Re: dovecot is moving messages to spam

[Webert de Souza Lima]

Hello,

it worked just fine. thank your for your help.

After change this user's password and kicked him, I resent the e-mail and
it didn't move.
Surely he has some MUA set somewhere but he has no clue where.

Thank you for your time.

On Wed, Sep 28, 2016 at 11:13 AM, Aki Tuomi  wrote:

> Hi,
>
> you could try doveadm who and doveadm kick. These might help you out.
>
> Aki
> > On September 28, 2016 at 4:39 PM Webert de Souza Lima <
> webert.b...@gmail.com> wrote:
> >
> >
> > Hi Konstantin,
> >
> > There is no sieve for the user (checked his dovecot mail directory, sieve
> > folder is empty and there is no sieve file) and the only global sieve
> > present is regarding the  X-Spam-Flag header, which is not the case.
> > There is no login happening for this user and this occur, for sure.
> >
> > The only thing I can imagine is some e-mail client as you said is holding
> > an old connection open, previously authenticated (before I disabled his
> > login) and moving the messages with some filter.
> > Looking at the logs, it surely looks like an e-mail client software.
> >
> > I'll take a deeper look into this.
> >
> > On Wed, Sep 28, 2016 at 10:30 AM, Konstantin Khomoutov <
> > flatw...@users.sourceforge.net> wrote:
> >
> > > On Wed, 28 Sep 2016 10:15:25 -0300
> > > Webert de Souza Lima  wrote:
> > >
> > > > is there any dovecot rule settings besides X-Spam-Flag header? Can it
> > > > move messages via IMAP?
> > > >
> > > > I have a message that is being moved to spam folder after delivered
> > > > in the INBOX but it has no X-Spam-Flag and it's not beeing done by
> > > > the user (I changed his password, suspended his account and made his
> > > > login impossible).
> > > >
> > > > This happens only when certain "FROM" address is present in the body,
> > > > like the following message (sent via telnet):
> > > [...]
> > > > Sep 28 13:08:00 lmtp(my.user@my.domain): Info:
> OOKlA3rA61dNbwAAkzG9Ng:
> > > > sieve: msgid=unspecified: stored mail into mailbox 'INBOX'
> > > >
> > > > Sep 28 13:08:01 imap(my.user@my.domain): Info: copy from INBOX:
> > > > box=INBOX.Spam, uid=154, msgid=, size=340, subject=Test
> > > >
> > > > Sep 28 13:08:01 imap(my.user@my.domain): Info: expunge: box=INBOX,
> > > > uid=18147, msgid=, size=340, subject=Test
> > > [...]
> > >
> > > Are you sure there's no Sieve script active for this user?
> > > (Note that there also could be a global Sieve script or scripts which
> > > are executed before/after those of a user.)
> > >
> > > And have you really verified nothing logs into the server for sure
> > > using that user's credentials (such as a Thunderbird instance with mail
> > > filters enabled)?  Another thing to check is that this user's INBOX
> > > folder is not shared with someone else (if at all possible).
> > >
>

Re: dovecot is moving messages to spam

[Aki Tuomi]

Hi,

you could try doveadm who and doveadm kick. These might help you out. 

Aki
> On September 28, 2016 at 4:39 PM Webert de Souza Lima  
> wrote:
> 
> 
> Hi Konstantin,
> 
> There is no sieve for the user (checked his dovecot mail directory, sieve
> folder is empty and there is no sieve file) and the only global sieve
> present is regarding the  X-Spam-Flag header, which is not the case.
> There is no login happening for this user and this occur, for sure.
> 
> The only thing I can imagine is some e-mail client as you said is holding
> an old connection open, previously authenticated (before I disabled his
> login) and moving the messages with some filter.
> Looking at the logs, it surely looks like an e-mail client software.
> 
> I'll take a deeper look into this.
> 
> On Wed, Sep 28, 2016 at 10:30 AM, Konstantin Khomoutov <
> flatw...@users.sourceforge.net> wrote:
> 
> > On Wed, 28 Sep 2016 10:15:25 -0300
> > Webert de Souza Lima  wrote:
> >
> > > is there any dovecot rule settings besides X-Spam-Flag header? Can it
> > > move messages via IMAP?
> > >
> > > I have a message that is being moved to spam folder after delivered
> > > in the INBOX but it has no X-Spam-Flag and it's not beeing done by
> > > the user (I changed his password, suspended his account and made his
> > > login impossible).
> > >
> > > This happens only when certain "FROM" address is present in the body,
> > > like the following message (sent via telnet):
> > [...]
> > > Sep 28 13:08:00 lmtp(my.user@my.domain): Info: OOKlA3rA61dNbwAAkzG9Ng:
> > > sieve: msgid=unspecified: stored mail into mailbox 'INBOX'
> > >
> > > Sep 28 13:08:01 imap(my.user@my.domain): Info: copy from INBOX:
> > > box=INBOX.Spam, uid=154, msgid=, size=340, subject=Test
> > >
> > > Sep 28 13:08:01 imap(my.user@my.domain): Info: expunge: box=INBOX,
> > > uid=18147, msgid=, size=340, subject=Test
> > [...]
> >
> > Are you sure there's no Sieve script active for this user?
> > (Note that there also could be a global Sieve script or scripts which
> > are executed before/after those of a user.)
> >
> > And have you really verified nothing logs into the server for sure
> > using that user's credentials (such as a Thunderbird instance with mail
> > filters enabled)?  Another thing to check is that this user's INBOX
> > folder is not shared with someone else (if at all possible).
> >

Re: dovecot is moving messages to spam

[Webert de Souza Lima]

Hi Konstantin,

There is no sieve for the user (checked his dovecot mail directory, sieve
folder is empty and there is no sieve file) and the only global sieve
present is regarding the  X-Spam-Flag header, which is not the case.
There is no login happening for this user and this occur, for sure.

