Thanks for the responses!!
As you can tell I am a newb to procmail.
I use the "procmailrc" as a GLOBAL for all of the email address in my
company and NOT single individual accounts. I am trying to do an
INTERNAL EMAIL AUDIT:
ALL email that was sent by a "selected" user will be forwarded to an
"internal email auditor" of my choice. I want this forward to be
decided and implemented by my "procmail", and not by the client. This
audit will be enforced and analyzed on suspicious employees abusing the
email privileges.
Now with that said, let me try to answer some of your questions.
************************************
1. Show us the real names - I could guess what may be happening but
I'm not going to.
:0 c
# Person being audited for all outgoing messages
* ^From(_dot_)*dhubbell(_at_)tecategroup(_dot_)com
# Email Auditor that gets a copy of ALL outgoing emails sent by
employee.
! diont(_at_)tecategroup(_dot_)com
In this example, as a test, I sent from "dhubbell(_at_)tecategroup(_dot_)com"
to
"luser(_at_)tecategroup(_dot_)com". Hoping that a message that was sent by
dhubbell(_at_)tecategroup(_dot_)com would be forwarded
diont(_at_)tecategroup(_dot_)com(_dot_) This
gets stuck in a loop and bounces out of sight!
I am not sure, but I'll bet it has something to do with me using a
single procmailrc for my entire domain.
If I need to provide additional information, please ask!
Thank you!
Doug Hubbell
See below examples of files and logs:
1) my GLOBAL procmailrc
2) email header from bouncing emails
3) Procmail.log From bouncing
BTW, I do have junkfilter running in the same procmailrc file:
1) ************** GLOBAL procmailrc ************** Begin
PATH="/usr/bin:$PATH:/usr/local/bin"
SHELL=/bin/sh
# Junkfilter Additions Doug Hubbell 6-5-2002 (BEGIN) MAILDIR=/var/mail
JFDIR=/usr/local/etc/junkfilter
INCLUDERC=/usr/local/etc/junkfilter/junkfilter
# Deal with mail that junkfilter has flagged.
:0
* JFEXP ?? .
{
# Check for whitelisted mail
:0 f
* JFSTATUS ?? 1
| formail -i "X-junkfilter: $JFVERSION" \
-i "X-Spammer: $JFEXP"
# File as spam
:0 E :
| formail -i "X-junkfilter: $JFVERSION" \
-i "X-Spammer: $JFEXP" >> junkmail
}
# Junkfilter Additions Doug Hubbell 6-5-2002 (END)
# Spy Outgoing Emails (Begin)
:0 c
* ^From(_dot_)*dhubbell(_at_)tecategroup(_dot_)com
! diont(_at_)tecategroup(_dot_)com
# Spy Outgoing Emails (END)
POISONED_EXECUTABLES STRIPPED_EXECUTABLES=/etc/procmail/stripped
SECURITY_NOTIFY="postmaster" SECURITY_NOTIFY_VERBOSE="virus-checker"
SECURITY_NOTIFY_SENDER=
SECRET="I Changed this."
