Прошу Вас помочь разобраться в моей ситуации.
Имеем сервер:
Код: Выделить всё
mail# uname -a
FreeBSD mailmoa.moa.local 8.1-RELEASE FreeBSD 8.1-RELEASE #0: Mon Jul 19 02:55:53 UTC 2010Код: Выделить всё
mail# pkg_info
exim-4.72 High performance MTA for Unix systems on the Internet
dovecot-1.2.14_1 Secure and compact IMAP and POP3 serversНО!
Смотрю логи:
Код: Выделить всё
mail# tail -f /var/log/maillogКод: Выделить всё
Nov 24 13:51:50 mailmoa exim[21398]: Delay 0s for [192.168.25.150] with HELO=smtp.seapro.crs.org. Mail from dieffenb@conti.ru to flamtour@mail.wpius.net.
Nov 24 13:51:50 mailmoa exim[21516]: Delay 0s for [192.168.25.150] with HELO=221.2.144.135. Mail from megabits@ariostos.ru to kristyjane@km.ru.
Nov 24 13:51:51 mailmoa exim[21458]: Delay 0s for [192.168.25.150] with HELO=218.7.191.182. Mail from spsomut@user.transit.ru to vasilyeval@yukos.ru.
Nov 24 13:51:51 mailmoa exim[21746]: Delay 0s for [192.168.25.150] with HELO=187.16.58.12. Mail from lita-studio@hdm.ru to vast@metacom.ru.
Nov 24 13:51:51 mailmoa exim[21036]: Delay 0s for [192.168.25.150] with HELO=222.168.18.227. Mail from kuplya-prodaja@panaservice.ru to vasilek315@mail.primorye.ru.
Nov 24 13:51:51 mailmoa exim[20940]: Delay 0s for [192.168.25.150] with HELO=211.143.117.73. Mail from lufthansa@prombiofit.ru to lesha@sterling.ru.
Nov 24 13:51:51 mailmoa exim[19131]: 1PLCru-0004Up-Ec SMTP timeout while connected to umail.ru [195.34.32.101] after initial connection: Operation timed out
Nov 24 13:51:51 mailmoa exim[19013]: 1PLCru-0004Up-Ec == vam@dialup.ptt.ru R=dnslookup T=remote_smtp defer (60): Operation timed out: SMTP timeout while connected to umail.ru [195.34.32.101] after initial connection
Nov 24 13:51:51 mailmoa exim[19013]: 1PLCru-0004Up-Ec == vam@kon.ru R=dnslookup T=remote_smtp defer (60): Operation timed out: SMTP timeout while connected to umail.ru [195.34.32.101] after initial connection
Nov 24 13:51:51 mailmoa exim[21815]: 1PLCx5-0005fr-Dd <= <> R=1PLCru-0004Up-Ec U=mailnull P=local S=14140 from <> for murmansga@evol.ru
Nov 24 13:51:51 mailmoa exim[21593]: Delay 0s for [192.168.25.150] with HELO=187.115.148.61.static.gvt.net.br. Mail from nsk-nestra@inbox.ru to vasiljevasmtpirina.vasiljeva@bavaria-m.ru.
Nov 24 13:51:51 mailmoa exim[21744]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from perfomelal_ru@bezant.ru to libero@mail.iks.ru.
Nov 24 13:51:51 mailmoa exim[21309]: Delay 0s for [192.168.25.150] with HELO=219.150.227.111. Mail from master-ok@filmstudio.ru to lepet@land.ru.
Nov 24 13:51:51 mailmoa exim[21125]: Delay 0s for [192.168.25.150] with HELO=41.191.121.164. Mail from bendy@kurganmash.ru to vasiliy_mdd@inbox.ru.
Nov 24 13:51:51 mailmoa exim[21647]: Delay 0s for [192.168.25.150] with HELO=112.64.180.114. Mail from baltlogistic@tpl.ru to lianiadmin@rshu.ru.
Nov 24 13:51:51 mailmoa exim[20833]: 1PLCuC-00056i-SP rusautogaz.ru [193.232.158.145] Operation timed out
Nov 24 13:51:51 mailmoa exim[21765]: Delay 0s for [192.168.25.150] with HELO=202.107.200.93. Mail from farmtekct@afin.ru to vasv@wbd.ru.
Nov 24 13:51:51 mailmoa exim[21746]: Delay 0s for [192.168.25.150] with HELO=187.16.58.12. Mail from lita-studio@hdm.ru to vast@neon.ru.
Nov 24 13:51:51 mailmoa exim[21398]: Delay 0s for [192.168.25.150] with HELO=smtp.seapro.crs.org. Mail from dieffenb@conti.ru to flan@giglasnet.ru.
