我最近在我的postfix-log中发现了这个:
Aug 4 11:09:12 mail postfix/smtpd[71597]: connect from unknown[59.88.35.206] Aug 4 11:09:14 mail postfix/smtpd[71597]: Anonymous TLS connection established from unknown[59.88.35.206]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) Aug 4 11:09:17 mail postfix/smtpd[71597]: 1AE3B7EC3D: client=unknown[59.88.35.206], sasl_method=PLAIN, [email protected] Aug 4 11:09:30 mail postfix/cleanup[71606]: 1AE3B7EC3D: message-id=<[email protected]> Aug 4 11:09:30 mail opendkim[24666]: 1AE3B7EC3D: DKIM-Signature field added (s=mail, d=MYDOMAINCOM2012) Aug 4 11:09:30 mail postfix/qmgr[27543]: 1AE3B7EC3D: from=<[email protected]>, size=2149, nrcpt=20 (queue active) Aug 4 11:09:31 mail postfix/smtpd[71611]: connect from MAIL.example.com[172.16.0.3] Aug 4 11:09:31 mail postfix/smtpd[71611]: 14C4C7EC57: client=MAIL.example.com[172.16.0.3] Aug 4 11:09:31 mail postfix/cleanup[71606]: 14C4C7EC57: message-id=<[email protected]> Aug 4 11:09:31 mail postfix/smtpd[71611]: disconnect from MAIL.example.com[172.16.0.3] Aug 4 11:09:31 mail postfix/qmgr[27543]: 14C4C7EC57: from=<[email protected]>, size=2891, nrcpt=20 (queue active) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57) Aug 4 11:09:31 mail postfix/qmgr[27543]: 1AE3B7EC3D: removed Aug 4 11:09:31 mail postfix/smtpd[71597]: 968227EC58: client=unknown[59.88.35.206], sasl_method=PLAIN, [email protected] Aug 4 11:09:31 mail postfix/smtp[71612]: 14C4C7EC57: to=<[email protected]>, relay=mx.bluebottle.com[136.243.21.189]:25, delay=0.61, delays=0.05/0.02/0.22/0.32, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 37DBE9EC4) Aug 4 11:09:32 mail postfix/smtp[71618]: 14C4C7EC57: to=<[email protected]>, relay=vfxplc.com.inbound10.mxlogic.net[208.65.144.3]:25, delay=1.6, delays=0.05/0.05/0.6/0.85, dsn=5.0.0, status=bounced (host vfxplc.com.inbound10.mxlogic.net[208.65.144.3] said: 554 Denied [CS] [b6d90c55.0.552923.00-2289.1107665.p02c11m005.mxlogic.net] (Mode: normal) (in reply to end of DATA command)) Aug 4 11:09:32 mail postfix/smtp[71616]: 14C4C7EC57: to=<[email protected]>, relay=mx4.hotmail.com[65.55.33.119]:25, delay=1.6, delays=0.05/0.04/0.49/1, dsn=2.0.0, status=sent (250 <[email protected]> Queued mail for delivery) Aug 4 11:09:32 mail postfix/smtp[71614]: 14C4C7EC57: to=<[email protected]>, relay=equitydirect.co.ke.inbound10.mxlogicmx.net[208.65.145.3]:25, delay=1.6, delays=0.05/0.03/0.9/0.66, dsn=5.0.0, status=bounced (host equitydirect.co.ke.inbound10.mxlogicmx.net[208.65.145.3] said: 554 Denied [CS] [b6d90c55.0.778752.00-2304.1523550.s12p02m085.mxlogic.net] (Mode: normal) (in reply to end of DATA command)) Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2) Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2) Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2) Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2) Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2) Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2) Aug 4 11:09:33 mail postfix/smtp[71613]: 14C4C7EC57: to=<[email protected]>, relay=mx.bt.lon5.cpcloud.co.uk[65.20.0.49]:25, delay=2.5, delays=0.05/0.02/0.08/2.4, dsn=2.0.0, status=sent (250 <55BF549902860DA2> Mail accepted) Aug 4 11:09:35 mail postfix/smtp[71615]: 14C4C7EC57: to=<[email protected]>, relay=mx1.safaricombusiness.co.ke[41.203.208.3]:25, delay=4.2, delays=0.05/0.03/2.6/1.5, dsn=2.0.0, status=sent (250 ok: Message 1038363882 accepted) Aug 4 11:09:35 mail postfix/smtp[71615]: 14C4C7EC57: to=<[email protected]>, relay=mx1.safaricombusiness.co.ke[41.203.208.3]:25, delay=4.2, delays=0.05/0.03/2.6/1.5, dsn=2.0.0, status=sent (250 ok: Message 1038363882 accepted) Aug 4 