Strange email problems I've never encountered -- admin domain email spoofing

Spook

Verified User
Joined
Jan 3, 2006
Messages
138
Hello,

Having a few odd issues that I've not had to investigate before.

I've only the squirrelmail client installed and have not tried with a desktop client so far.. not to mention the problem seems to, at least in part have magically healed itself.

New DA users do not have the following squirrelmail fields populated automatically, something I am unsure has ever happened anyhow.

Name and Address Options
Full Name:
E-mail Address:
Reply To:

As such, sending mail results in header with:

ADMIN (snipped non domain lines in header) to second emailbox/user under DA admin. The problem came to my attention when a test reply bounced back due to invalid recipient -- note the lack of ".com" on return-path, etc.
Code:
+OK message follows
Return-path: <admin@example>
Envelope-to: [email protected]
Received: from localhost ([::1] helo=example.com)
	by srv.example.com with esmtpa (Exim 4.82.1)
	(envelope-from <admin@example>)
	for [email protected]; Sun, 08 Jun 2014 13:46:48 -0400
Received: from x.x.x.x
        (SquirrelMail authenticated user admin)
        by example.com with HTTP;
Message-ID: <[email protected]>
From: "Administrator" <admin@example>
To: [email protected]
I set values in SQmail for name and from, same problem. Removed the field data comepletly and problem went away. Added back minimal SQmail field info and still working. Tried with external mailboxes also.

However since it seems there may be some underlying kinks, not sure 'fixing' the problem as related to squirrelmail is really a solution at all.

USER created under ADMIN

[email protected]

connected to SSL webmail of server domain, https://example.com/squirrelmail as user "cust" and sent message to external mailbox. Message recv'd on external mailbox has header showing:
Code:
+OK message follows
Return-Path: [email protected]
Received: from srv.example.com ([x.x.x.x])
Received: from localhost ([::1] helo=example.com)
	by srv.example.com with esmtpa (Exim 4.82.1)
	(envelope-from <[email protected]>)
	for [email protected]; Sun, 08 Jun 2014 14:27:03 -0400
Received: from x.x.x.x
        (SquirrelMail authenticated user cust)
        by example.com with HTTP;
Message-ID: <[email protected]>
From: [email protected]
To: [email protected]
User-Agent: SquirrelMail/1.4.23 [SVN]
The user USER's domain, newdomain.example nor [email protected] ever entered into the headers. Fully spoofed email as if it were from my domain.

Presumably this can be tweaked in exim.conf but I've never seen this problem so not sure how the default exim.conf may be playing a part.

The gist of this is that after a bare-metal DA + CB2.0 install (nginx instead of apache) there seems to be some quirks with out-of-box email functionality.

I realize this is perhaps considerd an "at your own risk" DA installation but considering the observations I have had, it seems someone with more insighht with the workings of this all might want to look into it since the admin domain spoofing.


Last issue, a problem I think that I can find in search, welcome emails not being sent to user account email, although do get a cc on local admin mailbox without user password showing.
 
Back
Top