【求助】mail server被入侵了





ahdeng
2002-12-12, 02:00 PM
幫忙一下,星期日公司的MAIL QUEUE居然有十萬多筆的信件未寄出,看了一下大部份都是由這個網站寄出來的,http://chmailnet.com/,是公司的MAIL SERVER 被 RELAY了嗎?可是我也沒有開放讓這個位址可以寄信?可以幫忙一下如何解決呢!!
Dec 9 00:00:00 mail sendmail[22426]: gB8Fxtn22426: from=<[email protected]>, size=2114, class=0, nrcpts=5, msgid=<[email protected]>, proto=SMTP, relay=localhost.localdomain [127.0.0.1]
Dec 9 00:00:01 mail sendmail[22432]: gB8Fxrm22421: to=<[email protected]>, delay=00:00:07, xdelay=00:00:03, mailer=esmtp, pri=152120, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
Dec 9 00:00:01 mail sendmail[22430]: gB8FxqZ22410: to=<[email protected]>, delay=00:00:08, xdelay=00:00:03, mailer=esmtp, pri=152118, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
Dec 9 00:00:01 mail sendmail[22425]: gB8Fxwn22425: to=<[email protected]>, delay=00:00:02, xdelay=00:00:01, mailer=esmtp, pri=32220, relay=chmailnet.com. [210.82.176.96], dsn=4.0.0, stat=Deferred: Connection refused by chmailnet.com.
Dec 9 00:00:01 mail sendmail[22428]: gB8FxqN22417: to=<[email protected]>, delay=00:00:08, xdelay=00:00:03, mailer=esmtp, pri=152120, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
Dec 9 00:00:01 mail sendmail[21996]: gB8FvVR21960: to=<[email protected]>, delay=00:02:28, xdelay=00:02:00, mailer=esmtp, pri=153987, relay=onemain-mx.earthlink.net. [207.217.120.183], dsn=4.0.0, stat=Deferred: Connection timed out with onemain-mx.earthlink.net.
Dec 9 00:00:01 mail sendmail[22432]: gB8Fxrm22421: to=<[email protected]>, delay=00:00:07, xdelay=00:00:03, mailer=esmtp, pri=152120, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
Dec 9 00:00:01 mail sendmail[21996]: gB8FvVR21960: gB8G01R21996: DSN: User unknown




dominic
2002-12-12, 11:07 PM
stat=User unknown
如果stat不是=sent就是沒寄出.....而且你貼的log太短了~~只看到尾巴.....不知道是本地使用者寄ㄉ還是外部server要relayㄉ

ahdeng
2002-12-13, 09:03 AM
最初由 dominic 發表
stat=User unknown
如果stat不是=sent就是沒寄出.....而且你貼的log太短了~~只看到尾巴.....不知道是本地使用者寄ㄉ還是外部server要relayㄉ

在公司內部才可以relay,在外面就不行透過這台mail server relay,這是大部份都是這樣設定的吧!!
我很想全部貼出來,但是這些log檔光12/8日就80MB了,這不是我打錯,這是真的!!
主機是用RED HAT 7.2,每天都會寄LOG到root的信箱,光是看就受不了!!
是我主機被spam了嗎?
還需要提供什麼資料才可以解答?

dominic
2002-12-13, 04:58 PM
你可以先搜索站上有關relay測試的文章為你的server做test
至於你的log檔像這個
Dec 9 00:00:01 mail sendmail[22432]: gB8Fxrm22421: to=<[email protected]>, delay=00:00:07, xdelay=00:00:03, mailer=esmtp, pri=152120, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
應該還有一段程序sendmail[22432]一樣的一行主要記載from的部份......