FYI: -- Max Trefonides MCS Systems [email protected] Begin forwarded message:
From: Max Trefonides <[email protected]> Subject: Fwd: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:58:02 PM CDT To: Mike Rios <[email protected]>
This is a user who was suspended in our account system yesterday, we reactivated and now the user does not see any old mail in his account.
I gotta go, but this is what our system ran ...
/root/bin/zimbra-deact.sh mcs.anl.gov knight
it looks like this is what was run:
root@newman:/etc/postfix# less /root/bin/zimbra-deact.sh #!/bin/sh
DOMAIN=$1 # domain name USERNAME=$2 # Username
if ssh -q -i /root/.ssh/zimbra-deact-key [email protected] $DOMAIN:$USERNAME then if ! /root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE then echo mailrelay fail exit 1 fi else echo zimbra fail exit 1 fi
UGH! why is that a REMOVE?!?!?
Can you help me restore this account? new mail has been being delivered today, I wanted to tell you as soon as I knew, to try to avoid the problem we had last time. right now I have a little league playoff game to get to ...
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Chris Knight <[email protected]> Subject: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:46:03 PM CDT To: Tina Stanton-Piersanti <[email protected]> Cc: [email protected] Reply-To: [email protected], Chris Knight <[email protected]>
quick update: messages started coming in at 3:48pm (which is, of course, shortly after I created the ticket), but contents from Saturday still gone.
chris
On Jun 18, 2013, at 4:41 PM, Tina Stanton-Piersanti <[email protected]> wrote:
The "/root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE" script is a local operation on newman. It doesn't touch anything on the zimbra server. And the REMOVE argument doesn't actually do anything from what I can tell. Someone needs to look at what script the zimbra-deact-key invokes on the Zimbra server to find out why mail disappeared. ----- Original Message -----
From: "Max Trefonides" <[email protected]> To: "Core Sysadmins" <[email protected]> Sent: Tuesday, June 18, 2013 4:58:31 PM Subject: Fwd: [mcs-systems #167302] Testing your mail
FYI:
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Max Trefonides <[email protected]> Subject: Fwd: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:58:02 PM CDT To: Mike Rios <[email protected]>
This is a user who was suspended in our account system yesterday, we reactivated and now the user does not see any old mail in his account.
I gotta go, but this is what our system ran ...
/root/bin/zimbra-deact.sh mcs.anl.gov knight
it looks like this is what was run:
root@newman:/etc/postfix# less /root/bin/zimbra-deact.sh #!/bin/sh
DOMAIN=$1 # domain name USERNAME=$2 # Username
if ssh -q -i /root/.ssh/zimbra-deact-key [email protected] $DOMAIN:$USERNAME then if ! /root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE then echo mailrelay fail exit 1 fi else echo zimbra fail exit 1 fi
UGH! why is that a REMOVE?!?!?
Can you help me restore this account? new mail has been being delivered today, I wanted to tell you as soon as I knew, to try to avoid the problem we had last time. right now I have a little league playoff game to get to ...
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Chris Knight <[email protected]> Subject: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:46:03 PM CDT To: Tina Stanton-Piersanti <[email protected]> Cc: [email protected] Reply-To: [email protected], Chris Knight <[email protected]>
quick update: messages started coming in at 3:48pm (which is, of course, shortly after I created the ticket), but contents from Saturday still gone.
chris
On Jun 18, 2013, at 4:41 PM, Tina Stanton-Piersanti <[email protected]> wrote:
Indeed. It only removed it from the address maps. -- Craig (from my mobile) Ken Raffenetti <[email protected]> wrote:
The "/root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE" script is a local operation on newman. It doesn't touch anything on the zimbra server. And the REMOVE argument doesn't actually do anything from what I can tell. Someone needs to look at what script the zimbra-deact-key invokes on the Zimbra server to find out why mail disappeared.
