# postmap hash:/etc/postfix/aliases

# mail vscan

2013-09-20T08:15:20.476639-04:00 linux01 postfix/pickup[15985]: 7448E340099: uid=0 from=<root>
2013-09-20T08:15:20.487761-04:00 linux01 postfix/cleanup[16074]: 7448E340099: message-id=<20130920121520.7448E340099@linux01.mydomain.com>
2013-09-20T08:15:20.535023-04:00 linux01 postfix/qmgr[17471]: 7448E340099: from=<root@linux01.mydomain.com>, size=503, nrcpt=1 (queue active)
2013-09-20T08:15:21.229115-04:00 linux01 postfix/smtpd[16090]: connect from unknown[127.0.0.1]
2013-09-20T08:15:21.235796-04:00 linux01 postfix/smtpd[16090]: 39857340092: client=unknown[127.0.0.1]
2013-09-20T08:15:21.236440-04:00 linux01 postfix/cleanup[16074]: 39857340092: message-id=<20130920121520.7448E340099@linux01.mydomain.com>
2013-09-20T08:15:21.292629-04:00 linux01 postfix/smtpd[16090]: disconnect from unknown[127.0.0.1]
2013-09-20T08:15:21.293170-04:00 linux01 postfix/qmgr[17471]: 39857340092: from=<root@linux01.mydomain.com>, size=1023, nrcpt=1 (queue active)
2013-09-20T08:15:21.298768-04:00 linux01 amavis[26862]: (26862-15) Passed CLEAN {RelayedInternal}, MYUSERS <root@linux01.mydomain.com> -> <vscan@linux01.mydomain.com>, Message-ID: <20130920121520.7448E340099@linux01.mydomain.com>, mail_id: olijKv0iuEiW, Hits: 1.178, size: 503, queued_as: 39857340092, 758 ms
2013-09-20T08:15:21.363522-04:00 linux01 postfix/smtp[16087]: 7448E340099: to=<vscan@linux01.mydomain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.92, delays=0.1/0/0/0.82, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 39857340092)
2013-09-20T08:15:21.363901-04:00 linux01 postfix/qmgr[17471]: 7448E340099: removed
2013-09-20T08:15:21.419587-04:00 linux01 postfix/local[16093]: 39857340092: to=<vscan@linux01.mydomain.com>, relay=local, delay=0.19, delays=0.06/0.01/0/0.12, dsn=4.3.0, status=deferred (temporary failure)

Sep 23 13:24:26 lda(vscan): Fatal: setgid(303(vmail) from mail_gid setting) failed with euid=65(vscan), gid=479(vscan), egid=479(vscan): Operation not permitted (This binary should probably be called with process group set to 303(vmail) instead of 479(vscan))

#id vscan

$daemon_user  = 'vscan';     # (no default;  customary: vscan or amavis), -u
$daemon_group = 'vscan';     # (no default;  customary: vscan or amavis), -g