Nov 24 13:51:51 mailmoa exim[20118]: Delay 0s for [192.168.25.150] with HELO=200-168-87-17.dsl.telesp.net.br. Mail from avtolit@comptek.ru to vasia27@yandex.ru.
Nov 24 13:51:51 mailmoa exim[21602]: 1PLCw7-0005Gn-RW ** lena@simtel.ru R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<lena@simtel.ru>: host mail.simtel.ru [89.239.131.121]: 550 lena@simtel.ru unknown user account
Nov 24 13:51:52 mailmoa exim[21593]: Delay 0s for [192.168.25.150] with HELO=187.115.148.61.static.gvt.net.br. Mail from nsk-nestra@inbox.ru to vasiljevatanja@chaika.ru.
Nov 24 13:51:52 mailmoa exim[21602]: 1PLCw7-0005Gn-RW ** lena@smart.al.ru R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<lena@smart.al.ru>: host mx.centre.ru [194.186.208.5]: 554 5.7.1 <lena@smart.al.ru>: Relay access denied
Сегодня начали приходить на мой личный почтовик (как владельца почтового сервера) такого рода сообщения (уже 4 штуки)
[ SpamCop V4.6.1.006 ]
This message is brief for your comfort. Please use links below for details.
Email from 77.247.185.206 / 24 Nov 2010 04:42:01 +0300
http://www.spamcop.net/w3m?i=z532118384 ... d2d21edf9z
[ Offending message ]
Return-Path: <scandi_saxum@tiran.ru>
Delivered-To: x
Received: (qmail 70521 invoked by uid 0); 24 Nov 2010 04:41:10 +0300
Received: from unknown (HELO mailx.marsat.ru) (192.168.100.254)
by mail.mss with ESMTP; 24 Nov 2010 04:41:10 +0300
Received: (qmail 17269 invoked from network); 24 Nov 2010 04:42:01 +0300
Received: from mx.moalco.ru (77.247.185.206)
Полез в старые логи, что бы посмотреть события связанные с этим почтовиком.
Код: Выделить всё
mail# cat 24_maillog | grep scandi_saxum@tiran.ru
Nov 24 04:38:57 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochlit@svs.ru.
Nov 24 04:38:59 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochmash@land.ru.
Nov 24 04:39:00 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochmash@mt.ru.
Nov 24 04:39:01 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochmash@rmt.ru.
Nov 24 04:39:03 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochmash@te.net.ua.
Nov 24 04:39:04 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochmash@tochmash.ru.
Nov 24 04:39:06 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochmash@tula.net.
Nov 24 04:39:07 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochmash@tut.by.
Nov 24 04:39:08 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochmeh@tochmeh.ru.
Nov 24 04:39:09 mailmoa exim[35210]: Delay 0s for [192.168.25.150] with HELO=sym.gdsz.cncnet.net. Mail from scandi_saxum@tiran.ru to tochmet@bigfoot.com.
Продолжение:
Код: Выделить всё
Nov 24 04:41:06 mailmoa exim[35210]: [1/3] 1PL4Lw-00099u-KC <= scandi_saxum@tiran.ru H=(sym.gdsz.cncnet.net) [192.168.25.150] I=[192.168.25.151]:25 P=smtp S=45814 id=39A1BA1D9F754B31888819B6F79098CD@rjlba from <scandi_saxum@tiran.ru> for tochlit@svs.ru tochmash@land.ru tochmash@mt.ru tochmash@rmt.ru tochmash@te.net.ua tochmash@tochmash.ru tochmash@tula.net tochmash@tut.by tochmeh@tochmeh.ru tochmet@bigfoot.com tochpribor1@fpg.ru tochpribor@interline.ru tochremstanok@samaramail.ru tochtonado@i-set.ru tocusor@moldtelecom.md tod_dragnev@hotmail.com todak@alfacom.net todayko@ntv.ru todd_cooper@yahoo.com toddsf@gmail.com tode@tode.lv todek@solyd-ent.ru todemspb@hotmail.com todes2003@ua.fm todes@lin.com.ua todes@rol.ru todmak@bgnet.bg todorova@alfrus.ru todorovakalina@hotmail.com todorut@rdstm.ro todosiy16@mail.ru todplast@superfish.pl toe@riac.ru toefl@language.ru toek@dataforce.net toek@samtel.ru tofa@ma
Nov 24 04:41:23 mailmoa exim[37670]: 1PL4Lw-00099u-KC ** tod_dragnev@hotmail.com R=dnslookup T=remote_smtp: SMTP error from remote mail server after MAIL FROM:<scandi_saxum@tiran.ru> SIZE=47466: host mx3.hotmail.com [65.55.92.168]: 550 SC-001 Unfortunately, messages from 77.247.185.206 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.