----- Original Message -----
From: "Max Trefonides" <[email protected]> To: "Core Sysadmins" <[email protected]> Sent: Tuesday, June 18, 2013 4:58:31 PM Subject: Fwd: [mcs-systems #167302] Testing your mail
FYI:
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Max Trefonides <[email protected]> Subject: Fwd: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:58:02 PM CDT To: Mike Rios <[email protected]>
This is a user who was suspended in our account system yesterday, we reactivated and now the user does not see any old mail in his account.
I gotta go, but this is what our system ran ...
/root/bin/zimbra-deact.sh mcs.anl.gov knight
it looks like this is what was run:
root@newman:/etc/postfix# less /root/bin/zimbra-deact.sh #!/bin/sh
DOMAIN=$1 # domain name USERNAME=$2 # Username
if ssh -q -i /root/.ssh/zimbra-deact-key [email protected] $DOMAIN:$USERNAME then if ! /root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE then echo mailrelay fail exit 1 fi else echo zimbra fail exit 1 fi
UGH! why is that a REMOVE?!?!?
Can you help me restore this account? new mail has been being delivered today, I wanted to tell you as soon as I knew, to try to avoid the problem we had last time. right now I have a little league playoff game to get to ...
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Chris Knight <[email protected]> Subject: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:46:03 PM CDT To: Tina Stanton-Piersanti <[email protected]> Cc: [email protected] Reply-To: [email protected], Chris Knight <[email protected]>
quick update: messages started coming in at 3:48pm (which is, of course, shortly after I created the ticket), but contents from Saturday still gone.
chris
On Jun 18, 2013, at 4:41 PM, Tina Stanton-Piersanti <[email protected]> wrote:
Despite the fact that it was deleted the scripts should not have deleted the mailbox: "•Closed. When a mailbox status is closed, the login is disabled, and messages are bounced. This status is used to soft-delete an account before deleting it from the server." it's still a mystery why the mailbox was emptied, the scripts check out, I'm wondering if it might be related to the mailbox living on zimbra-mb2 ... I'm reaching here ... the script lives in zimbra.anl.gov:/home/mcsadmin/bin ... I'm waiting on rios to work with me on that. I've restored his mailbox and imported the mail tat was sent to the new one into it and renamed the restored mailbox to [email protected] -- Max Trefonides MCS Systems [email protected] On Jun 18, 2013, at 5:28 PM, Craig Stacey <[email protected]> wrote:
Indeed. It only removed it from the address maps. -- Craig (from my mobile)
Ken Raffenetti <[email protected]> wrote:
The "/root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE" script is a local operation on newman. It doesn't touch anything on the zimbra server. And the REMOVE argument doesn't actually do anything from what I can tell. Someone needs to look at what script the zimbra-deact-key invokes on the Zimbra server to find out why mail disappeared.
----- Original Message -----
From: "Max Trefonides" <[email protected]> To: "Core Sysadmins" <[email protected]> Sent: Tuesday, June 18, 2013 4:58:31 PM Subject: Fwd: [mcs-systems #167302] Testing your mail
FYI:
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Max Trefonides <[email protected]> Subject: Fwd: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:58:02 PM CDT To: Mike Rios <[email protected]>
This is a user who was suspended in our account system yesterday, we reactivated and now the user does not see any old mail in his account.
I gotta go, but this is what our system ran ...
/root/bin/zimbra-deact.sh mcs.anl.gov knight
it looks like this is what was run:
root@newman:/etc/postfix# less /root/bin/zimbra-deact.sh #!/bin/sh
DOMAIN=$1 # domain name USERNAME=$2 # Username
if ssh -q -i /root/.ssh/zimbra-deact-key [email protected] $DOMAIN:$USERNAME then if ! /root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE then echo mailrelay fail exit 1 fi else echo zimbra fail exit 1 fi
UGH! why is that a REMOVE?!?!?
Can you help me restore this account? new mail has been being delivered today, I wanted to tell you as soon as I knew, to try to avoid the problem we had last time. right now I have a little league playoff game to get to ...
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Chris Knight <[email protected]> Subject: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:46:03 PM CDT To: Tina Stanton-Piersanti <[email protected]> Cc: [email protected] Reply-To: [email protected], Chris Knight <[email protected]>
quick update: messages started coming in at 3:48pm (which is, of course, shortly after I created the ticket), but contents from Saturday still gone.
chris
On Jun 18, 2013, at 4:41 PM, Tina Stanton-Piersanti <[email protected]> wrote:
So, as best as I can tell, this account was never deleted. Here's what happened on the server when the account was deactivated. You see it get deactivated (set state to closed) then some failed auth attempts.
zimbra% zgrep knight auth.log.6.gz Jun 17 08:39:31 zimbra saslauthd[24706]: auth_zimbra: [email protected] auth OK Jun 17 09:13:07 zimbra sudo: mcsadmin : TTY=unknown ; PWD=/home/mcsadmin ; USER=zimbra ; COMMAND=/opt/zimbra/bin/zmprov getAccount [email protected] Jun 17 09:13:12 zimbra sudo: mcsadmin : TTY=unknown ; PWD=/home/mcsadmin ; USER=zimbra ; COMMAND=/opt/zimbra/bin/zmprov modifyAccount [email protected] zimbraAccountStatus closed Jun 17 15:12:26 zimbra saslauthd[24703]: zmpost: url='https://zimbra-mb1.anl.gov:7071/service/admin/soap/' returned buffer->data='<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><soap:Fault><soap:Code><soap:Value>soap:Sender</soap:Value></soap:Code><soap:Reason><soap:Text>authentication failed for [[email protected]]</soap:Text></soap:Reason><soap:Detail><Error xmlns="urn:zimbra"><Code>account.AUTH_FAILED</Code><Trace>btpool0-124524://zimbra-mb1.anl.gov:7071/service/admin/soap/:1371499946551:a856ad0268f4a69b</Trace></Error></soap:Detail></soap:Fault></soap:Body></soap:Envelope>', hti->error='' Jun 17 15:12:26 zimbra saslauthd[24703]: auth_zimbra: [email protected] auth failed: authentication failed for [[email protected]] Jun 17 15:12:26 zimbra saslauthd[24703]: do_auth : auth failure: [[email protected]] [service=smtp] [realm=mcs.anl.gov] [mech=zimbra] [reason=Unknown] Jun 17 15:12:30 zimbra saslauthd[24706]: zmpost: url='https://zimbra-mb1.anl.gov:7071/service/admin/soap/' returned buffer->data='<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><soap:Fault><soap:Code><soap:Value>soap:Sender</soap:Value></soap:Code><soap:Reason><soap:Text>authentication failed for [[email protected]]</soap:Text></soap:Reason><soap:Detail><Error xmlns="urn:zimbra"><Code>account.AUTH_FAILED</Code><Trace>btpool0-124524://zimbra-mb1.anl.gov:7071/service/admin/soap/:1371499950189:a856ad0268f4a69b</Trace></Error></soap:Detail></soap:Fault></soap:Body></soap:Envelope>', hti->error='' Jun 17 15:12:30 zimbra saslauthd[24706]: auth_zimbra: [email protected] auth failed: authentication failed for [[email protected]] Jun 17 15:12:30 zimbra saslauthd[24706]: do_auth : auth failure: [[email protected]] [service=smtp] [realm=mcs.anl.gov] [mech=zimbra] [reason=Unknown]
I can't find the log for the reactivation because I something went wrong with the log rotation on zimbra. auth.log.6.gz ends at Jun 18 06:31:17 and auth.log.5.gz starts at Jun 19 06:42:52, so the whole day of June 18th is missing (which is when it was reactivated). Scouring other logs of that day doesn't show me much of anything useful, but the create script is pretty straightforward and would not blow away an existing account. The first test will create it if it doesn't exist, and the rest modify the created account to ensure name parameters match expectations. Did the restored account get blown away already? -- Craig On Jun 19, 2013, at 4:31 PM, Max Trefonides <[email protected]> wrote:
Despite the fact that it was deleted the scripts should not have deleted the mailbox:
"•Closed. When a mailbox status is closed, the login is disabled, and messages are bounced. This status is used to soft-delete an account before deleting it from the server."
it's still a mystery why the mailbox was emptied, the scripts check out, I'm wondering if it might be related to the mailbox living on zimbra-mb2 ... I'm reaching here ... the script lives in zimbra.anl.gov:/home/mcsadmin/bin ... I'm waiting on rios to work with me on that.
I've restored his mailbox and imported the mail tat was sent to the new one into it and renamed the restored mailbox to [email protected]
-- Max Trefonides MCS Systems [email protected]
On Jun 18, 2013, at 5:28 PM, Craig Stacey <[email protected]> wrote:
Indeed. It only removed it from the address maps. -- Craig (from my mobile)
Ken Raffenetti <[email protected]> wrote:
The "/root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE" script is a local operation on newman. It doesn't touch anything on the zimbra server. And the REMOVE argument doesn't actually do anything from what I can tell. Someone needs to look at what script the zimbra-deact-key invokes on the Zimbra server to find out why mail disappeared.
----- Original Message -----
From: "Max Trefonides" <[email protected]> To: "Core Sysadmins" <[email protected]> Sent: Tuesday, June 18, 2013 4:58:31 PM Subject: Fwd: [mcs-systems #167302] Testing your mail
FYI:
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Max Trefonides <[email protected]> Subject: Fwd: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:58:02 PM CDT To: Mike Rios <[email protected]>
This is a user who was suspended in our account system yesterday, we reactivated and now the user does not see any old mail in his account.
I gotta go, but this is what our system ran ...
/root/bin/zimbra-deact.sh mcs.anl.gov knight
it looks like this is what was run:
root@newman:/etc/postfix# less /root/bin/zimbra-deact.sh #!/bin/sh
DOMAIN=$1 # domain name USERNAME=$2 # Username
if ssh -q -i /root/.ssh/zimbra-deact-key [email protected] $DOMAIN:$USERNAME then if ! /root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE then echo mailrelay fail exit 1 fi else echo zimbra fail exit 1 fi
UGH! why is that a REMOVE?!?!?
Can you help me restore this account? new mail has been being delivered today, I wanted to tell you as soon as I knew, to try to avoid the problem we had last time. right now I have a little league playoff game to get to ...
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Chris Knight <[email protected]> Subject: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:46:03 PM CDT To: Tina Stanton-Piersanti <[email protected]> Cc: [email protected] Reply-To: [email protected], Chris Knight <[email protected]>
quick update: messages started coming in at 3:48pm (which is, of course, shortly after I created the ticket), but contents from Saturday still gone.
chris
On Jun 18, 2013, at 4:41 PM, Tina Stanton-Piersanti <[email protected]> wrote:
The account that was created by userbase that he logged in to, (the empty mailbox) is gone. The way I fixed this was that I restored his account into a new account, called "knight_restored" put both accounts in maint, exported the mail that had been delivered into the new empty account, imported it into the restored account, renamed the new account "knight_saved", renamed the restored account to "knight", unmainted the "knight" account, made sure stuff was working. I did play around with the restored account for a bit, setting it to closed and active ... but then in an effort to minimize confusion I deleted it. -- Max Trefonides MCS Systems [email protected] On Jun 25, 2013, at 12:06 PM, Craig Stacey <[email protected]> wrote:
So, as best as I can tell, this account was never deleted. Here's what happened on the server when the account was deactivated. You see it get deactivated (set state to closed) then some failed auth attempts.
