Acabei de receber a seguinte "mensagem não entregue" para o meu [email protected]
Isso significa que alguém pode ter tentado (ou ter conseguido) me hackear?
(Eu substituí certas partes abaixo para fins de privacidade, não é exatamente 100% do original que recebi aqui.)
This is the mail system at host mydomain.com.
I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.
For further assistance, please send mail to <postmaster>
If you do so, please include this problem report. You can
delete your own text from the attached returned message.
The mail system
<[email protected]>: host mta7.am0.yahoodns.net[98.138.112.35] said: 554
delivery error: dd Sorry your message to [email protected] cannot be
delivered. This account has been disabled or discontinued [#102]. -
mta1303.mail.ne1.yahoo.com (in reply to end of DATA command)
Reporting-MTA: dns; mydomain.com
X-Postfix-Queue-ID: 684A933780CC
X-Postfix-Sender: rfc822; [email protected]
Arrival-Date: Tue, 14 Oct 2014 21:16:56 +0200 (CEST)
Final-Recipient: rfc822; [email protected]
Original-Recipient: rfc822;[email protected]
Action: failed
Status: 5.0.0
Remote-MTA: dns; mta7.am0.yahoodns.net
Diagnostic-Code: smtp; 554 delivery error: dd Sorry your message to
[email protected] cannot be delivered. This account has been disabled
or discontinued [#102]. - mta1303.mail.ne1.yahoo.com
ForwardedMessage.eml
Subject:
TESTING - 2012
From:
[email protected] (root)
Date:
10/14/2014 9:16 PM
To:
[email protected]
#############################iNFOS#############################
#############################FOR YOU#############################
Linux servername 2.6.18-164.el5 #1 SMP Thu Sep 3 03:33:56 EDT 2009 i686 i686 i386 GNU/Linux
uid=0(root) gid=0(root) context=system_u:system_r:initrc_t
#############################SSH iNFOS#############################
#############################FOR YOU#############################
#UsePAM no
UsePAM yes
PermitRootLogin
#GatewayPorts no
#ListenAddress 0.0.0.0
#ListenAddress ::
#############################SHADOWFILE#############################
#############################SHADOWFILE#############################
root:$1$H4zwKrgL$NA37jPGoTCiPA0mrq/OKq/:15231:0:99999:7:::
bin:*:15431:0:99999:7:::
daemon:*:15431:0:99999:7:::
info:$1$dO1pvRG.$DZUXjGeS4NgDpGNCwX.0b0:14241:0:99999:7::::::
postmaster:$1$gW7jPsgB$dh09VlQ/W0FALpPlR1fPt/:16127:0:99999:7:::
... more stuff like that
#############################iPS#############################
#############################iPS#############################
inet addr:111.11.111.11 Bcast:111.11.111.11 Mask:255.255.255.0
inet6 addr: ff11::11ff:11ff:ffff:1111/64 Scope:Link
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
#############################USERS WITH SHELL#############################
#############################USERS WITH SHELL#############################
root:x:0:0:root:/root:/bin/bash
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
... some more stuff like the first three lines
Eu não sou o mais experiente, então se alguém puder me dar sugestões sobre o que isso significa e o que fazer em seguida ... obrigado!
Atualização:
No momento da violação, tenho o seguinte no meu arquivo de log httpd:
80.65.51.220 - - [14/Oct/2014:21:56:52 +0200] "POST http://80.65.51.219:6667/ HTTP/1.0" 302 225 "-" "-"
80.65.51.220 - - [14/Oct/2014:21:56:52 +0200] "CONNECT 80.65.51.219:6667 HTTP/1.0" 302 225 "-" "-"
80.65.51.220 - - [14/Oct/2014:21:56:52 +0200] "PUT http://80.65.51.219:6667/ HTTP/1.0" 302 225 "-" "-"
Caso contrário, não encontrei nada suspeito.
Qualquer sugestão adicional de alguém ter visto algo assim antes, deixe um comentário ou uma resposta. Obrigado!
Alguém usando seu servidor intencionalmente enviou um email para [email protected]? Em caso afirmativo, isso é apenas um relatório de falha na entrega.
Se não, então você provavelmente foi hackeado.
/ Editar Aha - por algum motivo eu li o conteúdo mais baixo deste e-mail como informação de diagnóstico do seu mailer local. Agora eu vejo que é mais provável que o conteúdo do e-mail mal-sucedido foi devolvido - sim, você foi pwned. Queime-o no chão e comece de novo.
Tags hacking