Nov 24 04:41:24 mailmoa exim[37670]: 1PL4Lw-00099u-KC ** todemspb@hotmail.com R=dnslookup T=remote_smtp: SMTP error from remote mail server after MAIL FROM:<scandi_saxum@tiran.ru> SIZE=47466: host mx4.hotmail.com [65.55.92.184]: 550 SC-001 Unfortunately, messages from 77.247.185.206 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.
Nov 24 04:41:24 mailmoa exim[37670]: 1PL4Lw-00099u-KC ** todorovakalina@hotmail.com R=dnslookup T=remote_smtp: SMTP error from remote mail server after MAIL FROM:<scandi_saxum@tiran.ru> SIZE=47466: host mx4.hotmail.com [65.55.92.184]: 550 SC-001 Unfortunately, messages from 77.247.185.206 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.
Nov 24 04:41:28 mailmoa exim[37670]: 1PL4Lw-00099u-KC ** toe@riac.ru R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<toe@riac.ru>: host mx1.spaceweb.ru [77.222.41.36]: 550-Verification failed for <scandi_saxum@tiran.ru>\n550-Called: 74.125.79.27\n550-Sent: RCPT TO:<scandi_saxum@tiran.ru>\n550-Response: 550-5.1.1 The email account that you tried to reach does not exist. Please try\n550-550-5.1.1 double-checking the recipient's email address for typos or\n550-550-5.1.1 unnecessary spaces. Learn more at\n550-550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596 w5si16681727eeh.12\n550 Sender verify failed
Nov 24 04:41:31 mailmoa exim[37670]: 1PL4Lw-00099u-KC ** toir@tmn.ru R=dnslookup T=remote_smtp: SMTP error from remote mail server after MAIL FROM:<scandi_saxum@tiran.ru>: host relay.tmn.ru [212.76.160.49]: 553 5.3.0 Rejected - see http://www.uceprotect.net/en/rblcheck.php?ipr=77.247.185.206
Nov 24 04:41:37 mailmoa exim[37670]: 1PL4Lw-00099u-KC ** tochremstanok@samaramail.ru R=dnslookup T=remote_smtp: SMTP error from remote mail server after MAIL FROM:<scandi_saxum@tiran.ru> SIZE=47466: host mx.kraft-s.net [213.156.192.51]: 550-5.1.0 <scandi_saxum@tiran.ru>... Your MX replied "550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596 z7si16660597eeh.76"\n550 5.1.0 E-mail <scandi_saxum@tiran.ru> hasn't been confirmed by its MX "ASPMX.L.GOOGLE.COM"
Nov 24 04:41:37 mailmoa exim[37670]: 1PL4Lw-00099u-KC ** toiltechnica@chel.surnet.ru R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<toiltechnica@chel.surnet.ru>: host relay4.surnet.ru [195.54.2.30]: 550 5.1.7 <scandi_saxum@tiran.ru>: Sender address rejected: undeliverable address: host ASPMX.L.GOOGLE.COM[74.125.79.27] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596 y2si16667282eeh.61 (in reply to RCPT TO command)
Nov 24 04:42:29 mailmoa exim[39532]: 1PL4NR-000AHc-Sh <= <> R=1PL4Lw-00099u-KC U=mailnull P=local S=61920 from <> for scandi_saxum@tiran.ru
Nov 24 04:42:33 mailmoa exim[39533]: 1PL4NR-000AHc-Sh ** scandi_saxum@tiran.ru R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<scandi_saxum@tiran.ru>: host ASPMX.L.GOOGLE.COM [74.125.77.27]: 550-5.1.1 The email account that you tried to reach does not exist. Please try\n550-5.1.1 double-checking the recipient's email address for typos or\n550-5.1.1 unnecessary spaces. Learn more at\n550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596 p10si16658766eeh.74
Nov 24 04:44:04 mailmoa exim[41769]: 1PL4Oy-000Arh-UY <= <> R=1PL4Lw-00099u-KC U=mailnull P=local S=47518 from <> for scandi_saxum@tiran.ru
Nov 24 04:44:08 mailmoa exim[41770]: 1PL4Oy-000Arh-UY ** scandi_saxum@tiran.ru R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<scandi_saxum@tiran.ru>: host aspmx.l.google.com [74.125.77.27]: 550-5.1.1 The email account that you tried to reach does not exist. Please try\n550-5.1.1 double-checking the recipient's email address for typos or\n550-5.1.1 unnecessary spaces. Learn more at\n550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596 v51si16675959eeh.31
Вопрос - это так жестоко спамеры атакуют сервак? пока сам не понимаю что это
И я так понимаю что все это складывается в очередь. Ибо когда запускаю команду по очищению ожидающих сообщений, удаляется нереально большой список.
Прошу Вашей помощи в анализе проблемы.
с ув.
) )
