Unwanted address rewrite

[confuzzled]

Using ISPConfig, I set up a client, and a site, called "c2".

ISPConfig has created entries for it in /etc/postfix/virtusertable:

###################################
#
# ISPConfig virtusertable Configuration File
# Version 1.0
#
###################################
c2@www.c2.dddddd.com web5_c2
web5_c2@www.c2.dddddd.com web5_c2
c2@c2.dddddd.com web5_c2
web5_c2@c2.dddddd.com web5_c2
c1@www.gonzo.dddddd.com web4_c1
web4_c1@www.gonzo.dddddd.com web4_c1
c1@gonzo.dddddd.com web4_c1
web4_c1@gonzo.dddddd.com web4_c1
#### MAKE MANUAL ENTRIES BELOW THIS LINE! ####

When I send an email to c2@c2.dddddd.com, it bounces.

Undelivered Mail Returned to Sender
From:
Mail Delivery System <MAILER-DAEMON@gonzo.dddddd.com>
To:
paul@gonzo.dddddd.com
Date:
Today 10:59:11

This is the Postfix program at host server1.gonzo.dddddd.com.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The Postfix program

<web5_c2@gonzo.dddddd.com>: unknown user: "web5_c2"
unnamed
Delivery report

Encapsulated message
test
From:
paul <paul@gonzo.dddddd.com>
To:
c2@c2.dddddd.com
Date:
Today 10:59:02

End of encapsulated message

Looking at /var/log/mail, it seems like something (maybe amavis, I don't know)
has rewritten the subdomain from c2.dddddd.com to gonzo.dddddd.com, i.e. from virtual to real. But there isn't a user c2
at gonzo, only at c2, so it bounces - that's my theory.

Mar 20 10:59:04 gonzo postfix/smtpd[6527]: connect from gonzo.dddddd.com[127.0.0.2]
Mar 20 10:59:04 gonzo postfix/smtpd[6527]: A7EA11E513: client=gonzo.dddddd.com[127.0.0.2]
Mar 20 10:59:04 gonzo postfix/cleanup[6529]: A7EA11E513: message-id=<200603201059.02714.paul@gonzo.dddddd.com>
Mar 20 10:59:04 gonzo postfix/qmgr[5499]: A7EA11E513: from=<paul@gonzo.dddddd.com>, size=548, nrcpt=1 (queue active)
Mar 20 10:59:04 gonzo postfix/smtpd[6527]: disconnect from gonzo.dddddd.com[127.0.0.2]
Mar 20 10:59:05 gonzo amavis[5729]: (05729-01) WARN: all primary virus scanners failed, considering backups
Mar 20 10:59:11 gonzo postfix/smtpd[6535]: connect from localhost[127.0.0.1]
Mar 20 10:59:11 gonzo postfix/smtpd[6535]: A698D1B495: client=localhost[127.0.0.1]
Mar 20 10:59:11 gonzo postfix/cleanup[6529]: A698D1B495: message-id=<200603201059.02714.paul@gonzo.dddddd.com>
Mar 20 10:59:11 gonzo postfix/qmgr[5499]: A698D1B495: from=<paul@gonzo.dddddd.com>, size=1024, nrcpt=1 (queue active)
Mar 20 10:59:11 gonzo postfix/smtpd[6535]: disconnect from localhost[127.0.0.1]
Mar 20 10:59:11 gonzo amavis[5729]: (05729-01) Passed CLEAN, [127.0.0.2] <paul@gonzo.dddddd.com> -> <web5_c2@gonzo.dddddd.com>, Message-ID: <200603201059.02714.paul@gonzo.dddddd.com>, mail_id: 5kAWkQnpleSl, Hits: -1.633, 6955 ms
Mar 20 10:59:11 gonzo postfix/smtp[6530]: A7EA11E513: to=<web5_c2@gonzo.dddddd.com>, orig_to=<c2@c2.dddddd.com>, relay=127.0.0.1[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=05729-01, from MTA([127.0.0.1]:10025): 250 Ok: queued as A698D1B495)
Mar 20 10:59:11 gonzo postfix/qmgr[5499]: A7EA11E513: removed
Mar 20 10:59:11 gonzo postfix/local[6536]: A698D1B495: to=<web5_c2@gonzo.dddddd.com>, relay=local, delay=0, status=bounced (unknown user: "web5_c2")
Mar 20 10:59:11 gonzo postfix/cleanup[6529]: F29D31EB68: message-id=<20060320105911.F29D31EB68@server1.gonzo.dddddd .com>
Mar 20 10:59:12 gonzo postfix/qmgr[5499]: F29D31EB68: from=<>, size=2801, nrcpt=1 (queue active)
Mar 20 10:59:12 gonzo postfix/qmgr[5499]: A698D1B495: removed
Mar 20 10:59:12 gonzo postfix/local[6536]: F29D31EB68: to=<paul@gonzo.dddddd.com>, relay=local, delay=1, status=sent (delivered to mailbox)
Mar 20 10:59:12 gonzo postfix/qmgr[5499]: F29D31EB68: removed
Mar 20 11:00:04 gonzo postfix/pickup[5498]: AA3C31EB68: uid=0 from=<root>
Mar 20 11:00:04 gonzo postfix/cleanup[6529]: AA3C31EB68: message-id=<20060320110004.AA3C31EB68@server1.gonzo.dddddd .com>
Mar 20 11:00:04 gonzo postfix/qmgr[5499]: AA3C31EB68: from=<root@gonzo.dddddd.com>, size=463, nrcpt=1 (queue active)
Mar 20 11:00:05 gonzo postfix/smtp[6530]: warning: relayhost configuration problem
Mar 20 11:00:05 gonzo postfix/smtp[6530]: AA3C31EB68: to=<root@localhost.gonzo.dddddd.com>, orig_to=<root@localhost>, relay=none, delay=1, status=deferred (Host or domain name not found. Name service error for name=dinnae.send.ootside.yet type=AAAA: Host not found)

