Hast ja recht. Hab mich echt ein bisschen zu kurz gefasst. Bin jetzt aber der Sache schon fast auf die Schliche gekommen: Ein Spammer faked eine interne Adresse. Postfix kann sie nicht zustellen, weil es einen "forwarding loop" gibt, da im Header schonmal ein "Delivered-To: echter_user@domain" drinsteht. Deshalb sendet er eine Meldung an die Fake-Adresse. Da beim Cyrus createonpost aktiviert ist, wird (ohne den Sender nocheinmal gegenzuprüfen!) ein Postfach mit der entsprechenden Nachricht im Gepäck angelegt. hier mal die Nachricht, die in der Inbox gelegen hat: #################################################################### Received: from mailserver ([unix socket]) by cyrus (Cyrus v2.2.12) with LMTPA; Tue, 23 Jan 2007 09:42:42 +0100 X-Sieve: CMU Sieve 2.2 Received: by mailserver (Postfix) id 793639265B; Tue, 23 Jan 2007 09:42:41 +0100 (CET) Date: Tue, 23 Jan 2007 09:42:41 +0100 (CET) From: MAILER-DAEMON@domain (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: fake@domain MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="47C859265A.1169541761/mailserver" Message-Id: <20070123084241.793639265B@mailserver.domain> This is a MIME-encapsulated message. --47C859265A.1169541761/mailserver.domain Content-Description: Notification Content-Type: text/plain This is the Postfix program at host mailserver.domain. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <echter_user@domain>: mail forwarding loop for echter_user@domain --47C859265A.1169541761/mailserver.domain Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns; mailserver.domain X-Postfix-Queue-ID: 47C859265A X-Postfix-Sender: rfc822; fake@domain Arrival-Date: Tue, 23 Jan 2007 09:42:41 +0100 (CET) Final-Recipient: rfc822; echter_user@domain Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; mail forwarding loop for echter_user@domain --47C859265A.1169541761/mailserver.domain Content-Description: Undelivered Message Content-Type: message/rfc822 Received: from localhost (localhost [127.0.0.1]) by mailserver.domain (Postfix) with ESMTP id 47C859265A for <echter_user@domain>; Tue, 23 Jan 2007 09:42:41 +0100 (CET) Received: from mailserver.domain ([127.0.0.1]) by localhost (mailserver.domain [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 27238-08 for <echter_user@domain>; Tue, 23 Jan 2007 09:42:40 +0100 (CET) Received: from 203-113-17-130.totbb.net (203-113-17-130.totbb.net [203.113.17.130]) by mailserver.domain (Postfix) with SMTP id 40DA292658 for <echter_user@domain>; Tue, 23 Jan 2007 09:42:30 +0100 (CET) X-Original-To: echter_user@domain Delivered-To: echter_user@domain Received: from [203.113.17.130] (port=17362 helo=203-113-17-130.totbb.net) by mailserver.domain with esmtp id 118027-118027-34 for echter_user@domain; Tue, 23 Jan 2007 15:43:55 +0900 (EET) Message-ID: <245601c73f05$01c73f05$821171cb@domain> From: "Kendall" <fake@domain> To: "Kendall" <echter_user@domain> Subject: {SPAM?} anglo with patina Date: Tue, 23 Jan 2007 15:43:55 +0900 (EET) MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_001_2451_01C73EB9.DA69B0E0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Virus-Scanned: amavisd-new at domain X-Spam-Status: Yes, score=8.992 tagged_above=2 required=5 tests=[BAYES_99=3.5, EXTRA_MPART_TYPE=1.091, HTML_IMAGE_ONLY_28=1.9, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5] X-Spam-Score: 8.992 X-Spam-Level: ******** X-Spam-Flag: YES ------=_NextPart_001_2451_01C73EB9.DA69B0E0 Content-Type: multipart/alternative; boundary="----=_NextPart_002_2451_01C73EB9.DA69B0E0" . . . [snip] #################################################################### die /etc/imapd.conf sieht folgendermaßen aus: configdirectory: /var/lib/imap partition-default: /home/imap sievedir: /var/lib/sieve admins: cyrus allowanonymouslogin: no #allowplaintext = yes # # folgendes wirkt sich auf neu angelegte Mailboxen aus # autocreatequota: 512000 autocreateinboxfolders: Spam autosubscribeinboxfolders: Spam implicit_owner_rights: lrswicd autocreate_sieve_script: /var/lib/sieve/default_sieve_script # createonpost: 1 # servername: mailserver reject8bit: no quotawarn: 90 timeout: 720 poptimeout: 720 dracinterval: 0 drachost: localhost sasl_pwcheck_method: saslauthd sasl_mech_list: PLAIN LOGIN lmtp_overquota_perm_failure: no lmtp_downcase_rcpt: yes username_tolower: 1 # # if you want TLS, you have to generate certificates and keys # tls_ca_file: /pfad/zu/CAcert.pem tls_cert_file: /pfad/zu/cert.pem tls_key_file: /pfad/zu/key.pem tls_session_timeout: 1440 #tls_ca_path: /usr/ssl/CA ################################################################ /var/log/messages: lmtpunix[27029]: autocreateinbox: User fake, INBOX was successfully created in partition default lmtpunix[27029]: autocreateinbox: User fake, subfolder INBOX.Spam creation succeeded. lmtpunix[27029]: autocreateinbox: User fake, subscription to INBOX.Spam succeeded lmtpunix[27029]: User fake, Inbox subfolders, created 1, subscribed 1 lmtpunix[27029]: autocreate_sieve: autocreate_sieve_compiledscript option is not defined. Compiling it lmtpunix[27029]: entered bc_action_emit with filelen: 16 lmtpunix[27029]: entered bc_action_emit with filelen: 88 lmtpunix[27029]: autocreate_sieve: User fake, default sieve script creation succeeded lmtpunix[27029]: duplicate_check: <20070123084241.793639265B@mailserver.domain> user.fake 0 lmtpunix[27029]: duplicate_mark: <20070123084241.793639265B@mailserver.domain> user.fake 1169541762 1 lmtpunix[27029]: mystore: starting txn 2147755104 lmtpunix[27029]: mystore: committing txn 2147755104 lmtpunix[27029]: duplicate_mark: <20070123084241.793639265B@mailserver.domain> .fake+@.sieve. 1169541764 0 ################################################################## /etc/sysconfig/saslauthd SASLAUTHD_AUTHMECH=pam -> PAM verweißt auf LDAP ################################################################## Aber warum erstellt dann Cyrus einfach eine Mailbox ohne zu checken ob es den User überhaupt gibt? Mail wird per LMTP weitergereicht. Danke für Eure Hinweise... Grüße Dominik -- Um die Liste abzubestellen, schicken Sie eine Mail an: opensuse-de+unsubscribe@opensuse.org Um eine Liste aller verfuegbaren Kommandos zu bekommen, schicken Sie eine Mail an: opensuse-de+help@opensuse.org