Log do postfix… tentativa de spam?

Question

Eu tenho algumas entradas estranhas no meu mail.log. O que eu gostaria de perguntar é se o postfix está evitando corretamente (de acordo com o main.cf anexado abaixo) o que parece ser uma tentativa de retransmissão, presumivelmente por spam, ou se eu puder melhorar sua segurança de alguma forma.

Feb  2 11:53:25 MYSERVER postfix/smtpd[9094]: connect from catv-80-99-46-143.catv.broadband.hu[80.99.46.143]
Feb  2 11:53:25 MYSERVER postfix/smtpd[9094]: warning: non-SMTP command from catv-80-99-46-143.catv.broadband.hu[80.99.46.143]: GET / HTTP/1.1
Feb  2 11:53:25 MYSERVER postfix/smtpd[9094]: disconnect from catv-80-99-46-143.catv.broadband.hu[80.99.46.143]
Feb  2 11:56:45 MYSERVER postfix/anvil[9097]: statistics: max connection rate 1/60s for (smtp:80.99.46.143) at Feb  2 11:53:25
Feb  2 11:56:45 MYSERVER postfix/anvil[9097]: statistics: max connection count 1 for (smtp:80.99.46.143) at Feb  2 11:53:25
Feb  2 11:56:45 MYSERVER postfix/anvil[9097]: statistics: max cache size 1 at Feb  2 11:53:25
Feb  2 12:09:19 MYSERVER postfix/smtpd[9302]: connect from vs148181.vserver.de[62.75.148.181]
Feb  2 12:09:19 MYSERVER postfix/smtpd[9302]: warning: non-SMTP command from vs148181.vserver.de[62.75.148.181]: GET / HTTP/1.1
Feb  2 12:09:19 MYSERVER postfix/smtpd[9302]: disconnect from vs148181.vserver.de[62.75.148.181]
Feb  2 12:12:39 MYSERVER postfix/anvil[9304]: statistics: max connection rate 1/60s for (smtp:62.75.148.181) at Feb  2 12:09:19
Feb  2 12:12:39 MYSERVER postfix/anvil[9304]: statistics: max connection count 1 for (smtp:62.75.148.181) at Feb  2 12:09:19
Feb  2 12:12:39 MYSERVER postfix/anvil[9304]: statistics: max cache size 1 at Feb  2 12:09:19
Feb  2 14:17:02 MYSERVER postfix/smtpd[10847]: connect from unknown[202.46.129.123]
Feb  2 14:17:02 MYSERVER postfix/smtpd[10847]: warning: non-SMTP command from unknown[202.46.129.123]: GET / HTTP/1.1
Feb  2 14:17:02 MYSERVER postfix/smtpd[10847]: disconnect from unknown[202.46.129.123]
Feb  2 14:20:22 MYSERVER postfix/anvil[10853]: statistics: max connection rate 1/60s for (smtp:202.46.129.123) at Feb  2 14:17:02
Feb  2 14:20:22 MYSERVER postfix/anvil[10853]: statistics: max connection count 1 for (smtp:202.46.129.123) at Feb  2 14:17:02
Feb  2 14:20:22 MYSERVER postfix/anvil[10853]: statistics: max cache size 1 at Feb  2 14:17:02
Feb  2 20:57:33 MYSERVER postfix/smtpd[18452]: warning: 95.110.224.230: hostname host230-224-110-95.serverdedicati.aruba.it verification failed: Name or service not known
Feb  2 20:57:33 MYSERVER postfix/smtpd[18452]: connect from unknown[95.110.224.230]
Feb  2 20:57:33 MYSERVER postfix/smtpd[18452]: lost connection after CONNECT from unknown[95.110.224.230]
Feb  2 20:57:33 MYSERVER postfix/smtpd[18452]: disconnect from unknown[95.110.224.230]
Feb  2 21:00:53 MYSERVER postfix/anvil[18455]: statistics: max connection rate 1/60s for (smtp:95.110.224.230) at Feb  2 20:57:33
Feb  2 21:00:53 MYSERVER postfix/anvil[18455]: statistics: max connection count 1 for (smtp:95.110.224.230) at Feb  2 20:57:33
Feb  2 21:00:53 MYSERVER postfix/anvil[18455]: statistics: max cache size 1 at Feb  2 20:57:33
Feb  2 21:13:44 MYSERVER pop3d: Connection, ip=[::ffff:219.94.190.222]
Feb  2 21:13:44 MYSERVER pop3d: LOGIN FAILED, user=admin, ip=[::ffff:219.94.190.222]
Feb  2 21:13:50 MYSERVER pop3d: LOGIN FAILED, user=test, ip=[::ffff:219.94.190.222]
Feb  2 21:13:56 MYSERVER pop3d: LOGIN FAILED, user=danny, ip=[::ffff:219.94.190.222]
Feb  2 21:14:01 MYSERVER pop3d: LOGIN FAILED, user=sharon, ip=[::ffff:219.94.190.222]
Feb  2 21:14:07 MYSERVER pop3d: LOGIN FAILED, user=aron, ip=[::ffff:219.94.190.222]
Feb  2 21:14:12 MYSERVER pop3d: LOGIN FAILED, user=alex, ip=[::ffff:219.94.190.222]
Feb  2 21:14:18 MYSERVER pop3d: LOGIN FAILED, user=brett, ip=[::ffff:219.94.190.222]
Feb  2 21:14:24 MYSERVER pop3d: LOGIN FAILED, user=mike, ip=[::ffff:219.94.190.222]
Feb  2 21:14:29 MYSERVER pop3d: LOGIN FAILED, user=alan, ip=[::ffff:219.94.190.222]
Feb  2 21:14:35 MYSERVER pop3d: LOGIN FAILED, user=info, ip=[::ffff:219.94.190.222]
Feb  2 21:14:41 MYSERVER pop3d: LOGIN FAILED, user=shop, ip=[::ffff:219.94.190.222]
Feb  3 06:49:29 MYSERVER postfix/smtpd[25834]: warning: 71.6.142.196: hostname db4142196.aspadmin.net verification failed: Name or service not known
Feb  3 06:49:29 MYSERVER postfix/smtpd[25834]: connect from unknown[71.6.142.196]
Feb  3 06:49:29 MYSERVER postfix/smtpd[25834]: lost connection after CONNECT from unknown[71.6.142.196]
Feb  3 06:49:29 MYSERVER postfix/smtpd[25834]: disconnect from unknown[71.6.142.196]
Feb  3 06:52:49 MYSERVER postfix/anvil[25837]: statistics: max connection rate 1/60s for (smtp:71.6.142.196) at Feb  3 06:49:29
Feb  3 06:52:49 MYSERVER postfix/anvil[25837]: statistics: max connection count 1 for (smtp:71.6.142.196) at Feb  3 06:49:29
Feb  3 06:52:49 MYSERVER postfix/anvil[25837]: statistics: max cache size 1 at Feb  3 06:49:29

Eu tenho o Postfix 2.7.1-1 rodando no Ubuntu 10.10. Este é o meu (modificado por privacidade) main.cf:

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

append_dot_mydomain = no


readme_directory = no


smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_key_file = /etc/ssl/private/smtpd.key


myhostname = mymailserver.org
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = mymailserver.org, MYSERVER, localhost
relayhost = 
mynetworks = 127.0.0.0/8, 192.168.1.0/24
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/

smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
mailbox_command = 
smtpd_sasl_local_domain = 
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtp_tls_security_level = may

    

Answer 1

Você está certo em ambos.

São tentativas de spam padrão, e o postfix está negando a retransmissão para elas. Se estes são seus registros completos, então você tem sorte se estiver vendo apenas algumas tentativas por dia.

Você ainda pode endurecê-lo bastante, usando SSL, por exemplo, mas parece que não precisa.

Você pode alterar isso para main.cf para forçar todos os clientes que desejam retransmitir email a usar a Autenticação TLS, smtpd_tls_auth_only = yes . Isso pode causar problemas com clientes mais antigos. Os clientes da LAN (conforme definido na variável mynetworks) ainda poderão enviar e-mails usando conexões não criptografadas.

Você pode forçar o postfix a aceitar apenas conexões TLS, mas é uma idéia muito ruim , a menos que você esteja usando apenas para receber e enviar mensagens locais:

• Os servidores que não suportam TLS não poderão enviar ou receber mensagens de você.
• É contra o RFC, então não é padrão.

Altere apenas smtpd_tls_security_level = encrypt . Mais uma vez, esta é uma má ideia .