Deletion of mail from Junk mailbox

[Doug Hardie]

> On 2 July 2016, at 02:29, Noel Butler <noel.butler at ausics.net> wrote:
> 
> On 02/07/2016 19:16, Doug Hardie wrote:
>> I have a pigeon sive running which directs some of my received mail to
>> the Junk folder.  That works just fine.  However, a couple minutes
>> later, it is moved to Deleted mailbox and deleted from Junk.  At first
>> I thought my client was doing that so I shut down the client and it
>> still happens.  Here are the log entries:
>> Jul  2 00:36:31 mail dovecot: imap(doug): copy from INBOX: box=Junk,
>> uid=10842, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340,
>> from="jnilj" <hr at bjwmt.com>
>> Jul  2 00:36:31 mail dovecot: imap(doug): delete: box=INBOX,
>> uid=55719, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340,
>> from="jnilj" <hr at bjwmt.com>
>> Jul  2 00:39:33 mail dovecot: imap(doug): copy from Junk: box=Deleted
>> Messages, uid=31049, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>,
>> size=3340, from="jnilj" <hr at bjwmt.com>
>> Jul  2 00:39:33 mail dovecot: imap(doug): delete: box=Junk, uid=10842,
>> msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340, from="jnilj"
>> <hr at bjwmt.com>
>> Jul  2 00:50:29 mail dovecot: imap(doug): expunge: box=Junk,
>> uid=10842, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340,
>> from="jnilj" <hr at bjwmt.com>
>> Jul  2 00:50:29 mail dovecot: imap(doug): expunge: box=INBOX,
>> uid=55719, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340,
>> from="jnilj" <hr at bjwmt.com>
>> Is this the intended way the Junk maibox is supposed to work?  I
>> couldn't find any settings that appear to control (or affect) this
>> behavior.
>> — Doug
> 
> and your dovecot version is?
> 
> I suggest you'll also need to show doveconf -n and example of sieve rules, because it doesnt seem right, certainly does not do that here.
> 


After some more experimentation, it seemed like the messages above were created by a MUA and not the LDA.  However, I was not able to identify the MUA that caused that.  I modified logging to include the remote IP address, restarted dovecot with all the MUAs disabled. Now the problem has not reoccurred.  I have been restarting the MUSs one at a time, however I still don't know who did it.  I have only had a couple junk emails in the last few days so its not much of a test yet.  I guess the volume will return to normal tomorrow.

mail# doveconf -n
# 2.2.24 (a82c823): /usr/local/etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.14 (099a97c)
# OS: FreeBSD 9.3-RELEASE-p43 amd64  ufs
auth_mechanisms = plain login
base_dir = /var/run/home_mail/
first_valid_gid = 0
lda_mailbox_autocreate = yes
login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k session=<%{session}> port=%a
mail_gid = 2222
mail_location = maildir:/var/mail/home_mail/%n
mail_log_prefix = "%s(%u)[%r]<%{session}>: "
mail_uid = 2222
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    autoexpunge = 5 days
    special_use = \Drafts
  }
  mailbox Junk {
    autoexpunge = 2 days
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    autoexpunge = 2 days
    special_use = \Trash
  }
  prefix = 
}
passdb {
  args = scheme=CRYPT username_format=%n /usr/local/etc/dovecot/users
  driver = passwd-file
}
plugin {
  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
  mail_log_fields = uid box msgid size from
  sieve = file:/var/mail/home_mail/%n/sieve;active=/var/mail/home_mail/%n/.dovecot.sieve
}
postmaster_address = doug at sermon-archive.info
protocols = imap
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
  unix_listener auth-userdb {
    group = vmail
    mode = 0666
    user = vmail
  }
}
service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
  inet_listener imaps2 {
    port = 998
    ssl = yes
  }
}
ssl_cert = </etc/ssl/certs/mail.pem
ssl_key = </etc/ssl/private/mail.key
syslog_facility = local0
userdb {
  args = home=/var/mail/home_mail/%d/%n allow_all_users=yes
  driver = static
}
verbose_proctitle = yes
protocol lda {
  mail_plugins = " sieve"
}
protocol imap {
  mail_plugins = " mail_log notify"
}
protocol pop3 {
  mail_plugins = " mail_log notify"
}
mail#