(Yes, I know the external relay isn't working either, but I'm not worried about that.)
In all the text above, I've replaced my real domain name with "dddddd",
but otherwise it's completely unedited.

The question is, why is the address being rewritten?
It makes it impossible to send email to the users I create.
I don't particularly want it rewritten, and I don't know what I've done that
might make that happen. Any ideas?

[falko]

Can you post the virtusertable again with the real domain names?
What's in /etc/hosts?
Is web5_c2 listed in /etc/passwd?

[confuzzled]

OK, here's virtusertable:

###################################
#
# ISPConfig virtusertable Configuration File
# Version 1.0
#
###################################
c2@www.c2.banthewasp.com web5_c2
web5_c2@www.c2.banthewasp.com web5_c2
c2@c2.banthewasp.com web5_c2
web5_c2@c2.banthewasp.com web5_c2
#### MAKE MANUAL ENTRIES BELOW THIS LINE! ####

/etc/hosts is:

#
# hosts This file describes a number of hostname-to-address
# mappings for the TCP/IP subsystem. It is mostly
# used at boot time, when no name servers are running.
# On small systems, this file can be used instead of a
# "named" name server.
# Syntax:
#
# IP-Address Full-Qualified-Hostname Short-Hostname
#

127.0.0.1 localhost

# special IPv6 addresses
::1 localhost ipv6-localhost ipv6-loopback

fe00::0 ipv6-localnet

ff00::0 ipv6-mcastprefix
ff02::1 ipv6-allnodes
ff02::2 ipv6-allrouters
ff02::3 ipv6-allhosts
127.0.0.2 gonzo.banthewasp.com gonzo gonzo.home.banthewasp.com

web5_c2 is listed in /etc/passwd, on the very last line
(which doen not have a return character at the end - I don't know
if that matters).
The end of /etc/passwd looks like this:

admispconfig:x:1003:1003:Administrator ISPConfig:/home/admispconfig:/bin/bash
clamav:x:1004:1004:Clam AntiVirus:/home/clamav:/bin/false
+::::::
web5_c2:x:10005:10005:c2:/home/www/web5/user/web5_c2:/dev/null

[falko]

virtusertable and /etc/passwd are ok, but /etc/hosts isn't. 127.0.0.2 does not exist. Please change the file to

#
# hosts This file describes a number of hostname-to-address
# mappings for the TCP/IP subsystem. It is mostly
# used at boot time, when no name servers are running.
# On small systems, this file can be used instead of a
# "named" name server.
# Syntax:
#
# IP-Address Full-Qualified-Hostname Short-Hostname
#

127.0.0.1 localhost
 gonzo.banthewasp.com gonzo gonzo.home.banthewasp.com
# special IPv6 addresses
::1 localhost ipv6-localhost ipv6-loopback

fe00::0 ipv6-localnet

ff00::0 ipv6-mcastprefix
ff02::1 ipv6-allnodes
ff02::2 ipv6-allrouters
ff02::3 ipv6-allhosts

Another problem: c2.banthewasp.com doesn't exist in DNS:

dig c2.banthewasp.com

; <<>> DiG 9.2.1 <<>> c2.banthewasp.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9057
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;c2.banthewasp.com.             IN      A

;; AUTHORITY SECTION:
banthewasp.com.         10800   IN      SOA     ns1.force9.net. hostmaster.plus.net.uk. 2006031900 14400 1800 604800 86400

;; Query time: 147 msec
;; SERVER: 81.169.163.104#53(81.169.163.104)
;; WHEN: Mon Mar 20 23:46:04 2006
;; MSG SIZE  rcvd: 107

Please change that.