# 2.1.13: /etc/dovecot/dovecot.conf
# OS: Linux 3.7.10-1.16-desktop x86_64 openSUSE 12.3 (x86_64)
auth_master_user_separator = *
auth_mechanisms = PLAIN LOGIN
dict {
  acl = mysql:/etc/dovecot/dovecot-share-folder.conf
  quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf
}
first_valid_uid = 303
last_valid_uid = 303
listen = *
log_path = /var/log/dovecot.log
mail_debug = yes
mail_gid = 303
mail_location = maildir:/%h/Maildir/:INDEX=/%h/Maildir/
mail_plugins = quota
mail_uid = 303
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
namespace {
  inbox = yes
  location =
  prefix =
  separator = /
  type = private
}
namespace {
  list = children
  location = maildir:/%%h/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u
  prefix = Shared/%%u/
  separator = /
  subscriptions = yes
  type = shared
}
passdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
}
passdb {
  args = /etc/dovecot/dovecot-master-users-password
  driver = passwd-file
  master = yes
}
plugin {
  acl = vfile
  acl_shared_dict = proxy::acl
  auth_socket_path = /var/run/dovecot/auth-master
  autocreate = INBOX
  autocreate2 = Sent
  autocreate3 = Trash
  autocreate4 = Drafts
  autocreate5 = Junk
  autosubscribe = INBOX
  autosubscribe2 = Sent
  autosubscribe3 = Trash
  autosubscribe4 = Drafts
  autosubscribe5 = Junk
  quota = dict:user::proxy::quotadict
  quota_rule = *:storage=1G
  quota_warning = storage=85%% quota-warning 85 %u
  quota_warning2 = storage=90%% quota-warning 90 %u
  quota_warning3 = storage=95%% quota-warning 95 %u
  sieve = /%h/sieve/dovecot.sieve
  sieve_global_dir = /data/vmail/sieve
  sieve_global_path = /data/vmail/sieve/dovecot.sieve
}
protocols = pop3 imap sieve
service auth {
  unix_listener /var/spool/postfix/dovecot-auth {
    group = postfix
    mode = 0666
    user = postfix
  }
  unix_listener auth-master {
    group = vmail
    mode = 0666
    user = vmail
  }
  unix_listener auth-userdb {
    group = vmail
    mode = 0660
    user = vmail
  }
}
service dict {
  unix_listener dict {
    group = vmail
    mode = 0660
    user = vmail
  }
}
service imap-login {
  process_limit = 500
  service_count = 1
}
service pop3-login {
  service_count = 1
}
service quota-warning {
  executable = script /usr/local/bin/dovecot-quota-warning.sh
  unix_listener quota-warning {
    group = vmail
    mode = 0660
    user = vmail
  }
}
ssl = required
ssl_cert = </etc/ssl/certs/iRedMail_CA.pem
ssl_key = </etc/ssl/private/iRedMail.key
userdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
}
protocol lda {
  auth_socket_path = /var/run/dovecot/auth-master
  lda_mailbox_autocreate = yes
  log_path = /var/log/sieve.log
  mail_plugins = quota sieve autocreate
  postmaster_address = root
}
protocol imap {
  imap_client_workarounds = tb-extra-mailbox-sep
  mail_plugins = quota imap_quota autocreate
}
protocol pop3 {
  mail_plugins = quota
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
  pop3_uidl_format = %08Xu%08Xv
}

# Use dovecot deliver program as LDA.
dovecot unix    -       n       n       -       -      pipe
    flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${domain} -m ${extension}

# Basic system aliases -- these MUST be present
MAILER-DAEMON:  postmaster
postmaster:     root

# General redirections for pseudo accounts
bin:            root
daemon:         root
named:          root
#nobody:                root
uucp:           root
www:            root
ftp-bugs:       root
postfix:        root

# Put your local aliases here.

# Well-known aliases
manager:        root
dumper:         root
operator:       root
abuse:          postmaster

# trap decode to catch security attacks
decode:         root

wwwrun: root
nobody: root
vmail: root
root: me@mydomain.com
cluebringer: root
clamav: root

root:   me@mydomain.com

# Basic system aliases that MUST be present.
postmaster:     root
mailer-daemon:  postmaster
# amavis
virusalert:     root
# General redirections for pseudo accounts in /etc/passwd.
administrator:  root
daemon: root
lp:     root
news:   root
uucp:   root
games:  root
man:    root
at:     root
postgres:       root
mdom:   root
amanda: root
ftp:    root
wwwrun: root
squid:  root
msql:   root
gnats:  root
nobody: root
vscan: root
# "bin" used to be in /etc/passwd
bin:    root
# Further well-known aliases for dns/news/ftp/mail/fax/web/gnats.
newsadm:        news
newsadmin:      news
usenet: news
ftpadm: ftp
ftpadmin:       ftp
ftp-adm:        ftp
ftp-admin:      ftp
hostmaster:     root
mail:   postmaster
postman:        postmaster
post_office:    postmaster
# "abuse" is often used to fight against spam email
abuse:  postmaster
spam:   postmaster
faxadm: root
faxmaster:      root
webmaster:      root
gnats-admin:    root
mailman:        root
mailman-owner:  mailman
nagiosadmin:    root

# postalias /etc/postfix/aliases

Cron <vscan@linux01> find /var/spool/amavis/virusmails/ -ctime +15 | xargs rm -rf {}

find: `/var/spool/amavis/virusmails/': No such file or directory