Hi Marko,
Such a very long shot that I hesitated before posting:
Since it is a so strange number (FdwvZMqyKNV/AAAB), is it possible that it comes from a vhost that you created with Cockpit then deleted it ?
Michel-André
Hi Marko,
Such a very long shot that I hesitated before posting:
Since it is a so strange number (FdwvZMqyKNV/AAAB), is it possible that it comes from a vhost that you created with Cockpit then deleted it ?
Michel-André
Hi Andy, I checked it - no artifacts.
I will investigate the idea from @michelandre
best regards, Marko
I checked all DBs: no hit
I ckecked
/etc/: no hit
/opt/: no hit
/usr/: no hit
/var/:
[root@ns-srv01 /]# grep -rnwi '/var/' -e 'FdwvZMqyKNV/AAAB'
/var/log/maillog:79715:Oct 29 08:40:17 ns-srv01 dovecot: auth: Error: plain(USER01,127.0.0.1,<FdwvZMqyKNV/AAAB>): user not found from any userdbs
/var/log/imap:109394:Oct 29 08:40:17 ns-srv01 dovecot: imap-login: Internal login failure (pid=11844 id=1) (internal failure, 1 successful auths): user=<USER01>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=11845, secured, session=<FdwvZMqyKNV/AAAB>
[root@ns-srv01 /]#
this kind of string changes permanently:
/var/log/imap:131854:Oct 30 00:20:17 ns-srv01 dovecot: imap-login: Internal login failure (pid=2079 id=1) (internal failure, 1 successful auths): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=2080, secured, session=<k7Ljhdey0t5/AAAB>
/var/log/imap:131894:Oct 30 00:22:17 ns-srv01 dovecot: imap-login: Internal login failure (pid=2896 id=1) (internal failure, 1 successful auths): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=2897, secured, session=<ebQKjdeyat9/AAAB>
/var/log/imap:131942:Oct 30 00:24:17 ns-srv01 dovecot: imap-login: Internal login failure (pid=3425 id=1) (internal failure, 1 successful auths): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=3426, secured, session=<vTIylNeyDuB/AAAB>
/var/log/imap:131990:Oct 30 00:26:17 ns-srv01 dovecot: imap-login: Internal login failure (pid=3965 id=1) (internal failure, 1 successful auths): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=3966, secured, session=<BtNYm9eyqOB/AAAB>
/var/log/imap:132030:Oct 30 00:28:17 ns-srv01 dovecot: imap-login: Internal login failure (pid=4456 id=1) (internal failure, 1 successful auths): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=4457, secured, session=<ViiAoteyPOF/AAAB>
/var/log/imap:132087:Oct 30 00:30:17 ns-srv01 dovecot: imap-login: Internal login failure (pid=5000 id=1) (internal failure, 1 successful auths): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=5001, secured, session=<gxmnqdey7uF/AAAB>
/var/log/imap:132124:Oct 30 00:32:17 ns-srv01 dovecot: imap-login: Internal login failure (pid=5547 id=1) (internal failure, 1 successful auths): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=5548, secured, session=<ldzNsNeyhuJ/AAAB>
/var/log/imap:132157:Oct 30 00:34:17 ns-srv01 dovecot: imap-login: Internal login failure (pid=6024 id=1) (internal failure, 1 successful auths): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=6025, secured, session=<UMr1t9eyEuN/AAAB>
So there is still a session with that ID active? Pragmatic solution: find and kill the session… (I am probably oversimplifying things now)
Could it be a SOGo cronjob that is still running? (every 2 minutes)
SOGO I uninstalled, but surprisingly a CRON job is still running
-rw-r–r–. 1 root root 128 Aug 9 2019 0hourly
-rw-r–r-- 1 root root 316 Oct 8 20:27 backup-data
-rw-r–r-- 1 root root 1398 Feb 23 2020 clamav-unofficial-sigs
-rw------- 1 root root 203 Jul 17 18:15 clamav-update
-rw-r–r-- 1 root root 116 Oct 12 17:06 fail2ban-statistics
-rw-r–r-- 1 root root 249 Oct 10 14:20 getmail
-rw-r–r-- 1 root root 438 Oct 18 10:29 nethserver-blacklist
-rw-r–r-- 1 root root 111 Oct 16 15:40 nextcloud
-rw-r–r-- 1 root root 455 May 25 16:35 ntopng
-rw-r–r–. 1 root root 159 May 22 2019 ptrack_purge
-rw-r–r–. 1 root root 108 Nov 27 2019 raid-check
-rw-r–r-- 1 root root 350 Oct 10 19:25 runmysqlbackup
-rw-r–r–. 1 root root 61 Oct 7 10:58 shorewall-update-dst
-rw-r----- 1 root root 1231 Oct 8 22:54 sogo
[root@ns-srv01 cron.d]# cat sogo
# ================= DO NOT MODIFY THIS FILE =================
#
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at NethServer official site: https://www.nethserver.org
#
#
# Sogod cronjobs
# Vacation messages expiration
# The credentials file should contain the sieve admin credentials (username:passwd)
0 0 * * * sogo /usr/sbin/sogo-tool update-autoreply -p /etc/sogo/sieve.creds
# Session cleanup - runs every minute
# - Ajust the nbMinutes parameter to suit your needs
# Example: Sessions without activity since 60 minutes will be dropped:
#* * * * * sogo /usr/sbin/sogo-tool expire-sessions 60
# Email alarms - runs every minutes
# If you need to use SMTP AUTH for outgoing mails, specify credentials to use
# with '-p /path/to/credentialsFile' (same format as the sieve credentials)
* * * * * sogo /usr/sbin/sogo-ealarms-notify > /dev/null 2>&1
# Daily backups
# - writes to ~sogo/backups/ by default
# - will keep 31 days worth of backups by default
# - runs once a day by default, but can run more frequently
# - make sure to set the path to sogo-backup.sh correctly
30 0 * * * sogo /usr/share/doc/sogo-*/sogo-backup.sh
[root@ns-srv01 cron.d]#
I have checked all other crons: no one with */2 * * * *
find and kill the session
I don’t have an unique PID, because they change randomly too.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
5727 netdata 20 0 56224 5988 1808 S 2.0 0.1 1:13.43 apps.plugin
1 root 20 0 199872 4220 2364 S 1.3 0.1 3:25.69 systemd
5410 root 20 0 3108932 38348 22828 S 1.3 0.5 1:08.19 f2b/server
1313 ntopng 20 0 1690256 256780 16708 S 0.7 3.1 117:50.80 ntopng
5588 netdata 20 0 357016 103276 3504 S 0.7 1.3 0:22.49 netdata
8929 root 20 0 563300 6660 3892 S 0.7 0.1 0:12.46 cockpit-bridge
27550 suricata 20 0 911516 383708 4864 S 0.7 4.7 10:58.95 Suricata-Main
761 dbus 20 0 70776 2428 1692 S 0.3 0.0 1:52.75 dbus-daemon
1221 unbound 20 0 149816 21864 3324 S 0.3 0.3 1:04.22 unbound
5723 netdata 20 0 167852 22052 4288 S 0.3 0.3 0:10.40 python
8739 cockpit+ 20 0 530104 7992 4448 S 0.3 0.1 0:07.40 cockpit-ws
27343 root 20 0 75444 4864 3636 S 0.3 0.1 1:36.99 openvpn
28068 root 20 0 162272 2500 1580 R 0.3 0.0 0:00.02 top
2 root 20 0 0 0 0 S 0.0 0.0 0:00.04 kthreadd
4 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kworker/0:0H
6 root 20 0 0 0 0 S 0.0 0.0 0:18.86 ksoftirqd/0
7 root rt 0 0 0 0 S 0.0 0.0 0:01.54 migration/0
8 root 20 0 0 0 0 S 0.0 0.0 0:00.75 rcu_bh
I proceeded yum autoremove
Removed:
nethserver-memcached.noarch 0:1.1.0-1.ns7 php-pear-Mail-Mime.noarch 0:1.10.2-1.el7 php-pear-Net-IDNA2.noarch 0:0.1.1-10.el7 php-pear-Net-SMTP.noarch 0:1.7.3-1.el7
