OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: all outgoing mail is written as userlocalhost.localdomain

From: Sandy Drobic (postfix-usersjapantest.homelinux.com)
Date: Mon Nov 21 2005 - 06:25:42 CST


Aaron Harwood wrote:

>> Okay, now it's getting a bit weird (not unusual on a monday after
>> all). I don't think there is a problem with your basic configuration
>> any more. Let's have a look at other possiblilities that might
>> account for the rewriting of the address. Could you post the
>> logentries of a message from client connect to delivery in /var/
>> log/maillog?
>
>
> Nov 21 22:46:03 home postfix/postfix-script: stopping the Postfix
> mail system
> Nov 21 22:46:03 home postfix/master[5633]: terminating on signal 15
> Nov 21 22:46:06 home postfix/postfix-script: starting the Postfix
> mail system
> Nov 21 22:46:06 home postfix/master[6024]: daemon started -- version
> 2.1.5
> Nov 21 22:46:40 home sendmail[6064]: jALBke5u006064: from=aharwood,
> size=54, class=0, nrcpts=1,
> msgid=<200511211146.jALBke5u006064localhost.localdomain>,
> relay=aharwoodlocalhost

This is a bit unusual, normally the connection starts with a client
connect entry. Is that a mail that was injected locally via sendmail?
Also, the message id usually contains the hostname, and here the
hostname is obviously "localhost.localdomain".

Here is an example log from my server:

Nov 21 12:37:56 katgar postfix/smtpd[17854]: connect from
grobi.washu.lab[192.168.0.4]
Nov 21 12:37:57 katgar postfix/smtpd[17854]: 5B3621DB4C:
client=grobi.washu.lab[192.168.0.4], sasl_method=PLAIN,
sasl_username=sasluser
Nov 21 12:37:57 katgar postfix/cleanup[17855]: 5B3621DB4C:
message-id=<4381B193.3070208japantest.homelinux.com>
Nov 21 12:37:57 katgar postfix/qmgr[17423]: 5B3621DB4C:
from=<postfix-usersjapantest.homelinux.com>, size=1727, nrcpt=1 (queue
active)
Nov 21 12:37:57 katgar postfix/smtpd[17854]: disconnect from
grobi.washu.lab[192.168.0.4]
Nov 21 12:38:03 katgar postfix/cleanup[17855]: B09D51DB4F:
message-id=<4381B193.3070208japantest.homelinux.com>
Nov 21 12:38:03 katgar postfix/qmgr[17423]: B09D51DB4F:
from=<postfix-usersjapantest.homelinux.com>, size=2219, nrcpt=1 (queue
active)
Nov 21 12:38:03 katgar amavis[17319]: (17319-03) Passed,
<postfix-usersjapantest.homelinux.com> -> <postfix-userspostfix.org>,
Message-ID: <4381B193.307020
8japantest.homelinux.com>, Hits: -5.84
Nov 21 12:38:03 katgar amavis[17319]: (17319-03) Passed CLEAN,
<postfix-usersjapantest.homelinux.com> -> <postfix-userspostfix.org>,
Hits: -5.84, tag=-20,
tag2=3.5, kill=3.5, 0/Y/0/0
Nov 21 12:38:03 katgar postfix/smtp[17856]: 5B3621DB4C:
to=<postfix-userspostfix.org>, relay=127.0.0.1[127.0.0.1], delay=6,
status=sent (250 2.6.0 Ok, id=17
319-03, from MTA: 250 Ok: queued as B09D51DB4F)
Nov 21 12:38:03 katgar postfix/qmgr[17423]: 5B3621DB4C: removed
Nov 21 12:38:05 katgar postfix/smtp[17864]: B09D51DB4F:
to=<postfix-userspostfix.org>, relay=mail.cloud9.net[168.100.1.9],
delay=2, status=sent (250 Ok: que
ued as 35EF6199BC)
Nov 21 12:38:05 katgar postfix/qmgr[17423]: B09D51DB4F: removed

What does "postconf myhostname" say?

katgar:~ # postconf myhostname
myhostname = japantest.homelinux.com

Please note that katgar is the internal server name.

Sandy