: skiplist
quota_db: skiplist
mboxlist_db: skiplist
seenstate_db: skiplist
quotawarn: 90
lmtp_over_quota_perm_failure: 1
autocreatequota: 15360
createonpost: 1
autocreateinboxfolders: Sent|Drafts|Trash
autosubscribeinboxfolders: Sent|Drafts|Trash
autosubscribesharedfolders: user.PublicFolders | user.PublicFolders.SPAM Can | u
fulldirhash: 1
hashimapspool: 1
mailnotifier: mailto
notifysocket: /var/imap/socket/notify
sievenotifier: mailto
sievedir: /var/imap/sieve
And because we're talking LDAP here, saslauthd.conf:
ldap_servers: ldap://ldap.ivytech.edu
ldap_search_base: ou=People,dc=ivytech,dc=edu
ldap_auth_method: bind
ldap_port: 389
ldap_version: 3
ldap_verbose: on
ldap_debug: 10
ldap_filter: (&(uid=%u)(o=Mail))
Thanks,
John
--
John Madden
UNIX Systems Engineer
Ivy Tech Community College of Indiana
[EMAIL PROTECTED]
----
Cyrus Home Page: http://asg.web.cmu.edu/cyrus
Cyrus Wiki/FAQ: http://cyruswiki.andrew.cmu.edu
List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html