The only thing I can imagine is some e-mail client as you said is holding
an old connection open, previously authenticated (before I disabled his
login) and moving the messages with some filter.
Looking at the logs, it surely looks like an e-mail client software.

I'll take a deeper look into this.

On Wed, Sep 28, 2016 at 10:30 AM, Konstantin Khomoutov <
flatw...@users.sourceforge.net> wrote:

> On Wed, 28 Sep 2016 10:15:25 -0300
> Webert de Souza Lima  wrote:
>
> > is there any dovecot rule settings besides X-Spam-Flag header? Can it
> > move messages via IMAP?
> >
> > I have a message that is being moved to spam folder after delivered
> > in the INBOX but it has no X-Spam-Flag and it's not beeing done by
> > the user (I changed his password, suspended his account and made his
> > login impossible).
> >
> > This happens only when certain "FROM" address is present in the body,
> > like the following message (sent via telnet):
> [...]
> > Sep 28 13:08:00 lmtp(my.user@my.domain): Info: OOKlA3rA61dNbwAAkzG9Ng:
> > sieve: msgid=unspecified: stored mail into mailbox 'INBOX'
> >
> > Sep 28 13:08:01 imap(my.user@my.domain): Info: copy from INBOX:
> > box=INBOX.Spam, uid=154, msgid=, size=340, subject=Test
> >
> > Sep 28 13:08:01 imap(my.user@my.domain): Info: expunge: box=INBOX,
> > uid=18147, msgid=, size=340, subject=Test
> [...]
>
> Are you sure there's no Sieve script active for this user?
> (Note that there also could be a global Sieve script or scripts which
> are executed before/after those of a user.)
>
> And have you really verified nothing logs into the server for sure
> using that user's credentials (such as a Thunderbird instance with mail
> filters enabled)?  Another thing to check is that this user's INBOX
> folder is not shared with someone else (if at all possible).
>

Re: dovecot is moving messages to spam

[Konstantin Khomoutov]

On Wed, 28 Sep 2016 10:15:25 -0300
Webert de Souza Lima  wrote:

> is there any dovecot rule settings besides X-Spam-Flag header? Can it
> move messages via IMAP?
> 
> I have a message that is being moved to spam folder after delivered
> in the INBOX but it has no X-Spam-Flag and it's not beeing done by
> the user (I changed his password, suspended his account and made his
> login impossible).
> 
> This happens only when certain "FROM" address is present in the body,
> like the following message (sent via telnet):
[...]
> Sep 28 13:08:00 lmtp(my.user@my.domain): Info: OOKlA3rA61dNbwAAkzG9Ng:
> sieve: msgid=unspecified: stored mail into mailbox 'INBOX'
> 
> Sep 28 13:08:01 imap(my.user@my.domain): Info: copy from INBOX:
> box=INBOX.Spam, uid=154, msgid=, size=340, subject=Test
> 
> Sep 28 13:08:01 imap(my.user@my.domain): Info: expunge: box=INBOX,
> uid=18147, msgid=, size=340, subject=Test
[...]

Are you sure there's no Sieve script active for this user?
(Note that there also could be a global Sieve script or scripts which
are executed before/after those of a user.)

And have you really verified nothing logs into the server for sure
using that user's credentials (such as a Thunderbird instance with mail
filters enabled)?  Another thing to check is that this user's INBOX
folder is not shared with someone else (if at all possible).

dovecot is moving messages to spam

[Webert de Souza Lima]

Hi,

is there any dovecot rule settings besides X-Spam-Flag header? Can it move
messages via IMAP?

I have a message that is being moved to spam folder after delivered in the
INBOX but it has no X-Spam-Flag and it's not beeing done by the user (I
changed his password, suspended his account and made his login impossible).

This happens only when certain "FROM" address is present in the body, like
the following message (sent via telnet):

From:
Subject: Test

teste
.


Dovecot logs:

Sep 28 13:08:00 lmtp(my.user@my.domain): Info: OOKlA3rA61dNbwAAkzG9Ng:
sieve: msgid=unspecified: stored mail into mailbox 'INBOX'

Sep 28 13:08:01 imap(my.user@my.domain): Info: copy from INBOX:
box=INBOX.Spam, uid=154, msgid=, size=340, subject=Test

Sep 28 13:08:01 imap(my.user@my.domain): Info: expunge: box=INBOX,
uid=18147, msgid=, size=340, subject=Test

Thanks in advance