[postfix] Jakis Atak ? Czy Moze Zbyt Duza Ilosc Maili Na Raz

[k4 0]

Witam

 

Troche dziwny problem, mam pod soba duze forum dyskusyjne 20k uzytkownikow. Load nie przekraczajacy 3-4, az pewnego dnia nastapil atak, nie wiem co dokladnie, pewnie jakis bot klikajacy/sciagajacy wszystko co popadnie. No to standardowo przyblokowalem IP, ale load nadal nie spadal. Zobaczylem ze postfix mocno mi przeciaza serwer. Wylaczylem go. Przeczekalem 1 dzien wlaczam, a on nadal probuje maile wysylac. Trzyma gdzies w pamieci maile, ktorych nie zdolal wyslac ?

 

Moje logi

mail.log

 

Feb 8 17:49:36 89-149-194-20 postfix/cleanup[30011]: 3AAA1FD586: message-id=<20070208164936.3AAA1FD586@mojadomena2.biz>

Feb 8 17:49:36 89-149-194-20 postfix/qmgr[29840]: 2E9DDFE0EC: to=<dbmaster@example.com>, relay=none, delay=604649, status=deferred (delivery temporarily suspended: connect to example.com[192.0.34.166]: Connection timed out)

Feb 8 17:49:36 89-149-194-20 postfix/qmgr[29840]: 2E9DDFE0EC: from=<www-data@mojadomena2.biz>, status=expired, returned to sender

Feb 8 17:49:37 89-149-194-20 postfix/postfix-script: stopping the Postfix mail system

Feb 8 17:49:38 89-149-194-20 postfix/pickup[29839]: 961D5FD595: uid=33 from=<www-data>

Feb 8 17:49:38 89-149-194-20 postfix/cleanup[29854]: 961D5FD595: message-id=<200702080842.121063796915@mojadomena2.com>

Feb 8 17:49:40 89-149-194-20 postfix/cleanup[29841]: A965AFD596: message-id=<20070208164940.A965AFD596@mojadomena.biz>

Feb 8 17:49:40 89-149-194-20 postfix/qmgr[29840]: 2206BFE0FB: to=<dbmaster@example.com>, relay=none, delay=604650, status=deferred (delivery temporarily suspended: connect to example.com[192.0.34.166]: Connection timed out)

Feb 8 17:49:40 89-149-194-20 postfix/qmgr[29840]: 2206BFE0FB: from=<www-data@mojadomena.biz>, status=expired, returned to sender

Feb 8 17:49:40 89-149-194-20 postfix/cleanup[29904]: D4B97FD597: message-id=<20070208164940.D4B97FD597@mojadomena.biz>

Feb 8 17:49:40 89-149-194-20 postfix/qmgr[29840]: 2F3F5FE10A: to=<dbmaster@example.com>, relay=none, delay=604646, status=deferred (delivery temporarily suspended: connect to example.com[192.0.34.166]: Connection timed out)

Feb 8 17:49:40 89-149-194-20 postfix/qmgr[29840]: 2F3F5FE10A: from=<www-data@zmojadomena.biz>, status=expired, returned to sender

Feb 8 17:49:40 89-149-194-20 postfix/cleanup[29936]: ECCC9FD5A2: message-id=<20070208164940.ECCC9FD5A2@mojadomena.biz>

Feb 8 17:49:40 89-149-194-20 postfix/qmgr[29840]: 2F1FEFE116: to=<dbmaster@example.com>, relay=none, delay=604644, status=deferred (delivery temporarily suspended: connect to example.com[192.0.34.166]: Connection timed out)

Feb 8 17:49:40 89-149-194-20 postfix/qmgr[29840]: 2F1FEFE116: from=<www-data@mojadomena.biz>, status=expired, returned to sender

Feb 8 17:49:41 89-149-194-20 postfix/qmgr[29840]: 25D0CFE130: to=<dbmaster@example.com>, relay=none, delay=604639, status=deferred (delivery temporarily suspended: connect to example.com[192.0.34.166]: Connection timed out)

Feb 8 17:49:41 89-149-194-20 postfix/qmgr[29840]: 25D0CFE130: from=<www-data@mojadomena.biz>, status=expired, returned to sender

Feb 8 17:49:41 89-149-194-20 postfix/cleanup[30029]: 11AB6FD5B3: message-id=<20070208164940.11AB6FD5B3@mojadomena.biz>

Feb 8 17:49:41 89-149-194-20 postfix/cleanup[30030]: 115E5FD5A4: message-id=<20070208164941.115E5FD5A4@mojadomena.biz>

Feb 8 17:49:41 89-149-194-20 postfix/master[29837]: terminating on signal 15

 

mail.warn

 

Feb 8 01:33:34 89-149-194-20 postfix/pickup[18542]: warning: 3E11317501B: message has been queued for 6 days

Feb 8 01:33:35 89-149-194-20 postfix/pickup[18542]: warning: 72809175086: message has been queued for 6 days

Feb 8 01:33:36 89-149-194-20 postfix/pickup[18542]: warning: AE86FFD011: message has been queued for 6 days

Feb 8 01:33:37 89-149-194-20 postfix/pickup[18542]: warning: E5A8BFD127: message has been queued for 6 days

Feb 8 01:33:39 89-149-194-20 postfix/pickup[18542]: warning: 911D0FCD57: message has been queued for 6 days

Feb 8 01:33:42 89-149-194-20 postfix/pickup[18542]: warning: F268917509D: message has been queued for 6 days

Feb 8 01:33:44 89-149-194-20 postfix/pickup[18542]: warning: 5F23EFCD6A: message has been queued for 6 days

Feb 8 01:33:45 89-149-194-20 postfix/pickup[18542]: warning: 9D930175114: message has been queued for 6 days

Feb 8 01:33:46 89-149-194-20 postfix/pickup[18542]: warning: D4CCDFD1B9: message has been queued for 6 days

Feb 8 01:33:58 89-149-194-20 postfix/pickup[18542]: warning: CCEB1175078: message has been queued for 6 days

Feb 8 01:33:59 89-149-194-20 postfix/pickup[18542]: warning: 5C72EFD28D: message has been queued for 6 days

Feb 8 01:34:00 89-149-194-20 postfix/pickup[18542]: warning: 63AFAFD2ED: message has been queued for 6 days

Feb 8 01:34:02 89-149-194-20 postfix/pickup[18542]: warning: 9E733FD3A6: message has been queued for 6 days

Feb 8 01:34:04 89-149-194-20 postfix/pickup[18542]: warning: 5FC0C175038: message has been queued for 6 days

Feb 8 01:34:05 89-149-194-20 postfix/pickup[18542]: warning: B002BFD407: message has been queued for 6 days

[shive 0]

Masz pewnie jakiś dziurawy skrypt mailowy na stronie. Zabezpiecz go i wyczyść kolejki wstrzymanych wiadomości w postfiksie przed uruchomieniem.

[beliq 442]

Wszystkie maile oczekujące na dostarczenie możesz zobaczyć wpisując mailq z konsoli.

Bardzo możliwe, że ktoś Ci się włamał i masz teraz masę spamu w kolejce.

[k4 0]

juz sobie poradzilem,

 

postsuper