Stop Postfix sending email to [email protected]

Question

I configured a Postfix server in Ubuntu as satellite system to forward emails to an Exchange server.

When I try to do sudo -i with a user that is not part of the sudoers group the incident is reporting sending an email. (I think using Postfix)

On Exchange queue viewer I saw undelivered messages to an address [email protected] with the security incident report. That email does not exists. I changed /etc/mailname to use domain.com but then in Postfix's logs /var/log/mail.log I saw an email going to [email protected].

After the setup, I ran the

newaliases
service postfix restart

My goal is to setup that postfix send the incident report to [email protected] instead of [email protected] or [email protected]

Note: I am currently sending email in multiple PHP scripts going to [email protected] and everything works fine.

hostname -f
ns.domain.local

cat /etc/hosts
127.0.0.1       ns.domain.local       ns     localhost
192.168.1.3     ns.domain.local       ns

cat /etc/hostname
ns

cat /root/.forward
[email protected]

cat /etc/aliases
postmaster:    root
root: [email protected]

cat /etc/mailname
domain.local

cat /etc/postfix/main.cf
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

append_dot_mydomain = no

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = ns.domain.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = ns.domain.local, localhost.domain.local, localhost,
relayhost = 192.168.1.2 #(EXCHANGE_IP_ADDRESS)
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only
inet_protocols = ipv4

Thank you for any help.

Solution

I found the problem. Now I can received the reports email. As the document explain you need to redirect the root local account to a unix account. I keep all other settings as I posted before.

I have to configure:

nano /etc/postfix/main.cf:
virtual_alias_maps = hash:/etc/postfix/virtual

# I had to create the file.
nano /etc/postfix/virtual:
root     root@localhost

And then run

postmap /etc/postfix/virtual

Here the explanation: http://www.postfix.org/STANDARD_CONFIGURATION_README.html#some_local

Thank you all.

Comments

[Gordon]

Did you run newaliases after setting the file /etc/alias ?