Spammer using an alias to login

[bpinet]

Thanks, the issue has not occurred since deleting the nickname, it was really not used much anymore so no great loss. We were more concerned with how/way with the nickname scenario because we have many nicknames setup and if they are a security issue somehow, we really needed to know that. Seeing I can't find anyone else that has experienced this, I guess we will just keep our eyes on it and go from there. Thanks to everyone that responded.

Can't help with how/why on the nickname -- but the possibly better solution
is to change the password of the user (instead of deleting the nickname).

Ted

>>> On 10/23/09 at 3:16 PM, bpinet<bpinet@no-mx.forums.novell.com> wrote:

> I would agree, however a nickname does not match any mailbox name, it
> is, to my understanding simply a reference pointer to a real user's
> mailbox with a different name.
>
> Here is the scenario (the names have been change to protect the
> innocent)
>
> We have a user called JSparrow and he has a groupwise account and
> recieves mail at jsparrow@tortola.com, this user is in charge of sales
> and would like to receive any mail that might be addressed to
> sales@tortola.com. In the users eDir/groupwise settings, a nickname
> called sales is created.
>
> The login of a spammer is traced via the GWIA and PO logs the entry is
> as follows:
>
> C/S Login dos ::GW Id=sales
>
> There is no mailbox/groupwise user/edir user named "sales" there is
> only a nickname. We have had to deleted the nickname because nicknames
> do not have passwords or any means of securing and to our knowledge it
> should not be possible to login with a nickname.
>
> Has anyone ever reported or seen this. Can anyone shed some light on
> how this could have been done.