11:09:35 mail postfix/smtp[71615]: 14C4C7EC57: to=<[email protected]>, relay=mx1.safaricombusiness.co.ke[41.203.208.3]:25, delay=4.2, delays=0.05/0.03/2.6/1.5, dsn=2.0.0, status=sent (250 ok: Message 1038363882 accepted) Aug 4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0) Aug 4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0) Aug 4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0) Aug 4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0) Aug 4 11:09:43 mail postfix/cleanup[71606]: 968227EC58: message-id=<[email protected]> Aug 4 11:09:43 mail opendkim[24666]: 968227EC58: DKIM-Signature field added (s=mail, d=MYDOMAINCOM2012) Aug 4 11:09:43 mail postfix/qmgr[27543]: 968227EC58: from=<[email protected]>, size=2204, nrcpt=20 (queue active) Aug 4 11:09:43 mail postfix/smtpd[71611]: connect from MAIL.example.com[172.16.0.3] Aug 4 11:09:43 mail postfix/smtpd[71611]: B0D2D7EC70: client=MAIL.example.com[172.16.0.3] Aug 4 11:09:43 mail postfix/cleanup[71606]: B0D2D7EC70: message-id=<[email protected]> Aug 4 11:09:43 mail postfix/smtpd[71611]: disconnect from MAIL.example.com[172.16.0.3] Aug 4 11:09:43 mail postfix/qmgr[27543]: B0D2D7EC70: from=<[email protected]>, size=2946, nrcpt=20 (queue active) Aug 4 11:09:43 mail amavis[24687]: (24687-07) Passed CLEAN {RelayedOpenRelay}, [59.88.35.206]:4678 [59.88.35.206] <[email protected]> -> <[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>, Queue-ID: 968227EC58, Message-ID: <[email protected]>, mail_id: JR1l308kvN-H, Hits: -, size: 2531, queued_as: B0D2D7EC70, 378 ms Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70) Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
172.16.0.3是我的mailserver-jail的内部IP地址。
我解释这个日志有点麻烦。 这是否意味着某人正在使用我的用户名([email protected])发送垃圾邮件? 如果是这样,那么怎么可能,我该如何解决呢?
这是我的Postfix main.cf:
### GENERAL smtpd_banner = $myhostname ESMTP $mail_name biff = no append_dot_mydomain = no daemon_directory = /usr/local/libexec/postfix command_directory = /usr/local/sbin myhostname = MAIL.example.com myorigin = example.com mydestination = 172.16.0.3 #relayhost = mynetworks = 172.16.0.0/12 127.0.0.0/8 mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = all alias_database = hash:/etc/aliases alias_maps = $alias_database message_size_limit = 50000000 smtpd_helo_required = yes ### VIRTUAL virtual_mailbox_domains = pgsql:/usr/local/etc/postfix/postgres-virtual-mailbox-domains.cf virtual_mailbox_base = /var/vmail virtual_mailbox_maps = pgsql:/usr/local/etc/postfix/postgres-virtual-mailbox-maps.cf virtual_alias_maps = pgsql:/usr/local/etc/postfix/postgres-virtual-alias-maps.cf virtual_minimum_uid = 150 virtual_uid_maps = static:150 virtual_gid_maps = static:6 virtual_transport = dovecot dovecot_destination_recipient_limit = 1 ### SASL Authentication smtpd_sasl_auth_enable = yes smtpd_sasl_exceptions_networks = $mynetworks smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_tls_cert_file = /usr/local/etc/ssl/MAIL.example.com/private.crt smtpd_tls_key_file = /usr/local/etc/ssl/MAIL.example.com/private.key smtpd_tls_CAfile = /usr/local/etc/ssl/MAIL.example.com/cacert.pem smtpd_tls_security_level = may smtpd_tls_received_header = no smtpd_tls_loglevel = 1 smtpd_use_tls = yes smtpd_tls_auth_only = yes tls_random_source = dev:/dev/urandom debug_peer_level = 2 debugger_command = show_user_unknown_table_name = no ### LIMITATIONS smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_rbl_client ix.dnsbl.manitu.net, reject_rbl_client dnsbl.sorbs.net, reject_rbl_client sbl-xbl.spamhaus.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client dialup.blacklist.jippg.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl.spamhaus.org, reject_rbl_client t1.dnsbl.net.au, reject_rhsbl_client block.rhs.mailpolice.com, reject_rhsbl_client dynamic.rhs.mailpolice.com, reject_rhsbl_client rhsbl.sorbs.net, reject_rhsbl_client bogusmx.rfc-ignorant.org smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_sender_domain, reject_sender_login_mismatch, reject_rhsbl_sender rhsbl.sorbs.net, reject_rhsbl_sender rddb.dnsbl.net.au, reject_rhsbl_sender endn.dnsbl.net.au, reject_rhsbl_sender rhsbl.sorbs.net, reject_rhsbl_sender block.rhs.mailpolice.com, reject_rhsbl_sender dynamic.rhs.mailpolice.com smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unknown_recipient_domain, reject_rbl_client ix.dnsbl.manitu.net, reject_rbl_client dnsbl.sorbs.net, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client dnsbl-1.uceprotect.net readme_directory = /usr/local/share/doc/postfix sample_directory = /usr/local/etc/postfix sendmail_path = /usr/local/sbin/sendmail html_directory = /usr/local/share/doc/postfix setgid_group = maildrop manpage_directory = /usr/local/man newaliases_path = /usr/local/bin/newaliases mailq_path = /usr/local/bin/mailq queue_directory = /var/spool/postfix mail_owner = postfix data_directory = /var/db/postfix disable_vrfy_command = yes smtpd_delay_reject = yes content_filter = amavisfeed:[172.16.0.3]:10024 #receive_override_options = no_address_mappings smtpd_milters = inet:172.16.0.3:54321 non_smtpd_milters = inet:172.16.0.3:54321 milter_default_action = accept inet_protocols = ipv4
172.16.0.3:54321是OpenDKIM。
这是我的master.cf:
smtp inet n - n - - smtpd pickup unix n - n 60 1 pickup cleanup unix n - n - 0 cleanup qmgr unix n - n 300 1 qmgr tlsmgr unix - - n 1000? 1 tlsmgr rewrite unix - - n - - trivial-rewrite bounce unix - - n - 0 bounce defer unix - - n - 0 bounce trace unix - - n - 0 bounce verify unix - - n - 1 verify flush unix n - n 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - n - - smtp relay unix - - n - - smtp showq unix n - n - - showq error unix - - n - - error retry unix - - n - - error discard unix - - n - - discard local unix - nn - - local virtual unix - nn - - virtual lmtp unix - - n - - lmtp anvil unix - - n - 1 anvil scache unix - - n - 1 scache dovecot unix - nn - - pipe flags=DRhu user=vmail:mail argv=/usr/local/libexec/dovecot/deliver -f ${sender} -d ${user}@${nexthop} amavisfeed unix - - n - 2 lmtp -o lmtp_data_done_timeout=1200 -o lmtp_send_xforward_command=yes 172.16.0.3:10025 inet n - n - - smtpd -o content_filter= -o smtpd_delay_reject=no -o smtpd_client_restrictions=permit_mynetworks,reject -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o smtpd_data_restrictions=reject_unauth_pipelining -o smtpd_end_of_data_restrictions= -o smtpd_restriction_classes= -o mynetworks=172.16.0.0/12 -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 -o smtpd_client_connection_count_limit=0 -o smtpd_client_connection_rate_limit=0 -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters,no_address_mappings -o local_header_rewrite_clients= -o smtpd_milters= -o local_recipient_maps= -o relay_recipient_maps=
这是否意味着某人正在使用我的用户名([email protected])发送垃圾邮件?
这个日志行是它的certificate。
Aug 4 11:09:17 mail postfix/smtpd[71597]: 1AE3B7EC3D: client=unknown[59.88.35.206], sasl_method=PLAIN, [email protected]
因为您在main.cf有permit_sasl_authenticated ,那么您授权任何知道您的凭据的人通过您的服务器发送电子邮件。
如果是这样,那怎么可能呢?
有许多方法使您的凭证泄漏。
我该如何解决?
首先禁用该帐户,或者在postgre数据库中更改其状态,或将密码更改为随机密码。 确定你的证书是如何泄漏的,并修复这个漏洞。
补充笔记:
你的后缀configuration是好的。 虽然在每个阶段重复一些限制,但是它们有点重叠。 您还应该validation每个rhsbl / rbl提供程序是否仍在维护黑名单以避免误报。
日志显示有人已经获得邮件帐户[email protected]的密码,并正在使用它通过服务器发送垃圾邮件。
这类事件最常见的原因是用户因为钓鱼邮件而告诉他/她在某些收集网页表单的凭证上input他或她的邮件地址和密码。
修理: