Email auditing

[charlie derr]

Derek Broughton wrote:
> Preston Kutzner wrote:
> 
>> On Tue, 11 Dec 2007 11:33:20 -0400
>> Derek Broughton <news at pointerstop.ca> wrote:
>>
>>> Felipe Figueiredo wrote:
>>>
>>>> Em Monday 10 December 2007 15:06:29 Karl-Heinz Schulz escreveu:
>>>>> I want that all incoming and outgoing email for a particular user is
>>>>> cc: into another mail box.
>>>>> What is the best way to accomplish that?
>>>>> Which tools should I use?
>>>> An MDA (Mail Delivery Agent). The most common are procmail and
>>>> maildrop. There are manu tutorials over the web, and if you install one
>>>> of them, it will come with documentation full of examples of common
>>>> configurations.
>>> With postfix, can't you do that in /etc/aliases?
>> Yes, you can do that through postfix.  Here's a run-down on how to do it:
>>
>> add the following to /etc/postfix/main.cf:
>> sender_bcc_maps = hash:/etc/postfix/sender_bcc
>> recipient_bcc_maps = hash:/etc/postfix/recipient_bcc
>>
>> In sender/recipient_bcc:
>>
>> <dest_address>        <cc_address>
>>
>> Run postmap on both those files, then run postfix reload
> 
> While that's not particularly difficult, I thought it was possible to
> have /etc/aliases route to an additional user more simply than your method.
> 
> I'm _fairly_ sure (keeping in mind that I don't use Postfix!) that you can
> have an entry like:
> 
> user1: user2, user3 at otherhost
> 
> where all mail to "user1" goes to "user2 at localhost" and "user3 at otherhost",
> what I'm not so sure about is whether there's a syntax to allow mail
> to "user1" to be sent to "user1" and _also_ "user2" - since that runs the
> real risk of a mail loop, perhaps not :-)

I'm not an expert here either (though I do use postfix), but I think the problem with this solution is that it doesn't fulfill the 
other requirement of the original post, that mail *sent by* the user gets CCed to the additional mailbox (in addition to the 
incoming mail which you've solved with /etc/aliases).

	~c

and of course I'm trying to bite my tongue on the issue of notification, as what was originally requested was a CC, and what has 
been provided as an answer is actually a BCC, though I figure anyone who cares about my point of view has probably already read my 
previous thoughts...