php-pear-Net-Sieve.noarch 0:1.3.4-4.el7 python2-gflags.noarch 0:2.0-5.el7 sogo-activesync.x86_64 0:5.0.0-1.ns7 sogo-ealarms-notify.x86_64 0:5.0.0-1.ns7
sogo-tool.x86_64 0:5.0.0-1.ns7 sope49-gdl1-mysql.x86_64 1:4.9-5.0.0.1.ns7
Dependency Removed:
gnustep-base.x86_64 0:1.24.9-1.el7 gnustep-base-libs.x86_64 0:1.24.9-1.el7 lasso.x86_64 0:2.5.1-5.el7
libobjc.x86_64 0:4.8.5-39.el7 libwbxml.x86_64 0:0.11.2-4.el7.centos memcached.x86_64 0:1.4.15-10.el7_3.1
php-pear.noarch 1:1.9.4-21.el7 php-pear-Auth-SASL.noarch 0:1.0.6-5.el7 php-pear-Net-Socket.noarch 0:1.0.14-1.el7
sogo.x86_64 0:5.0.0-1.ns7 sope49-appserver.x86_64 1:4.9-5.0.0.1.ns7 sope49-cards.x86_64 0:5.0.0-1.2.ge470e57.ns7
sope49-core.x86_64 1:4.9-5.0.0.1.ns7 sope49-gdl1.x86_64 1:4.9-5.0.0.1.ns7 sope49-gdl1-contentstore.x86_64 0:5.0.0-1.2.ge470e57.ns7
sope49-ldap.x86_64 1:4.9-5.0.0.1.ns7 sope49-mime.x86_64 1:4.9-5.0.0.1.ns7 sope49-sbjson.x86_64 1:2.3.1-5.0.0.1.ns7
sope49-xml.x86_64 1:4.9-5.0.0.1.ns7 xmlsec1.x86_64 0:1.2.20-7.el7_4 xmlsec1-openssl.x86_64 0:1.2.20-7.el7_4
Complete!
Hopefully the old artifacts are gone and do not cause me new problems
[root@ns-srv01 cron.d]# ll
-rw-r----- 1 root root 1231 Oct 8 22:54 sogo.rpmsave
the error persists
Did you try to remove sogo.rpmsave?
Yes, but it don’t solve the problem. I did not expect this either, because it is not a 2-minute cron.
Unfortunately there is no 2-minute cron at all to convict the culprit.
My next suspicion would be WebTop, if WebTop would manage known users somewhere.
The user USER01 appears there in the suggested user list.
Unfortunately, https://docs.nethserver.org/en/v7/webtop5.html has no advice to the used Data Base.
But the log gives a 2 minute recurring event. If that isn’t trhough cron, there must be something else doing 2 minute recurring events.
I did it…
After doveadm expunge -d -u user01 mailbox '*' all
comes an error:
Error: Deleting mailbox 'INBOX' failed: INBOX can't be deleted.
…and the error log entry persists.
Sincerley, Marko
Something at the logs while trying to delete the mailbox?
nothing different
Did you also look at messages log?
no, only mail.log.
Here the relevant entries:
Nov 2 14:17:29 ns-srv01 cockpit-ws: New connection to session from 87.xxx.yyy.zzz
Nov 2 14:17:29 ns-srv01 dbus[757]: [system] Activating via systemd: service name='org.freedesktop.timedate1' unit='dbus-org.freedesktop.timedate1.service'
Nov 2 14:17:29 ns-srv01 systemd: Starting Time & Date Service...
Nov 2 14:17:29 ns-srv01 dbus[757]: [system] Successfully activated service 'org.freedesktop.timedate1'
Nov 2 14:17:29 ns-srv01 systemd: Started Time & Date Service.
Nov 2 14:17:29 ns-srv01 dbus[757]: [system] Activating via systemd: service name='org.freedesktop.realmd' unit='realmd.service'
Nov 2 14:17:29 ns-srv01 systemd: Starting Realm and Domain Configuration...
Nov 2 14:17:29 ns-srv01 dbus[757]: [system] Activating via systemd: service name='org.freedesktop.hostname1' unit='dbus-org.freedesktop.hostname1.service'
Nov 2 14:17:29 ns-srv01 systemd: Starting Hostname Service...
Nov 2 14:17:29 ns-srv01 dbus[757]: [system] Successfully activated service 'org.freedesktop.hostname1'
Nov 2 14:17:29 ns-srv01 dbus[757]: [system] Successfully activated service 'org.freedesktop.realmd'
Nov 2 14:17:29 ns-srv01 systemd: Started Hostname Service.
Nov 2 14:17:29 ns-srv01 systemd: Started Realm and Domain Configuration.
Nov 2 14:17:30 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:17:30 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:18:22 ns-srv01 cockpit-ws: New connection to session from 87.xxx.yyy.zzz
Nov 2 14:18:26 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:18:26 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:18:50 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:18:50 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:18:50 ns-srv01 /usr/libexec/nethserver/api/nethserver-mail/pseudonym/create[15616]: /var/lib/nethserver/db/accounts: OLD user01@mydomain.tld=(undefined)
Nov 2 14:18:50 ns-srv01 /usr/libexec/nethserver/api/nethserver-mail/pseudonym/create[15616]: /var/lib/nethserver/db/accounts: NEW user01@mydomain.tld=pseudonym|Access|public|Account|user01@mydomain.tld|de|Description|
Nov 2 14:18:50 ns-srv01 create: Event: pseudonym-create
Nov 2 14:18:51 ns-srv01 create: expanding /etc/postfix/internal_access
Nov 2 14:18:51 ns-srv01 create: expanding /etc/postfix/login_maps
Nov 2 14:18:51 ns-srv01 create: expanding /etc/postfix/virtual
Nov 2 14:18:51 ns-srv01 create: Action: /etc/e-smith/events/actions/generic_template_expand SUCCESS [0.125078]
Nov 2 14:18:51 ns-srv01 create: Action: /etc/e-smith/events/pseudonym-create/S30nethserver-mail-postmap-update SUCCESS [0.084044]
Nov 2 14:18:51 ns-srv01 create: Event: pseudonym-create SUCCESS
Nov 2 14:19:14 ns-srv01 cockpit-ws: WebSocket from 87.xxx.yyy.zzz for session closed
Nov 2 14:19:15 ns-srv01 cockpit-ws: New connection to session from 87.xxx.yyy.zzz
Nov 2 14:20:04 ns-srv01 cockpit-ws: WebSocket from 87.xxx.yyy.zzz for session closed
Nov 2 14:20:04 ns-srv01 cockpit-ws: New connection to session from 87.xxx.yyy.zzz
Nov 2 14:20:05 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:20:05 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:20:14 ns-srv01 /usr/libexec/nethserver/api/nethserver-mail/pseudonym/delete[16405]: /var/lib/nethserver/db/accounts: DELETE user01@mydomain.tld=pseudonym|Access|public|Account|user01@mydomain.tld|Description|
Nov 2 14:20:14 ns-srv01 delete: Event: pseudonym-delete
Nov 2 14:20:14 ns-srv01 delete: expanding /etc/postfix/internal_access
Nov 2 14:20:15 ns-srv01 delete: expanding /etc/postfix/login_maps
Nov 2 14:20:15 ns-srv01 delete: expanding /etc/postfix/virtual
Nov 2 14:20:15 ns-srv01 delete: Action: /etc/e-smith/events/actions/generic_template_expand SUCCESS [0.125892]
Nov 2 14:20:15 ns-srv01 delete: Action: /etc/e-smith/events/pseudonym-delete/S30nethserver-mail-postmap-update SUCCESS [0.069905]
Nov 2 14:20:15 ns-srv01 delete: Event: pseudonym-delete SUCCESS
Nov 2 14:20:17 ns-srv01 cockpit-ws: WebSocket from 87.xxx.yyy.zzz for session closed
Nov 2 14:20:18 ns-srv01 dbus[757]: [system] Activating via systemd: service name='org.freedesktop.hostname1' unit='dbus-org.freedesktop.hostname1.service'
Nov 2 14:20:18 ns-srv01 systemd: Starting Hostname Service...
Nov 2 14:20:18 ns-srv01 dbus[757]: [system] Successfully activated service 'org.freedesktop.hostname1'
Nov 2 14:20:18 ns-srv01 systemd: Started Hostname Service.
Nov 2 14:20:18 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:20:18 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:20:21 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:20:21 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:23:16 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:23:16 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:23:17 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:23:17 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:23:17 ns-srv01 esmith::event[17305]: Event: user-create user01 name surname /usr/libexec/openssh/sftp-server
Nov 2 14:23:17 ns-srv01 esmith::event[17305]: Action: /etc/e-smith/events/user-create/S04nethserver-directory-user-create SUCCESS [0.222542]
Nov 2 14:23:17 ns-srv01 esmith::event[17305]: Action: /etc/e-smith/events/actions/adjust-services SUCCESS [0.043159]
Nov 2 14:23:17 ns-srv01 esmith::event[17305]: [NOTICE] clearing sssd cache for user user01@mydomain.tld
Nov 2 14:23:17 ns-srv01 esmith::event[17305]: No cache object matched the specified search
Nov 2 14:23:17 ns-srv01 esmith::event[17305]: No cache object matched the specified search
Nov 2 14:23:17 ns-srv01 esmith::event[17305]: Action: /etc/e-smith/events/user-create/S90nethserver-sssd-clear-cache SUCCESS [0.022813]
Nov 2 14:23:17 ns-srv01 esmith::event[17305]: Event: user-create SUCCESS
Nov 2 14:23:17 ns-srv01 esmith::event[17316]: Event: group-modify mail <...list of mail addresses...>
Nov 2 14:23:18 ns-srv01 esmith::event[17316]: Action: /etc/e-smith/events/group-modify/S15nethserver-directory-group-modify SUCCESS [0.087238]
Nov 2 14:23:18 ns-srv01 esmith::event[17316]: [NOTICE] clearing sssd cache for group mail@mydomain.tld
Nov 2 14:23:18 ns-srv01 esmith::event[17316]: [NOTICE] group members changed: clear users cache
Nov 2 14:23:18 ns-srv01 esmith::event[17316]: Action: /etc/e-smith/events/group-modify/S90nethserver-sssd-clear-cache SUCCESS [0.22927]
Nov 2 14:23:18 ns-srv01 esmith::event[17316]: Event: group-modify SUCCESS
Nov 2 14:23:18 ns-srv01 esmith::event[17330]: Event: password-policy-update florian no
Nov 2 14:23:18 ns-srv01 esmith::event[17330]: [NOTICE] clearing sssd cache for user user01@mydomain.tld
Nov 2 14:23:18 ns-srv01 esmith::event[17330]: No cache object matched the specified search
Nov 2 14:23:18 ns-srv01 esmith::event[17330]: No cache object matched the specified search
Nov 2 14:23:18 ns-srv01 esmith::event[17330]: Action: /etc/e-smith/events/password-policy-update/S10nethserver-sssd-clear-cache SUCCESS [0.019808]
Nov 2 14:23:18 ns-srv01 esmith::event[17330]: Action: /etc/e-smith/events/password-policy-update/S30nethserver-directory-password-policy SUCCESS [0.143038]
Nov 2 14:23:18 ns-srv01 esmith::event[17330]: Event: password-policy-update SUCCESS
Nov 2 14:23:18 ns-srv01 esmith::event[17338]: Event: password-modify user01@mydomain.tld /tmp/ng-fYpLgZ
Nov 2 14:23:18 ns-srv01 esmith::event[17338]: Action: /etc/e-smith/events/password-modify/S25password-set SUCCESS [0.004504]
Nov 2 14:23:18 ns-srv01 esmith::event[17338]: Password changed.
Nov 2 14:23:18 ns-srv01 esmith::event[17338]: Action: /etc/e-smith/events/password-modify/S30nethserver-directory-password-set SUCCESS [0.102074]
Nov 2 14:23:18 ns-srv01 esmith::event[17338]: Action: /etc/e-smith/events/password-modify/S40nethserver-directory-user-unlock SUCCESS [0.10278]
Nov 2 14:23:18 ns-srv01 esmith::event[17338]: Action: /etc/e-smith/events/password-modify/S90password-cleanup SUCCESS [0.008977]
Nov 2 14:23:18 ns-srv01 esmith::event[17338]: Event: password-modify SUCCESS
Nov 2 14:23:25 ns-srv01 cockpit-ws: New connection to session from 87.xxx.yyy.zzz
Nov 2 14:24:02 ns-srv01 cockpit-ws: WebSocket from 87.xxx.yyy.zzz for session closed
Nov 2 14:24:02 ns-srv01 cockpit-ws: New connection to session from 87.xxx.yyy.zzz
Nov 2 14:24:03 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:24:03 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:24:17 ns-srv01 /usr/libexec/nethserver/api/nethserver-mail/pseudonym/update[17750]: /var/lib/nethserver/db/accounts: OLD user01@mydomain.tld=(undefined)
Nov 2 14:24:17 ns-srv01 /usr/libexec/nethserver/api/nethserver-mail/pseudonym/update[17750]: /var/lib/nethserver/db/accounts: NEW user01@mydomain.tld=user|MailAccess|public|MailForwardAddress||MailForwardKeepMessageCopy|no|MailForwardStatus|disabled|MailQuotaCustom|200|MailQuotaType|default|MailSpamRetentionStatus|disabled|MailSpamRetentionTime|15d|MailStatus|enabled
Nov 2 14:24:17 ns-srv01 /usr/libexec/nethserver/api/nethserver-mail/pseudonym/update[17750]: /var/lib/nethserver/db/accounts: OLD user01@mydomain.tld=user|MailAccess|public|MailForwardAddress||MailForwardKeepMessageCopy|no|MailForwardStatus|disabled|MailQuotaCustom|200|MailQuotaType|default|MailSpamRetentionStatus|disabled|MailSpamRetentionTime|15d|MailStatus|enabled
Nov 2 14:24:17 ns-srv01 /usr/libexec/nethserver/api/nethserver-mail/pseudonym/update[17750]: /var/lib/nethserver/db/accounts: NEW user01@mydomain.tld=user|MailAccess|private|MailForwardAddress||MailForwardKeepMessageCopy|no|MailForwardStatus|disabled|MailQuotaCustom|200|MailQuotaType|default|MailSpamRetentionStatus|disabled|MailSpamRetentionTime|15d|MailStatus|enabled
Nov 2 14:24:17 ns-srv01 update: Event: pseudonym-modify
Nov 2 14:24:17 ns-srv01 update: expanding /etc/postfix/internal_access
Nov 2 14:24:17 ns-srv01 update: expanding /etc/postfix/login_maps
Nov 2 14:24:17 ns-srv01 update: expanding /etc/postfix/virtual
Nov 2 14:24:17 ns-srv01 update: Action: /etc/e-smith/events/actions/generic_template_expand SUCCESS [0.104481]
Nov 2 14:24:17 ns-srv01 update: Action: /etc/e-smith/events/pseudonym-modify/S30nethserver-mail-postmap-update SUCCESS [0.070221]
Nov 2 14:24:17 ns-srv01 update: Event: pseudonym-modify SUCCESS
Nov 2 14:24:22 ns-srv01 cockpit-ws: WebSocket from 87.xxx.yyy.zzz for session closed
Nov 2 14:24:22 ns-srv01 cockpit-ws: New connection to session from 87.xxx.yyy.zzz
Nov 2 14:26:09 ns-srv01 cockpit-ws: WebSocket from 87.xxx.yyy.zzz for session closed
Nov 2 14:26:10 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:26:10 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:26:10 ns-srv01 dbus[757]: [system] Activating via systemd: service name='org.freedesktop.hostname1' unit='dbus-org.freedesktop.hostname1.service'
Nov 2 14:26:10 ns-srv01 systemd: Starting Hostname Service...
Nov 2 14:26:10 ns-srv01 dbus[757]: [system] Successfully activated service 'org.freedesktop.hostname1'
Nov 2 14:26:10 ns-srv01 systemd: Started Hostname Service.
Nov 2 14:26:13 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:26:13 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:26:21 ns-srv01 cockpit-bridge: No entry for terminal type "unknown";
Nov 2 14:26:21 ns-srv01 cockpit-bridge: using dumb terminal settings.
Nov 2 14:26:21 ns-srv01 esmith::event[18460]: Event: group-modify mail <...list of addresses...>
Nov 2 14:26:21 ns-srv01 esmith::event[18460]: Action: /etc/e-smith/events/group-modify/S15nethserver-directory-group-modify SUCCESS [0.102268]
Nov 2 14:26:21 ns-srv01 esmith::event[18460]: [NOTICE] clearing sssd cache for group mail@maidomain.tld
Nov 2 14:26:22 ns-srv01 esmith::event[18460]: [NOTICE] group members changed:
The user in webtop still exists.
Hi @capote,
I can confirm that webtop has its own internal cronjob that every 2 minutes looks for any scheduled emails to be sent on all the IMAP accounts it has on its database.
If you delete a user on the server without first removing the profile on the webtop, what you reported happens:
You have two options to solve:
only subsequently delete the user also from the server
access the database and deactivate the user profile of the xxxxx
that no longer exists:
su - postgres -c 'psql webtop5'
update core.users set enabled='f' where user_id='xxxxx';
\q (to exit)
Let me know if you solve
Hi Luca, thank you for the hint. Unfortunately 2 minutes to late.
In the meantime I had completely deleted Webtop, including the database.
Since the documentation does not describe how to uninstall it, I based myself on this description:
#----removing webtop databases and its user----
su - postgres
dropdb webtop
dropdb webtop5
dropuser sonicle
exit
After reinstalling Webtop, I discovered the user management within Webtop at first sight; not before.
If I really missed it or if the previous installation had not been done correctly… I don’t know.
The former error is eliminated now.
Thank you very much.