zimbra% zgrep knight auth.log.6.gz Jun 17 08:39:31 zimbra saslauthd[24706]: auth_zimbra: [email protected] auth OK Jun 17 09:13:07 zimbra sudo: mcsadmin : TTY=unknown ; PWD=/home/mcsadmin ; USER=zimbra ; COMMAND=/opt/zimbra/bin/zmprov getAccount [email protected] Jun 17 09:13:12 zimbra sudo: mcsadmin : TTY=unknown ; PWD=/home/mcsadmin ; USER=zimbra ; COMMAND=/opt/zimbra/bin/zmprov modifyAccount [email protected] zimbraAccountStatus closed Jun 17 15:12:26 zimbra saslauthd[24703]: zmpost: url='https://zimbra-mb1.anl.gov:7071/service/admin/soap/' returned buffer->data='<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><soap:Fault><soap:Code><soap:Value>soap:Sender</soap:Value></soap:Code><soap:Reason><soap:Text>authentication failed for [[email protected]]</soap:Text></soap:Reason><soap:Detail><Error xmlns="urn:zimbra"><Code>account.AUTH_FAILED</Code><Trace>btpool0-124524://zimbra-mb1.anl.gov:7071/service/admin/soap/:1371499946551:a856ad0268f4a69b</Trace></Error></soap:Detail></soap:Fault></soap:Body></soap:Envelope>', hti->error='' Jun 17 15:12:26 zimbra saslauthd[24703]: auth_zimbra: [email protected] auth failed: authentication failed for [[email protected]] Jun 17 15:12:26 zimbra saslauthd[24703]: do_auth : auth failure: [[email protected]] [service=smtp] [realm=mcs.anl.gov] [mech=zimbra] [reason=Unknown] Jun 17 15:12:30 zimbra saslauthd[24706]: zmpost: url='https://zimbra-mb1.anl.gov:7071/service/admin/soap/' returned buffer->data='<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><soap:Fault><soap:Code><soap:Value>soap:Sender</soap:Value></soap:Code><soap:Reason><soap:Text>authentication failed for [[email protected]]</soap:Text></soap:Reason><soap:Detail><Error xmlns="urn:zimbra"><Code>account.AUTH_FAILED</Code><Trace>btpool0-124524://zimbra-mb1.anl.gov:7071/service/admin/soap/:1371499950189:a856ad0268f4a69b</Trace></Error></soap:Detail></soap:Fault></soap:Body></soap:Envelope>', hti->error='' Jun 17 15:12:30 zimbra saslauthd[24706]: auth_zimbra: [email protected] auth failed: authentication failed for [[email protected]] Jun 17 15:12:30 zimbra saslauthd[24706]: do_auth : auth failure: [[email protected]] [service=smtp] [realm=mcs.anl.gov] [mech=zimbra] [reason=Unknown]
I can't find the log for the reactivation because I something went wrong with the log rotation on zimbra. auth.log.6.gz ends at Jun 18 06:31:17 and auth.log.5.gz starts at Jun 19 06:42:52, so the whole day of June 18th is missing (which is when it was reactivated).
Scouring other logs of that day doesn't show me much of anything useful, but the create script is pretty straightforward and would not blow away an existing account. The first test will create it if it doesn't exist, and the rest modify the created account to ensure name parameters match expectations.
Did the restored account get blown away already? -- Craig
On Jun 19, 2013, at 4:31 PM, Max Trefonides <[email protected]> wrote:
Despite the fact that it was deleted the scripts should not have deleted the mailbox:
"•Closed. When a mailbox status is closed, the login is disabled, and messages are bounced. This status is used to soft-delete an account before deleting it from the server."
it's still a mystery why the mailbox was emptied, the scripts check out, I'm wondering if it might be related to the mailbox living on zimbra-mb2 ... I'm reaching here ... the script lives in zimbra.anl.gov:/home/mcsadmin/bin ... I'm waiting on rios to work with me on that.
I've restored his mailbox and imported the mail tat was sent to the new one into it and renamed the restored mailbox to [email protected]
-- Max Trefonides MCS Systems [email protected]
On Jun 18, 2013, at 5:28 PM, Craig Stacey <[email protected]> wrote:
Indeed. It only removed it from the address maps. -- Craig (from my mobile)
Ken Raffenetti <[email protected]> wrote:
The "/root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE" script is a local operation on newman. It doesn't touch anything on the zimbra server. And the REMOVE argument doesn't actually do anything from what I can tell. Someone needs to look at what script the zimbra-deact-key invokes on the Zimbra server to find out why mail disappeared.
