Spamming do meu servidor Linux

Question

Oi eu queria saber se alguém poderia ajudar. Eu recebi um email da minha empresa de hospedagem que há algum tráfego estranho vindo do meu servidor. Uma rápida olhada no arquivo de log revelou o log de amostra abaixo. Existem milhares de e-mails no arquivo de log.

Alguém pode sugerir como eu posso bloquear todos os e-mails que estão sendo enviados do meu servidor Linux. Eu estou no Ubuntu 12.03 LTS se isso ajuda.

Jan 31 09:52:30 myserver postfix/smtp[55852]: 03EC14869A: to=<[email protected]>, relay=exch-spam02.ulaval.ca[132.203.244.24]:25, delay=229193, delays=229193/0.17/0.47/0, dsn=4.0.0, status=deferred (host exch-spam02.ulaval.ca[132.203.244.24] refused to talk to me: 554-exch-spam02.ulaval.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: connect to cluster8.us.messagelabs.com[216.82.241.132]:25: Connection refused
Jan 31 09:52:30 myserver postfix/smtp[55849]: 5049348710: to=<[email protected]>, relay=mail3.uqam.ca[132.208.246.162]:25, delay=229188, delays=229187/0.15/0.52/0, dsn=4.0.0, status=deferred (host mail3.uqam.ca[132.208.246.162] refused to talk to me: 554-data.crochet.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: connect to cluster8a.us.messagelabs.com[85.158.139.103]:25: Connection refused
Jan 31 09:52:30 myserver postfix/smtp[55861]: 3437C4876E: to=<[email protected]>, relay=mail3.uqam.ca[132.208.246.162]:25, delay=229181, delays=229180/0.2/0.45/0, dsn=4.0.0, status=deferred (host mail3.uqam.ca[132.208.246.162] refused to talk to me: 554-data.crochet.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55846]: 8503348BF7: to=<[email protected]>, relay=mail2.csc-scc.gc.ca[198.103.56.136]:25, delay=228588, delays=228587/0.12/0.68/0, dsn=4.0.0, status=deferred (host mail2.csc-scc.gc.ca[198.103.56.136] refused to talk to me: 554-mxlaval.csc-scc.gc.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: connect to cluster8a.us.messagelabs.com[216.82.251.230]:25: Connection refused
Jan 31 09:52:30 myserver postfix/smtp[55865]: A5E364984A: to=<[email protected]>, relay=mail2.uqam.ca[132.208.246.165]:25, delay=228559, delays=228558/0.27/0.46/0, dsn=4.0.0, status=deferred (host mail2.uqam.ca[132.208.246.165] refused to talk to me: 554-data.hamecon.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: F0E6948932: to=<[email protected]>, relay=none, delay=229161, delays=229161/0.33/0.4/0, dsn=4.4.1, status=deferred (connect to cluster8a.us.messagelabs.com[216.82.251.230]:25: Connection refused)
Jan 31 09:52:30 myserver postfix/smtp[55843]: A83CA486EF: to=<[email protected]>, relay=exch-spam02.ulaval.ca[132.203.244.24]:25, delay=229191, delays=229190/0.27/0.48/0, dsn=4.0.0, status=deferred (host exch-spam02.ulaval.ca[132.203.244.24] refused to talk to me: 554-exch-spam02.ulaval.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55845]: 2E49B4866E: host mx11.exchange.telus.com[205.206.208.34] refused to talk to me: 554-mx21.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 31 09:52:30 myserver postfix/smtp[55856]: 12A4A4DF0A: to=<[email protected]>, relay=mxmta.bellnet.ca[67.69.240.61]:25, delay=231626, delays=231625/0.17/0.92/0, dsn=4.4.2, status=deferred (lost connection with mxmta.bellnet.ca[67.69.240.61] while receiving the initial server greeting)
Jan 31 09:52:30 myserver postfix/smtp[55845]: 2E49B4866E: host mx12.exchange.telus.com[205.206.208.35] refused to talk to me: 554-mx22.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 31 09:52:30 myserver postfix/smtp[55850]: 53A1948A8C: to=<[email protected]>, relay=presmtp.ex1.secureserver.net[72.167.238.201]:25, delay=228581, delays=228579/0.15/1.2/0, dsn=4.0.0, status=deferred (host presmtp.ex1.secureserver.net[72.167.238.201] refused to talk to me: 554-p3pismtp01-057.prod.phx3.secureserver.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:31 myserver postfix/smtp[55844]: 955704945F: to=<[email protected]>, relay=MX.cogeco.ca[216.221.81.26]:25, delay=228598, delays=228596/0.1/1.4/0, dsn=4.4.2, status=deferred (lost connection with MX.cogeco.ca[216.221.81.26] while receiving the initial server greeting)
Jan 31 09:52:31 myserver postfix/smtp[55845]: 2E49B4866E: host mx13.exchange.telus.com[209.171.64.82] refused to talk to me: 554-mx24.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 31 09:52:31 myserver postfix/smtp[55845]: 2E49B4866E: to=<[email protected]>, relay=mx14.exchange.telus.com[209.171.64.83]:25, delay=229196, delays=229194/0.1/1.6/0, dsn=4.0.0, status=deferred (host mx14.exchange.telus.com[209.171.64.83] refused to talk to me: 554-mx25.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:31 myserver postfix/smtp[55862]: 343EB486F0: to=<[email protected]>, relay=none, delay=229190, delays=229188/0.21/1.5/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=inrs-ete.uquebec.ca type=MX: Host not found, try again)
Jan 31 09:52:33 myserver postfix/smtp[55847]: 611C348731: to=<[email protected]>, relay=none, delay=229189, delays=229185/0.13/3.3/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=coastalwinds.com type=MX: Host not found, try again)
Jan 31 09:52:33 myserver postfix/smtp[55848]: 6146948685: to=<[email protected]>, relay=mail3.uqam.ca[132.208.246.162]:25, delay=229195, delays=229191/0.14/3.5/0, dsn=4.0.0, status=deferred (host mail3.uqam.ca[132.208.246.162] refused to talk to me: 554-data.crochet.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:59 myserver postfix/smtp[55854]: connect to gmail.co[173.194.34.182]:25: Connection timed out
Jan 31 09:52:59 myserver postfix/smtp[55860]: connect to hortmail.com[65.55.39.10]:25: Connection timed out
Jan 31 09:52:59 myserver postfix/smtp[55855]: connect to saskpower.ca[65.39.140.84]:25: Connection timed out
Jan 31 09:52:59 myserver postfix/smtp[55855]: 022C148CCF: to=<[email protected]>, relay=none, delay=229153, delays=229123/0.15/30/0, dsn=4.4.1, status=deferred (connect to saskpower.ca[65.39.140.84]:25: Connection timed out)
Jan 31 09:53:00 myserver postfix/smtp[55866]: connect to remax-lethbridge.com[208.91.196.163]:25: Connection timed out
Jan 31 09:53:00 myserver postfix/smtp[55866]: B370A48B44: to=<[email protected]>, relay=none, delay=229168, delays=229137/0.28/30/0, dsn=4.4.1, status=deferred (connect to remax-lethbridge.com[208.91.196.163]:25: Connection timed out)
Jan 31 09:53:29 myserver postfix/smtp[55854]: connect to gmail.co[173.194.34.181]:25: Connection timed out
Jan 31 09:53:29 myserver postfix/smtp[55854]: 056994B723: to=<[email protected]>, relay=none, delay=228541, delays=228481/0.19/60/0, dsn=4.4.1, status=deferred (connect to gmail.co[173.194.34.181]:25: Connection timed out)
Jan 31 09:53:29 myserver postfix/smtp[55860]: connect to hortmail.com[64.4.6.100]:25: Connection timed out
Jan 31 09:53:29 myserver postfix/smtp[55860]: 3F3DE48F58: to=<[email protected]>, relay=none, delay=229137, delays=229076/0.19/60/0, dsn=4.4.1, status=deferred (connect to hortmail.com[64.4.6.100]:25: Connection timed out)

