Question

我有一个带Postfix的Centos服务器。我的服务器被某人滥用来发送垃圾邮件。我使用恶意软件检测和其他工具定期扫描服务器。 Plesk控制面板也设置了50个/小时的限制。服务器操作系统和服务器上的其他软件会定期更新。

然而我的ISP通知我，从ip发送了大量垃圾邮件，因此他们阻止了ip。我一直试图检测源，但失败了。

如果有人可以建议我从标题中找到垃圾邮件发送者/垃圾邮件脚本的方法，那将会让我轻松:) （我已将我的服务器IP屏蔽为server.myserver.com/100.100.100.100）

##########邮件标题

X-HmXmrOriginalRecipient: lizmay28@hotmail.com
Received: from BN3NAM04HT097.eop-NAM04.prod.protection.outlook.com
(10.175.9.152) by MWHPR14MB1711.namprd14.prod.outlook.com with HTTPS via
MWHPR18CA0038.NAMPRD18.PROD.OUTLOOK.COM; Sun, 13 Aug 2017 13:28:43 +0000
Received: from BN3NAM04FT012.eop-NAM04.prod.protection.outlook.com
(10.152.92.54) by BN3NAM04HT097.eop-NAM04.prod.protection.outlook.com
(10.152.93.173) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1304.16; Sun, 13
Aug 2017 13:28:42 +0000
Authentication-Results: spf=none (sender IP is 100.100.100.100)
smtp.mailfrom=hotpop3.com; hotmail.com; dkim=none (message not signed)
header.d=none;hotmail.com; dmarc=none action=none header.from=hotpop3.com;
Received-SPF: None (protection.outlook.com: hotpop3.com does not designate
permitted sender hosts)
Received: from BAY004-MC1F21.hotmail.com (10.152.92.58) by
BN3NAM04FT012.mail.protection.outlook.com (10.152.92.169) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
15.1.1304.16 via Frontend Transport; Sun, 13 Aug 2017 13:28:41 +0000
X-IncomingTopHeaderMarker: OriginalChecksum:F12CEF74F354E5E4529259D131D19D0E4D4442B5F4483E6B74E2D931A45FBA73;UpperCasedChecksum:76720E6505CE4C455F8D3F0CB51C70A39163C5E1791F81A33FB44509BB39FB53;SizeAsReceived:678;Count:13
Received: from server.myserver.com ([100.100.100.100]) by BAY004-MC1F21.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143);
Sun, 13 Aug 2017 06:28:35 -0700
Subject: Lizmay You have a message that will be deleted in 6 days legendary
Feverishly-Vague-Notebooks: 16359
To: lizmay28@hotmail.com
Content-Type: text/html; charset="UTF-8"
Pectoral-Rises-Hobble: sense
Date: Sun, 13 Aug 2017 09:28:34 +0000
Content-Transfer-Encoding: 7bit
Message-ID: 862244fed7285.157dc1a7@hotpop3.com
From: Notification Facebook dogbard@hotpop3.com
Return-Path: dogbard@hotpop3.com
X-OriginalArrivalTime: 13 Aug 2017 13:28:35.0988 (UTC) FILETIME=[11010540:01D31438]
X-IncomingHeaderCount: 13
X-MS-Exchange-Organization-Network-Message-Id: 10ae07f6-85af-416d-5f30-08d4e24f3700
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
CMM-sender-ip: 100.100.100.100
CMM-sending-ip: 100.100.100.100
CMM-Authentication-Results: hotmail.com; spf=none (sender IP is
100.100.100.100) smtp.mailfrom=dogbard@hotpop3.com; dkim=none
header.d=hotpop3.com; x-hmca=none header.id=dogbard@hotpop3.com
CMM-X-SID-PRA: dogbard@hotpop3.com
CMM-X-AUTH-Result: NONE
CMM-X-SID-Result: NONE
CMM-X-Message-Status: n:n
CMM-X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
CMM-X-Message-Info: 3c21WZ1hAltI9DuizMAEE41BI5AyVQJy5WKTrkRtozy7n8uROmdGq+2lzhar6phB3KoijGvJ2eF4om5ai2JdojRslastfe6pj1PSlUSTzu43fu053gfRHmctpRBqOUpyGS3Vvp2i0dMdFEBn/V2FUePTQUv3iK5Hc6xpG2YhOg6feY2B48yB5jfebtnjBPmjRuGMUZjZRdLVNuhzm251tnrEfTwhUg4szJwHV/Dlf+P/AiA7NYuF6WUYldYez+RR
X-MS-Exchange-Organization-PCL: 2
X-MS-UserLastLogonTime: 8/13/2017 3:35:36 AM

Answer 1

请确保使用以下设置配置postfix：

...
smtp_tls_security_level = may
smtp_use_tls = no
smtpd_tls_security_level = may
smtpd_use_tls = yes
smtpd_sasl_auth_enable = yes
smtpd_tls_auth_only = no

smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = noanonymous
...

和

...
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sender_restrictions = check_sender_access hash:/var/spool/postfix/plesk/blacklists, permit_sasl_authenticated
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_rbl_client cbl.abuseat.org, reject_rbl_client sbl.spamhaus.org, reject_rbl_client xbl.spamhaus.org
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
...

例如。

PLS。确保，＆＃34; 允许用户和脚本使用Sendmail ＆＃34;未设置为 =＆gt; HOME＆gt;工具和设置＆gt;邮件服务器设置，因为这会阻止sendmail的使用，并且只允许发送带有SMTP身份验证的邮件（在您的情况下建议使用！）。

PLS。检查官方Plesk知识库 - 文章：

=＆gt; Many email messages are sent from PHP scripts on a server. How to find domains on which these scripts are running if Postfix is used?

...并考虑在Plesk官方社区论坛上使用Plesk论坛社区的帮助： =＆gt; https://talk.plesk.com

Answer 2

首先，您需要确定您的 MTA 是否正在发送这些电子邮件。

检查您的 MTA 日志，查看是否有蚂蚁提及投诉电子邮件地址等。

如果是 MTA，日志可能会说明哪个用户 ID 正在向您的 MTA 提交邮件，或者您可能会找到一个开放的中继。

如果不是通过 MTA，您将不得不使用 ss 和 lsof 等工具来查找端口 25 上的 TCP 活动，这些工具可以显示活动的 TCP 连接，或者将日志记录规则添加到 iptables。

Answer 3

通常会有两个问题：

邮件服务器配置为open relay
用户的可信任度已受到威胁，或者用户愿意发送大量邮件

我建议设置一个出站中继，以限制传出消息的数量并检查大量内容（DCC，razor，pyzor）。这样，您可以收集有关电子邮件使用情况的可靠统计信息，并查看导致洪水的用户。如果plesk服务器受损，则很难找到真正的来源。

关于标题的问题，请尝试评估original sender IP address并使用relay country plugin对其进行分类。

也许Logwatch还可以帮助确定异常流量的来源：

yum -y update
yum -y install logwatch

除此之外，介绍SPF，DKIM和DMARC很有用。看起来您没有设置它们：

身份验证结果：spf = 无（发件人IP为100.100.100.100）

从邮件标题中查找垃圾邮件来源

3 个答案: