Deletion of mail from Junk mailbox

[Doug Hardie]

> On 4 July 2016, at 13:18, Doug Hardie <doug at sermon-archive.info> wrote:
> 
>> 
>> On 2 July 2016, at 02:29, Noel Butler <noel.butler at ausics.net> wrote:
>> 
>> On 02/07/2016 19:16, Doug Hardie wrote:
>>> I have a pigeon sive running which directs some of my received mail to
>>> the Junk folder.  That works just fine.  However, a couple minutes
>>> later, it is moved to Deleted mailbox and deleted from Junk.  At first
>>> I thought my client was doing that so I shut down the client and it
>>> still happens.  Here are the log entries:
>>> Jul  2 00:36:31 mail dovecot: imap(doug): copy from INBOX: box=Junk,
>>> uid=10842, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340,
>>> from="jnilj" <hr at bjwmt.com>
>>> Jul  2 00:36:31 mail dovecot: imap(doug): delete: box=INBOX,
>>> uid=55719, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340,
>>> from="jnilj" <hr at bjwmt.com>
>>> Jul  2 00:39:33 mail dovecot: imap(doug): copy from Junk: box=Deleted
>>> Messages, uid=31049, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>,
>>> size=3340, from="jnilj" <hr at bjwmt.com>
>>> Jul  2 00:39:33 mail dovecot: imap(doug): delete: box=Junk, uid=10842,
>>> msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340, from="jnilj"
>>> <hr at bjwmt.com>
>>> Jul  2 00:50:29 mail dovecot: imap(doug): expunge: box=Junk,
>>> uid=10842, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340,
>>> from="jnilj" <hr at bjwmt.com>
>>> Jul  2 00:50:29 mail dovecot: imap(doug): expunge: box=INBOX,
>>> uid=55719, msgid=<F3C67E609C1A1BC4DB924CEA5FE12C76 at ze>, size=3340,
>>> from="jnilj" <hr at bjwmt.com>
>>> Is this the intended way the Junk maibox is supposed to work?  I
>>> couldn't find any settings that appear to control (or affect) this
>>> behavior.
>>> — Doug
>> 
>> and your dovecot version is?
>> 
>> I suggest you'll also need to show doveconf -n and example of sieve rules, because it doesnt seem right, certainly does not do that here.
>> 
> 
> 
> After some more experimentation, it seemed like the messages above were created by a MUA and not the LDA.  However, I was not able to identify the MUA that caused that.  I modified logging to include the remote IP address, restarted dovecot with all the MUAs disabled. Now the problem has not reoccurred.  I have been restarting the MUSs one at a time, however I still don't know who did it.  I have only had a couple junk emails in the last few days so its not much of a test yet.  I guess the volume will return to normal tomorrow.
> 
> mail# doveconf -n
> # 2.2.24 (a82c823): /usr/local/etc/dovecot/dovecot.conf
> # Pigeonhole version 0.4.14 (099a97c)
> # OS: FreeBSD 9.3-RELEASE-p43 amd64  ufs
> auth_mechanisms = plain login
> base_dir = /var/run/home_mail/
> first_valid_gid = 0
> lda_mailbox_autocreate = yes
> login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k session=<%{session}> port=%a
> mail_gid = 2222
> mail_location = maildir:/var/mail/home_mail/%n
> mail_log_prefix = "%s(%u)[%r]<%{session}>: "
> mail_uid = 2222
> managesieve_notify_capability = mailto
> managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
> namespace inbox {
>  inbox = yes
>  location = 
>  mailbox Drafts {
>    autoexpunge = 5 days
>    special_use = \Drafts
>  }
>  mailbox Junk {
>    autoexpunge = 2 days
>    special_use = \Junk
>  }
>  mailbox Sent {
>    special_use = \Sent
>  }
>  mailbox "Sent Messages" {
>    special_use = \Sent
>  }
>  mailbox Trash {
>    autoexpunge = 2 days
>    special_use = \Trash
>  }
>  prefix = 
> }
> passdb {
>  args = scheme=CRYPT username_format=%n /usr/local/etc/dovecot/users
>  driver = passwd-file
> }
> plugin {
>  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
>  mail_log_fields = uid box msgid size from
>  sieve = file:/var/mail/home_mail/%n/sieve;active=/var/mail/home_mail/%n/.dovecot.sieve
> }
> postmaster_address = doug at sermon-archive.info
> protocols = imap
> service auth {
>  unix_listener /var/spool/postfix/private/auth {
>    group = postfix
>    mode = 0660
>    user = postfix
>  }
>  unix_listener auth-userdb {
>    group = vmail
>    mode = 0666
>    user = vmail
>  }
> }
> service imap-login {
>  inet_listener imap {
>    port = 143
>  }
>  inet_listener imaps {
>    port = 993
>    ssl = yes
>  }
>  inet_listener imaps2 {
>    port = 998
>    ssl = yes
>  }
> }
> ssl_cert = </etc/ssl/certs/mail.pem
> ssl_key = </etc/ssl/private/mail.key
> syslog_facility = local0
> userdb {
>  args = home=/var/mail/home_mail/%d/%n allow_all_users=yes
>  driver = static
> }
> verbose_proctitle = yes
> protocol lda {
>  mail_plugins = " sieve"
> }
> protocol imap {
>  mail_plugins = " mail_log notify"
> }
> protocol pop3 {
>  mail_plugins = " mail_log notify"
> }
> mail# 


Well, its been running a few days now and I still am able to reproduce the problem.  There has been quite a bit of mail moved by sieve to Junk, but none was deleted.  It appears that changing the logging fixed the problem.  I have a lot of trouble believing that though.  I still suspect one of the MUAs, but have no idea which one it might have been.

— Doug