----- Original Message -----
From: "Max Trefonides" <[email protected]> To: "Core Sysadmins" <[email protected]> Sent: Tuesday, June 18, 2013 4:58:31 PM Subject: Fwd: [mcs-systems #167302] Testing your mail
FYI:
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Max Trefonides <[email protected]> Subject: Fwd: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:58:02 PM CDT To: Mike Rios <[email protected]>
This is a user who was suspended in our account system yesterday, we reactivated and now the user does not see any old mail in his account.
I gotta go, but this is what our system ran ...
/root/bin/zimbra-deact.sh mcs.anl.gov knight
it looks like this is what was run:
root@newman:/etc/postfix# less /root/bin/zimbra-deact.sh #!/bin/sh
DOMAIN=$1 # domain name USERNAME=$2 # Username
if ssh -q -i /root/.ssh/zimbra-deact-key [email protected] $DOMAIN:$USERNAME then if ! /root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE then echo mailrelay fail exit 1 fi else echo zimbra fail exit 1 fi
UGH! why is that a REMOVE?!?!?
Can you help me restore this account? new mail has been being delivered today, I wanted to tell you as soon as I knew, to try to avoid the problem we had last time. right now I have a little league playoff game to get to ...
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Chris Knight <[email protected]> Subject: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:46:03 PM CDT To: Tina Stanton-Piersanti <[email protected]> Cc: [email protected] Reply-To: [email protected], Chris Knight <[email protected]>
quick update: messages started coming in at 3:48pm (which is, of course, shortly after I created the ticket), but contents from Saturday still gone.
chris
On Jun 18, 2013, at 4:41 PM, Tina Stanton-Piersanti <[email protected]> wrote:
Based on the evidence, I can only blame some action on the user or his mail client at this point. I can see no way this would have happened from the scripts. -- Craig (from my mobile) Max Trefonides <[email protected]> wrote:
The account that was created by userbase that he logged in to, (the empty mailbox) is gone. The way I fixed this was that I restored his account into a new account, called "knight_restored" put both accounts in maint, exported the mail that had been delivered into the new empty account, imported it into the restored account, renamed the new account "knight_saved", renamed the restored account to "knight", unmainted the "knight" account, made sure stuff was working. I did play around with the restored account for a bit, setting it to closed and active ... but then in an effort to minimize confusion I deleted it.
-- Max Trefonides MCS Systems [email protected]
On Jun 25, 2013, at 12:06 PM, Craig Stacey <[email protected]> wrote:
So, as best as I can tell, this account was never deleted. Here's what happened on the server when the account was deactivated. You see it get deactivated (set state to closed) then some failed auth attempts.
zimbra% zgrep knight auth.log.6.gz Jun 17 08:39:31 zimbra saslauthd[24706]: auth_zimbra: [email protected] auth OK Jun 17 09:13:07 zimbra sudo: mcsadmin : TTY=unknown ; PWD=/home/mcsadmin ; USER=zimbra ; COMMAND=/opt/zimbra/bin/zmprov getAccount [email protected] Jun 17 09:13:12 zimbra sudo: mcsadmin : TTY=unknown ; PWD=/home/mcsadmin ; USER=zimbra ; COMMAND=/opt/zimbra/bin/zmprov modifyAccount [email protected] zimbraAccountStatus closed Jun 17 15:12:26 zimbra saslauthd[24703]: zmpost: url='https://zimbra-mb1.anl.gov:7071/service/admin/soap/' returned buffer->data='<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><soap:Fault><soap:Code><soap:Value>soap:Sender</soap:Value></soap:Code><soap:Reason><soap:Text>authentication failed for [[email protected]]</soap:Text></soap:Reason><soap:Detail><Error xmlns="urn:zimbra"><Code>account.AUTH_FAILED</Code><Trace>btpool0-124524://zimbra-mb1.anl.gov:7071/service/admin/soap/:1371499946551:a856ad0268f4a69b</Trace></Error></soap:Detail></soap:Fault></soap:Body></soap:Envelope>', hti->error='' Jun 17 15:12:26 zimbra saslauthd[24703]: auth_zimbra: [email protected] auth failed: authentication failed for [[email protected]] Jun 17 15:12:26 zimbra saslauthd[24703]: do_auth : auth failure: [[email protected]] [service=smtp] [realm=mcs.anl.gov] [mech=zimbra] [reason=Unknown] Jun 17 15:12:30 zimbra saslauthd[24706]: zmpost: url='https://zimbra-mb1.anl.gov:7071/service/admin/soap/' returned buffer->data='<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><soap:Fault><soap:Code><soap:Value>soap:Sender</soap:Value></soap:Code><soap:Reason><soap:Text>authentication failed for [[email protected]]</soap:Text></soap:Reason><soap:Detail><Error xmlns="urn:zimbra"><Code>account.AUTH_FAILED</Code><Trace>btpool0-124524://zimbra-mb1.anl.gov:7071/service/admin/soap/:1371499950189:a856ad0268f4a69b</Trace></Error></soap:Detail></soap:Fault></soap:Body></soap:Envelope>', hti->error='' Jun 17 15:12:30 zimbra saslauthd[24706]: auth_zimbra: [email protected] auth failed: authentication failed for [[email protected]] Jun 17 15:12:30 zimbra saslauthd[24706]: do_auth : auth failure: [[email protected]] [service=smtp] [realm=mcs.anl.gov] [mech=zimbra] [reason=Unknown]
I can't find the log for the reactivation because I something went wrong with the log rotation on zimbra. auth.log.6.gz ends at Jun 18 06:31:17 and auth.log.5.gz starts at Jun 19 06:42:52, so the whole day of June 18th is missing (which is when it was reactivated).
Scouring other logs of that day doesn't show me much of anything useful, but the create script is pretty straightforward and would not blow away an existing account. The first test will create it if it doesn't exist, and the rest modify the created account to ensure name parameters match expectations.
Did the restored account get blown away already? -- Craig
On Jun 19, 2013, at 4:31 PM, Max Trefonides <[email protected]> wrote:
Despite the fact that it was deleted the scripts should not have deleted the mailbox:
"•Closed. When a mailbox status is closed, the login is disabled, and messages are bounced. This status is used to soft-delete an account before deleting it from the server."
it's still a mystery why the mailbox was emptied, the scripts check out, I'm wondering if it might be related to the mailbox living on zimbra-mb2 ... I'm reaching here ... the script lives in zimbra.anl.gov:/home/mcsadmin/bin ... I'm waiting on rios to work with me on that.
I've restored his mailbox and imported the mail tat was sent to the new one into it and renamed the restored mailbox to [email protected]
-- Max Trefonides MCS Systems [email protected]
On Jun 18, 2013, at 5:28 PM, Craig Stacey <[email protected]> wrote:
Indeed. It only removed it from the address maps. -- Craig (from my mobile)
Ken Raffenetti <[email protected]> wrote:
The "/root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE" script is a local operation on newman. It doesn't touch anything on the zimbra server. And the REMOVE argument doesn't actually do anything from what I can tell. Someone needs to look at what script the zimbra-deact-key invokes on the Zimbra server to find out why mail disappeared.
----- Original Message -----
From: "Max Trefonides" <[email protected]> To: "Core Sysadmins" <[email protected]> Sent: Tuesday, June 18, 2013 4:58:31 PM Subject: Fwd: [mcs-systems #167302] Testing your mail
FYI:
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Max Trefonides <[email protected]> Subject: Fwd: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:58:02 PM CDT To: Mike Rios <[email protected]>
This is a user who was suspended in our account system yesterday, we reactivated and now the user does not see any old mail in his account.
I gotta go, but this is what our system ran ...
/root/bin/zimbra-deact.sh mcs.anl.gov knight
it looks like this is what was run:
root@newman:/etc/postfix# less /root/bin/zimbra-deact.sh #!/bin/sh
DOMAIN=$1 # domain name USERNAME=$2 # Username
if ssh -q -i /root/.ssh/zimbra-deact-key [email protected] $DOMAIN:$USERNAME then if ! /root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE then echo mailrelay fail exit 1 fi else echo zimbra fail exit 1 fi
UGH! why is that a REMOVE?!?!?
Can you help me restore this account? new mail has been being delivered today, I wanted to tell you as soon as I knew, to try to avoid the problem we had last time. right now I have a little league playoff game to get to ...
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Chris Knight <[email protected]> Subject: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:46:03 PM CDT To: Tina Stanton-Piersanti <[email protected]> Cc: [email protected] Reply-To: [email protected], Chris Knight <[email protected]>
quick update: messages started coming in at 3:48pm (which is, of course, shortly after I created the ticket), but contents from Saturday still gone.
chris
On Jun 18, 2013, at 4:41 PM, Tina Stanton-Piersanti <[email protected]> wrote:
So the script userbase runs on suspend, and the output in this case, is below: root/bin/zimbra-deact.sh mcs.anl.gov knight Queue Status: complete Exit Code: 0 /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov modifyAccount [email protected] zimbraAccountStatus closed * Reloading Postfix configuration... ...done. Errors: As far as I can tell, this should be good.. Here is the script that ran when he re-requested the MCS mail resource: /root/bin/zimbra-create.sh mcs.anl.gov knight "Christopher" "Knight" "Christopher Knight" [email protected] Queue Status: complete Exit Code: 0 /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov createAccount [email protected] 'NFTwaofky61zloKz' 575c381a-1dac-4ff0-835a-284a23685a8f /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov modifyAccount [email protected] givenName "Christopher" /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov modifyAccount [email protected] sn "Knight" /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov modifyAccount [email protected] cn 'knight' /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov modifyAccount [email protected] displayName "Christopher Knight" /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov modifyAccount [email protected] ZimbraPrefOutOfOfficeDirectAddress '[email protected]' ZimbraPrefOutOfOfficeDirectAddress [email protected] /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov modifyAccount [email protected] zimbraNotes 'Created/Modified Tue Jun 18 15:13:03 2013' /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov modifyAccount [email protected] zimbraPasswordMustChange FALSE /usr/bin/sudo -u zimbra /opt/zimbra/bin/zmprov modifyAccount [email protected] zimbraAccountStatus active * Reloading Postfix configuration... ...done. Errors: On Jun 18, 2013, at 4:58 PM, Max Trefonides <[email protected]> wrote:
FYI:
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Max Trefonides <[email protected]> Subject: Fwd: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:58:02 PM CDT To: Mike Rios <[email protected]>
This is a user who was suspended in our account system yesterday, we reactivated and now the user does not see any old mail in his account.
I gotta go, but this is what our system ran ...
/root/bin/zimbra-deact.sh mcs.anl.gov knight
it looks like this is what was run:
root@newman:/etc/postfix# less /root/bin/zimbra-deact.sh #!/bin/sh
DOMAIN=$1 # domain name USERNAME=$2 # Username
if ssh -q -i /root/.ssh/zimbra-deact-key [email protected] $DOMAIN:$USERNAME then if ! /root/bin/update-zimbra-user.sh $DOMAIN $USERNAME REMOVE then echo mailrelay fail exit 1 fi else echo zimbra fail exit 1 fi
UGH! why is that a REMOVE?!?!?
Can you help me restore this account? new mail has been being delivered today, I wanted to tell you as soon as I knew, to try to avoid the problem we had last time. right now I have a little league playoff game to get to ...
-- Max Trefonides MCS Systems [email protected]
Begin forwarded message:
From: Chris Knight <[email protected]> Subject: [mcs-systems #167302] Re: Testing your mail Date: June 18, 2013 4:46:03 PM CDT To: Tina Stanton-Piersanti <[email protected]> Cc: [email protected] Reply-To: [email protected], Chris Knight <[email protected]>
quick update: messages started coming in at 3:48pm (which is, of course, shortly after I created the ticket), but contents from Saturday still gone.
chris
On Jun 18, 2013, at 4:41 PM, Tina Stanton-Piersanti <[email protected]> wrote:
participants (4)
-
Chris Walker -
Craig Stacey -
Ken Raffenetti -
Max Trefonides