# this file must already exist, with proper permissions (rw--w--w-):
SECURITY_QUARANTINE=/var/spool/mail/quarantine
POISONED_SCORE=25
SCORE_HISTORY=/var/log/macro-scanner-scores
DROPPRIVS=YES
LOGFILE=/home/logs/procmail.log
# Finished setting up, now run the sanitizer...
INCLUDERC=/etc/procmail/html-trap.procmail
# Reset some things to avoid leaking info to
# the users...
POISONED_EXECUTABLES=
SECURITY_NOTIFY=
SECURITY_NOTIFY_VERBOSE=
SECURITY_NOTIFY_SENDER=
SECURITY_QUARANTINE=
SECRET=
************** GLOBAL procmailrc ************** End
From the email header mail received @ diont(_at_)tecategroup(_dot_)com:
2) ****************************** Email Header Begin
******************************
From line From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 12:01:03
2002
Return-Path: <root(_at_)mail(_dot_)tecategroup(_dot_)com>
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK134I008238 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:01:03
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK13fq008234 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:01:03 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK124I008195 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:01:02
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK123t008192 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:01:02 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK114I008164 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:01:01
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK11b4008161 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:01:01 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK104I008133 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:01:00
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK10qG008130 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:01:00 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK104I008096 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:01:00
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK10Q1008093 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:01:00 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK0x4I008052 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:00:59
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK0xhY008049 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:00:59 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK0w4I008010 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:00:58
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK0ww4008007 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:00:58 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK0v4I007978 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:00:57
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK0vwV007975 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:00:57 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK0u4I007946 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:00:56
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK0u8w007943 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:00:56 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK0u4I007915 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:00:56
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK0uAF007912 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:00:56 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK0t4I007884 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:00:55
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK0t1w007881 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:00:55 -0800 (PST)
Received: from mail.tecategroup.com (localhost.tecategroup.com
[127.0.0.1]) by mail.tecategroup.com (8.12.2/8.12.2) with ESMTP id
gBGK0s4I007853 for <diont(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:00:54
-0800 (PST)
Received: (from root(_at_)localhost) by mail.tecategroup.com
(8.12.2/8.12.2/Submit) id gBGK0sSl007852 for diont(_at_)tecategroup(_dot_)com;
Mon,
16 Dec 2002 12:00:54 -0800 (PST)
Received: from doughubbell (DHCP-192-168-30-112.tecategroup.com
[192.168.30.112]) (authenticated bits=0) by mail.tecategroup.com
(8.12.2/8.12.2) with ESMTP id gBGK0r4I007824 for
<luser(_at_)tecategroup(_dot_)com>; Mon, 16 Dec 2002 12:00:53 -0800 (PST)
Reply-To: <dhubbell(_at_)tecategroup(_dot_)com>
From: "Doug Hubbell" <dhubbell(_at_)tecategroup(_dot_)com>
To: <luser(_at_)tecategroup(_dot_)com>
Subject: Test AGAIN 9000
Date: Mon, 16 Dec 2002 12:01:23 -0800
Organization: Tecate Industries
Message-ID: <004601c2a53d$e8b9e440$701ea8c0(_at_)doughubbell>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2616
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-junkfilter: 20020519
X-Spammer: white: root(_at_)mail(_dot_)tecategroup(_dot_)com
****************************** Email Header END
******************************
3) ******************** Procmail.log BEGIN ********************
From dhubbell(_at_)tecategroup(_dot_)com Mon Dec 16 10:55:15 2002
Subject: Test
Folder: /var/mail/luser
867
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:16 2002
Subject: Test
Folder: /var/mail/diont
1315
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:17 2002
Subject: Test
Folder: /var/mail/diont
1693
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:18 2002
Subject: Test
Folder: /var/mail/diont
2071
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:18 2002
Subject: Test
Folder: /var/mail/diont
2449
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:19 2002
Subject: Test
Folder: /var/mail/diont
2827
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:20 2002
Subject: Test
Folder: /var/mail/diont
3205
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:21 2002
Subject: Test
Folder: /var/mail/diont
3583
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:22 2002
Subject: Test
Folder: /var/mail/diont
3961
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:22 2002
Subject: Test
Folder: /var/mail/diont
4339
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:23 2002
Subject: Test
Folder: /var/mail/diont
4717
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:24 2002
Subject: Test
Folder: /var/mail/diont
5095
From root(_at_)mail(_dot_)tecategroup(_dot_)com Mon Dec 16 10:55:25 2002
Subject: Test
Folder: /var/mail/diont
5473
Sanitizing MIME attachment headers in "Returned mail: see transcript for
details" from Mail Delivery Subsystem <MAILER-DAEMON
@mail.tecategroup.com> to diont
msgid=<200212161855(_dot_)gBGItPLw003069(_at_)mail(_dot_)tecategroup(_dot_)com>
From Mon Dec 16 10:55:26 2002
Subject: Returned mail: see transcript for details
Folder: /var/mail/diont
7565
Sanitizing MIME attachment headers in "Returned mail: see transcript for
details" from Mail Delivery Subsystem <MAILER-DAEMON
@mail.tecategroup.com> to dhubbell
msgid=<200212161855(_dot_)gBGItPLw003069(_at_)mail(_dot_)tecategroup(_dot_)com>
From Mon Dec 16 10:55:26 2002
Subject: Returned mail: see transcript for details
Folder: /var/mail/dhubbell
******************** Procmail.log END ********************
-----Original Message-----
From: procmail-admin(_at_)Lists(_dot_)RWTH-Aachen(_dot_)DE
[mailto:procmail-admin(_at_)Lists(_dot_)RWTH-Aachen(_dot_)DE] On Behalf Of Doug
Hubbell
Sent: Friday, December 13, 2002 3:15 PM
To: procmail(_at_)Lists(_dot_)RWTH-Aachen(_dot_)DE
Subject: Forwarding Inside the SAME domain question
Hello!
In my procmailrc file I have this and it does NOT work correctly:
:0 c
* ^From(_dot_)*nameONE(_at_)tecategroup(_dot_)com
! nameTWO(_at_)tecategroup(_dot_)com
The problem with the above, is it exceeds the hop count as it repeatedly
gets caught. When its all said and done it sends
"nameTWO(_at_)tecategroup(_dot_)com" about 12 messages and then EXCEEDS the hop
count.
How can I get this to check JUST once, and forward the message in the
SAME DOMAIN with out getting caught in a loop?
BTW, if I use the same recipe above, and direct it outside of my
internal domain, it works! Example...this works fine:
:0 c
* ^From(_dot_)*nameONE(_at_)tecategroup(_dot_)com
! anothername(_at_)OUTSIDEOFMYDOMAIN(_dot_)com
Thanks,
Doug Hubbell
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail