The account that was created by userbase that he logged in to, (the empty mailbox) is gone. The way I fixed this was that I restored his account into a new account, called "knight_restored" put both accounts in maint, exported the mail that had been delivered into the new empty account, imported it into the restored account, renamed the new account "knight_saved", renamed the restored account to "knight", unmainted the "knight" account, made sure stuff was working. I did play around with the restored account for a bit, setting it to closed and active ... but then in an effort to minimize confusion I deleted it.
--
Max Trefonides
MCS Systems
maxadam@mcs.anl.gov
On Jun 25, 2013, at 12:06 PM, Craig Stacey <stace@mcs.anl.gov> wrote:
So, as best as I can tell, this account was never deleted. Here's what happened on the server when the account was deactivated. You see it get deactivated (set state to closed) then some failed auth attempts.
zimbra% zgrep knight auth.log.6.gz
Jun 17 08:39:31 zimbra saslauthd[24706]: auth_zimbra: knight@mcs.anl.gov auth OK
Jun 17 09:13:07 zimbra sudo: mcsadmin : TTY=unknown ; PWD=/home/mcsadmin ; USER=zimbra ; COMMAND=/opt/zimbra/bin/zmprov getAccount knight@mcs.anl.gov
Jun 17 09:13:12 zimbra sudo: mcsadmin : TTY=unknown ; PWD=/home/mcsadmin ; USER=zimbra ; COMMAND=/opt/zimbra/bin/zmprov modifyAccount knight@mcs.anl.gov zimbraAccountStatus closed
Jun 17 15:12:26 zimbra saslauthd[24703]: zmpost: url='https://zimbra-mb1.anl.gov:7071/service/admin/soa
p/'
returned buffer->data='<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><soap:Fault><soap:Code><soap:Value>soap:Sender</soap:Value></soap:Code><soap:Reason><soap:Text>authentication failed for [knight@mcs.anl.gov]</soap:Text></soap:Reason><soap:Detail><Error xmlns="urn:zimbra"><Code>account.AUTH_FAILED</Code><Trace>btpool0-124524://zimbra-mb1.anl.gov:7071/service/admin/soap/:1371499946551:a856ad0268f4a69b</Trace></Error></soap:Detail></soap:Fault></soap:Body></soap:Envelope>;', hti->error=''
Jun
17 15:12:26 zimbra saslauthd[24703]: auth_zimbra: knight@mcs.anl.gov auth failed: authentication failed for [knight@mcs.anl.gov]
Jun 17 15:12:26 zimbra saslauthd[24703]: do_auth : auth failure: [user=knight@mcs.anl.gov] [service=smtp] [realm=mcs.anl.gov] [mech=zimbra] [reason=Unknown]
Jun 17 15:12:30 zimbra saslauthd[24706]: zmpost: url='https://zimbra-mb1.anl.gov:7071/service/admin/soap/' returned buffer->data='<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><soap:Fault><soap:Code><soap:Value>soap:Sender</soap:Value></soap:Code><soap:Reason><soap:Text>authentication failed for
[knight@mcs.anl.gov]</soap:Text></soap:Reason><soap:Detail><Error xmlns="urn:zimbra"><Code>account.AUTH_FAILED</Code><Trace>btpool0-124524://zimbra-mb1.anl.gov:7071/service/admin/soap/:1371499950189:a856ad0268f4a69b</Trace></Error></soap:Detail></soap:Fault></soap:Body></soap:Envelope>;', hti->error=''
Jun 17 15:12:30 zimbra saslauthd[24706]: auth_zimbra: knight@mcs.anl.gov auth failed: authentication failed for [knight@mcs.anl.gov]
Jun 17 15:12:30 zimbra saslauthd[24706]: do_auth : auth failure: [user=knight@mcs.anl.gov] [service=smtp] [realm=mcs.anl.gov] [mech=zimbra] [reason=Unknown]
I can't find the log for the reactivation beca
use I
something went wrong with the log rotation on zimbra. auth.log.6.gz ends at Jun 18 06:31:17 and auth.log.5.gz starts at Jun 19 06:42:52, so the whole day of June 18th is missing (which is when it was reactivated).
Scouring other logs of that day doesn't show me much of anything useful, but the create script is pretty straightforward and would not blow away an existing account. The first test will create it if it doesn't exist, and the rest modify the created account to ensure name parameters match expectations.
Did the restored account get blown away already?
--
Craig
On Jun 19, 2013, at 4:31 PM, Max Trefonides <maxadam@mcs.anl.gov> wrote:
Despite the fact that it was deleted the scripts should not have deleted the mailbox:
"•Closed. When a mailbox status is closed, the login is
disabled, and messages are bounced. This status is used to soft-delete an account before deleting it from the server."
it's still a mystery why the mailbox was emptied, the scripts check out, I'm wondering if it might be related to the mailbox living on zimbra-mb2 ... I'm reaching here ... the script lives in zimbra.anl.gov:/home/mcsadmin/bin ... I'm waiting on rios to work with me on that.
I've restored his mailbox and imported the mail tat was sent to the new one into it and renamed the restored mailbox to knight@mcs.anl.gov
--
Max Trefonides
MCS Systems
maxadam@mcs.anl.gov
On Jun 18, 2013, at 5:28 PM, Craig Stacey <stace@mcs.anl.gov> wrote:
Indeed. It only removed it from the address maps.
-- Craig (from my mobile)
Ken Raffenett
i
<raffenet@mcs.anl.gov> wrote:
The "/root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE" script
is a local operation on newman. It doesn't touch anything on the zimbra
server. And the REMOVE argument doesn't actually do anything from what
I can tell. Someone needs to look at what script the zimbra-deact-key
invokes on the Zimbra server to find out why mail disappeared.
----- Original Message -----
From: "Max Trefonides" <maxadam@mcs.anl.gov>
To: "Core Sysadmins" <core-sysadmins@mcs.anl.gov>
Sent: Tuesday, June 18, 2013 4:58:31 PM
Subject: Fwd: [mcs-systems #167302] Testing your mail
FYI:
--Max
Trefonides
MCS Systems
maxadam@mcs.anl.gov
Begin forwarded message:
From: Max Trefonides <maxadam@mcs.anl.gov>
Subject: Fwd: [mcs-systems #167302] Re: Testing your mail
Date: June 18, 2013 4:58:02 PM CDT
To: Mike Rios <mrios@anl.gov>
This is a user who was suspended in our account system yesterday,
we reactivated and now the user does not see any old mail in his
account.
I gotta go, but this is what our system ran ...
/root/bin/zimbra-deact.sh mcs.anl.gov knight
it looks like this is what was run:
root@newman:/etc/postfix# less /root/bin/zimbra-deact.sh
#!/bin/sh
DOMAIN=$1 # domain name
USERNAME=$2 #
Username
if ssh -q -i /root/.ssh/zimbra-deact-key mcsadmin@zimbra.anl.gov
$DOMAIN:$USERNAME
then
if ! /root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE
then
echo mailrelay fail
exit 1
fi
else
echo zimbra fail
exit 1
fi
UGH! why is that a REMOVE?!?!?
Can you help me restore this account? new mail has been being
delivered today, I wanted to tell you as soon as I knew, to try to
avoid the problem we had last time. right now I have a little
league playoff game to get to ...
--
Max Trefonides
MCS Systems
maxadam@mcs.anl.gov
Begin forwarded message:
From: Chris Knight <knight@mcs.anl.gov>
Subject: [mcs-systems #167302] Re: Testing your mail
D
ate:
June 18, 2013 4:46:03 PM CDT
To: Tina Stanton-Piersanti <tstanton@mcs.anl.gov>
Cc: systems@mcs.anl.gov
Reply-To: systems@mcs.anl.gov, Chris Knight <knight@mcs.anl.gov>
quick update: messages started coming in at 3:48pm (which is, of
course, shortly after I created the ticket), but contents from
Saturday still gone.
chris
On Jun 18, 2013, at 4:41 PM, Tina Stanton-Piersanti
<tstanton@mcs.anl.gov> wrote: