Tag: grep

I had a problem on Ubuntu server. Some guy has added his e-mail somewhere and the server tried to send him e-mails. So Google responded, that it was spam and blocked them. I have searched using grep in logs this way:

/var/log # grep -n "guys_name@gmail.com" *

And got this kind of entries in mail.log and others:

syslog.1:6538:Aug 21 03:39:54 lovecakes postfix/smtp[24625]: A49A315A951: to=, relay=gmail-smtp-in.l.google.com[64.233.165.27]:25, delay=2.9, delays=1.2/0/0.46/1.2, dsn=2.0.0, status=sent (250 2.0.0 OK 1408585194 wr8si36296852lbc.79 - gsmtp)
syslog.1:6864:Aug 21 04:32:18 lovecakes postfix/smtp[24949]: A04A215A951: to=, relay=gmail-smtp-in.l.google.com[2a00:1450:4010:c08::1a]:25, delay=12, delays=10/0.01/0.4/1.6, dsn=2.0.0, status=sent (250 2.0.0 OK 1408588338 t1si36397231laj.89 - gsmtp)
syslog.1:6990:Aug 21 04:50:56 lovecakes postfix/smtp[25071]: 0D54315A951: to=, relay=gmail-smtp-in.l.google.com[2a00:1450:4010:c08::1b]:25, delay=3.1, delays=1.4/0/0.34/1.3, dsn=5.7.1, status=bounced (host gmail-smtp-in.l.google.com[2a00:1450:4010:c08::1b] said: 550-5.7.1 [2a01:4f8:d15:1fc4::2      12] Our system has detected that this 550-5.7.1 message is likely unsolicited mail. To reduce the amount of spam sent 550-5.7.1 to Gmail, this message has been blocked. Please visit 550-5.7.1 http://support.google.com/mail/bin/answer.py?hl=en&answer=188131 for 550 5.7.1 more information. c2si36483814lac.0 - gsmtp (in reply to end of DATA command))

For a while I couldn’t find a problem place and didn’t know, where to fix. I tried to list cron jobs:

for user in $(cut -f1 -d: /etc/passwd); 
do 
  crontab -u $user -l; 
done

But without a success.

Finally, I did search using grep recursively and found some files, where this e-mail appeared:

root@lovecakes /home # grep -r 'guys_name' /etc
Binary file /etc/postfix/transport.db matches
Binary file /etc/postfix/recipient_bcc.db matches

Because it was in *.db files, I couldn’t fix it by just editing config files in PostFix.

And because PostFix is not used in the server, I just removed it:

# sudo apt-get purge postfix