    

Answer 1

1. postsuper -h ALL interromperá as mensagens enviadas do seu servidor. Faça isso. Agora mesmo. Sim, isso afetará o correio real. Mas o seu servidor já foi colocado na lista negra, e muito do seu e-mail real não será entregue de qualquer maneira.

2. Veja os cabeçalhos de um dos e-mails de spam. É assim que você descobre de onde eles vieram. Não posso fornecer mais informações sem ver esses cabeçalhos.

3. Limpe o spam da sua fila. Se você não estiver preocupado com qualquer email "real" ainda na fila, a exclusão da fila inteira será mais rápida e fácil. Isso é feito com postqueue -d ALL . Se você não quiser excluir toda a fila, imprima o conteúdo da fila com postqueue -p . Em seguida, para cada email que você realmente deseja enviar, examine o ID da fila desse email e remova-o da retenção com postsuper -H queue_ID . Quando terminar (e tiver copiado o conteúdo de algum email de spam para análise posterior), você poderá limpar os spams restantes na fila de espera executando postsuper -d ALL hold .

4. Se houver, você precisa encerrar o postfix. Agora mesmo. Não reinicie até descobrir de onde vem o spam e tenha certeza de que o interrompeu. Há informações sobre como proteger um servidor de postfix na documentação do postfix . Se você já fez isso, mas o spam ainda está chegando, provavelmente é através de algum serviço da web ou outro malware. Descobrir isso está além do escopo desta questão.

5. Seu servidor de e-mail está na lista negra. Você precisa configurar a retransmissão de e-mails por meio de um servidor ISPs, ou você precisa sair das listas negras. Há informações sobre isso no link .

Answer 2

O fragmento de log que você forneceu não é suficiente para lhe dar uma resposta. Esse fragmento de log mostra apenas tentativas de entrega para servidores que não estão respondendo. Eles também parecem ser endereços incorretos (gmail.co, hortmail.com, ...)

    

Answer 3

Podem existir algumas razões para isso.

O seu servidor aceita conexões de entrada na porta 25? Em caso afirmativo, precisa? Pode ser um proxy aberto, permitindo que qualquer pessoa use seu servidor SMTP para distribuir e-mail.

Se for um servidor da Web, ele poderá ter um malware instalado por meio de, por exemplo, software de fórum ou WordPress (para o último, você pode usar o software de verificação automática como link ).

Ajudaria a descobrir de onde os e-mails são enviados.

    

Answer 4

O novo log adicionado mostra que outros servidores de e-mail estão rejeitando o e-mail proveniente de seu servidor porque ele está em uma lista negra, provavelmente porque o spam foi (ou foi) enviado do seu lado. Esse é provavelmente o tráfego estranho que seu provedor de hospedagem estava falando.

Este log mostra que sim, seu servidor estava enviando spam e agora está listado em listas negras anti-spam, mas isso ainda não é suficiente para encontrar o motivo.

Eu aconselharia verificar seu sistema para rootkits / backdoors. Esta ferramenta pode ajudar:

link