# charlie root change to User admin



## jack111 (May 24, 2009)

I receive daily messages from my server and they all use to come from the email address below.


```
from	Charlie Root <root@myserver.com>
to	root@myserver.com
```

Today I notice they have started coming from User Admin instead of Charlie root.



```
from	User Admin <admin@myserver.com>
to	root@myserver.com
```

Any ideas why this has happened.

thanks


----------



## vivek (May 24, 2009)

Do you see any new changes in /etc/aliases or /etc/passwd for user root? It is also possible to change settings in mail server (especially address rewriting rules)


----------



## jack111 (May 24, 2009)

*no changes*

Thank you for your reply
where would I go about find the users


> /etc/aliases or /etc/passwd for user root?



and what type of changes am I looking for.

I have opened the passwd file and see no obivious changes.
the etc/aliases appears to be a just a link but i have not done any changes to the mail aliases.

anything else I could check up

thanks


----------



## jack111 (May 24, 2009)

*how the email have changed.*

below is how the emails i recieve from my server have changed.

Before

```
Delivered-To: myemail@gmail.com
Received: by 10.239.168.17 with SMTP id i17cs115485hbe;
        Sun, 24 May 2009 01:01:07 -0700 (PDT)
Received: by 10.151.123.6 with SMTP id a6mr11405400ybn.85.1243152065933;
        Sun, 24 May 2009 01:01:05 -0700 (PDT)
Return-Path: <root@myserver.com>
Received: from myserver.com ([serverip])
        by mx.google.com with ESMTP id 6si11473215ywc.41.2009.05.24.01.01.04;
        Sun, 24 May 2009 01:01:05 -0700 (PDT)
Received-SPF: neutral (google.com: serverip is neither permitted nor denied by best guess record for domain of root@myserver.com) client-ip=serverip;
Authentication-Results: mx.google.com; spf=neutral (google.com: serverip is neither permitted nor denied by best guess record for domain of root@myserver.com) smtp.mail=root@myserver.com
Received: from myserver.com (localhost [127.0.0.1])
	by myserver.com (9.10.2/9.10.2) with ESMTP id n4O81650006134
	for <root@myserver.com>; Sun, 24 May 2009 03:01:06 -0500 (CDT)
	(envelope-from root@myserver.com)
Received: (from root@localhost)
	by myserver.com (9.10.2/9.10.2/Submit) id n4O815ar006129
	for root; Sun, 24 May 2009 03:01:05 -0500 (CDT)
	(envelope-from root)
Date: Sun, 24 May 2009 03:01:05 -0500 (CDT)
From: Charlie Root <root@myserver.com>
Message-Id: <200905240801.n4O815ar006129@myserver.com>
To: root@myserver.com
Subject: myserver.com daily run output
```

changed to below

```
Delivered-To: myemail@gmail.com
Received: by 10.239.168.17 with SMTP id i17cs115744hbe;
        Sun, 24 May 2009 01:13:40 -0700 (PDT)
Received: by 10.151.133.7 with SMTP id k7mr11489748ybn.225.1243152819776;
        Sun, 24 May 2009 01:13:39 -0700 (PDT)
Return-Path: <admin@myserver.com>
Received: from myserver.com ([serverip])
        by mx.google.com with ESMTP id 5si4266320ywd.35.2009.05.24.01.13.38;
        Sun, 24 May 2009 01:13:39 -0700 (PDT)
Received-SPF: neutral (google.com: serverip is neither permitted nor denied by best guess record for domain of admin@myserver.com) client-ip=serverip;
Authentication-Results: mx.google.com; spf=neutral (google.com: serverip is neither permitted nor denied by best guess record for domain of admin@myserver.com) smtp.mail=admin@myserver.com
Received: from myserver.com (localhost [127.0.0.1])
	by myserver.com (8.14.2/8.14.2) with ESMTP id n4O8DexO006887
	for <root@myserver.com>; Sun, 24 May 2009 03:13:40 -0500 (CDT)
	(envelope-from admin@myserver.com)
Received: (from root@localhost)
	by myserver.com (9.14.2/9.14.2/Submit) id n4O8Dekq006885
	for root; Sun, 24 May 2009 03:13:40 -0500 (CDT)
	(envelope-from admin)
Date: Sun, 24 May 2009 03:13:40 -0500 (CDT)
From: User Admin <admin@myserver.com>
Message-Id: <200905240813.n4O8Dekq006885@myserver.com>
To: root@myserver.com
Subject: myserver.com monthly run output
```

you can see on the fourth line from the bottom the from has changed to User Admin.
If you missed it the below 
*From: Charlie Root <root@myserver.com>*
has change to 
*From: User Admin <admin@myserver.com>*

wondering why this has happened


----------



## vivek (May 24, 2009)

Try

```
grep -i root /etc/aliases 
grep -i root /etc/passwd
grep -i MAILTO /etc/crontab
cat /root/.forward
cd /etc
grep -Ri 'admin@myserver.com' *
```


----------



## phoenix (May 24, 2009)

Check your aliases file and your Sendmail config.  Looks like you did a sendmail upgrade (9.10.2 to 9.14.2).  Perhaps during the upgrade an alias for root was added, or a config file changed to use admin instead of root.


----------

