From: James G. McIntyre (jimmcintyresecurity.com)
Date: Mon Jul 17 2006 - 12:18:23 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Folks:

I am new to postfix and having 1 last implementation problem, hopefully.

The site I am working on has 8 hosted domains. The receiver address is
properly verified by the virtual table. My problem is the receivers hosted
domain name is re-written by the mail servers domain name,

ex. orginal to: jimhosted-domain1.com and when placed in the mail file is
jimnewserve.machine-domain.com.

How do I stop this ?

Thanks...jim mc....

Below is the full log from the emai in question:

Jul 17 12:30:10 newserve postfix/smtpd[19334]: connect from senderip
Jul 17 12:30:11 newserve postfix/smtpd[19334]: 75A56B29BF: senderip
Jul 17 12:30:11 newserve postfix/cleanup[19336]: 75A56B29BF:
message-id=<20060717163010.75A56B29BFnewserve.machine-domain.com>
Jul 17 12:30:11 newserve postfix/smtpd[19334]: disconnect from senderip
Jul 17 12:30:11 newserve postfix/qmgr[19333]: 75A56B29BF:
from=<jimmcintyresecurity.com>, size=436, nrcpt=1 (queue active)
Jul 17 12:30:11 newserve spamd[22915]: connection from
localhost.localdomain [127.0.0.1] at port 35223
Jul 17 12:30:11 newserve spamd[22915]: info: setuid to filter succeeded
Jul 17 12:30:11 newserve spamd[22915]: processing message
<20060717163010.75A56B29BFnewserve.machine-domain.com> for filter:1042.
Jul 17 12:30:12 newserve spamd[22915]: clean message (2.1/5.0) for
filter:1042 in 1.1 seconds, 467 bytes.
Jul 17 12:30:12 newserve spamd[22915]: result: . 2 -
ALL_TRUSTED,MISSING_SUBJECT,NO_REAL_NAME,RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL,UNDISC_RECIPS
scantime=1.1,size=467,mid=<20060717163010.75A56B29BFnewserve.machine-domain.com>,autolearn=no
Jul 17 12:30:12 newserve sendmail[19342]: k6HGUCL1019342:
Authentication-Warning: newserve.machine-domain.com: spamfilter set sender
to jimmcintyresecurity.com using -f
Jul 17 12:30:12 newserve sendmail[19342]: k6HGUCL1019342:
from=jimmcintyresecurity.com, size=736, class=0, nrcpts=1,
msgid=<20060717163010.75A56B29BFnewserve.machine-domain.com>,
relay=spamfilterlocalhost
Jul 17 12:30:12 newserve postfix/smtpd[19343]: warning: dict_nis_init: NIS
domain name not set - NIS lookups disabled
Jul 17 12:30:12 newserve postfix/smtpd[19343]: connect from
localhost.localdomain[127.0.0.1]
Jul 17 12:30:14 newserve postfix/smtpd[19343]: C8131B29C7:
client=localhost.localdomain[127.0.0.1]
Jul 17 12:30:14 newserve postfix/cleanup[19336]: C8131B29C7:
message-id=<20060717163010.75A56B29BFnewserve.machine-domain.com>
Jul 17 12:30:14 newserve sendmail[19342]: k6HGUCL1019342: to=jmcintyr,
ctladdr=jimmcintyresecurity.com (96/96), delay=00:00:02, xdelay=00:00:02,
mailer=relay, pri=30736, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0,
stat=Sent (Ok: queued as C8131B29C7)
Jul 17 12:30:14 newserve postfix/qmgr[19333]: C8131B29C7:
from=<jimmcintyresecurity.com>, size=1185, nrcpt=1 (queue active)
Jul 17 12:30:14 newserve postfix/smtpd[19343]: disconnect from
localhost.localdomain[127.0.0.1]
Jul 17 12:30:14 newserve postfix/local[19344]: warning: dict_nis_init: NIS
domain name not set - NIS lookups disabled

to re-written below:

Jul 17 12:30:14 newserve postfix/pipe[19337]: 75A56B29BF: to=<jmcintyr>,
orig_to=<jim.mcintyrehosted-domain1.com>, relay=spamfilter, delay=4,
status=sent (dummy)
Jul 17 12:30:14 newserve postfix/qmgr[19333]: 75A56B29BF: removed
Jul 17 12:30:14 newserve postfix/local[19344]: C8131B29C7:
to=<jmcintyrnewserve.machine-domain.com>, relay=local, delay=2,
status=sent (delivered to mailbox)
Jul 17 12:30:14 newserve postfix/qmgr[19333]: C8131B29C7: removed

--
James G. McIntyre
Senior Consultant
SANS/GIAC - GCIA Certified Intrusion Analyst
          - GCFA Certified Firewall Analyst
          - GAWN Auditing Wireless Networks
          - GWAS Web Application Security
HP-UX Certified System Administrator

McIntyre & Associates, Inc.
Virginia Tech Corporate Research Center
2020 Kraft Drive, Suite 3005
Blacksburg, VA 24060
540-552-9090
www.mcintyresecurity.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]