exim + спам

[garrotte]

Приветствую всех !:)
Достался тут сервак, настраивали давно и не известно кто, сам перечитал массу всего по теме, большинство на этом форуме, но не хватает опыта в работе с почтовиками что-бы четко идентифицировать проблему, то есть информации всосал кучу, а какую применять, хз
Суть следующая
В очереди exim копятся массы сообщений, то есть я когда на сервак впервые зашел, он почти лежал, кол-во процессов exim было порядка 1500, в очереди было 250 000 сообщений
большинство из них такого вида

Код: Выделить всё

srv /# exim -bp
13h  4.3K 1PusRV-000N2V-0g <info@cbn.com>
          harrison67@hotmail.com
          harrison74@hotmail.com
         .............................
        ....... еще пара десятков адресов в алфавитном порядке
         ..............................
          harshman2001@hotmail.com
          harshpuri@satyamonline.com

13h  4.3K 1PusRU-000N2Q-TH <info@cbn.com>
          harris9@hotmail.com
         .............................
        ....... еще пара десятков адресов в алфавитном порядке
         ..............................
          harrisamanda57@yahoo.com
          harrisamy@sbcglobal.net

пните в нужном направлении, если не затруднит
если еще какие-то данные нужны, скажите что показать, конфиг на мой взгляд вполне себе стандартный, вместе с DirectAdmin ставился.
IP сервера в нескольких блэклистах уже завис, ну это хрен с ним, сначала-бы настроить его нормально

Заранее благодарен за помощь

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[skeletor]

Посмотри в лог по ID письма (1PusRU-000N2Q-TH), обычно там пишется состояние (доставлено/недоставлено).

[garrotte]

skeletor пробил сейчас по одному из последних ID, ни одной доставки, сплошные defer'ы и грэйлисты
ну это в принципе логично, поскольку IP сервера уже в нескольких листах засветился

[skeletor]

Ну ведь на defer - пишется причина (вот её и посмотри). Что касается greylistов, то ничего ты не сделаешь.

[blade_007]

Если у топикстартера домен cbn.com, то может не все так плохо и это его ежедневная рассылка. Если нет - то у меня плохие новости, скорее похоже на openrelay (судя по количеству сообщений и домену реципиента).

[garrotte]

skeletor ну да, кто-то дает отлуп что превышен rate посылок, кто-то кричит что спамер
blade_007 нет этот домен не принадлежит серверу, более того он периодически меняется
не ребят, банлисты меня не особо пугают, я понимаю что это лишь следствие, поэтому и хочу вылечить изначальную проблему
а из листов потом можно что-то вручную поудалять, что-то по таймауту отвалится
как там у exim конфиг без комментов вывести ?))

[blade_007]

sudo grep -v "#" /etc/exim/exim.conf или где у вас конфиг лежит.

[garrotte]

blade_007 блин, извиняюсь, стормозил)

Код: Выделить всё

perl_startup = do '/etc/exim.pl'
system_filter = /etc/system_filter.exim
daemon_smtp_ports = 25 : 587

message_size_limit = 20M
smtp_receive_timeout = 5m
smtp_accept_max = 100
message_body_visible = 3000
print_topbitchars = true

helo_allow_chars = _

log_selector = \
  +delivery_size \
  +sender_on_delivery \
  +received_recipients \
  +received_sender \
  +smtp_confirmation \
  +subject \
  +smtp_incomplete_transaction \
  -dnslist_defer \
  -host_lookup_failed \
  -queue_run \
  -rejected_header \
  -retry_defer \
  -skip_delivery

syslog_duplication = false
no_message_logs

acl_smtp_rcpt = check_recipient
acl_smtp_data = check_message

addresslist whitelist_senders = lsearch;/etc/virtual/whitelist_senders
addresslist blacklist_senders = lsearch;/etc/virtual/blacklist_senders
domainlist blacklist_domains = lsearch;/etc/virtual/blacklist_domains
domainlist whitelist_domains = lsearch;/etc/virtual/whitelist_domains
domainlist local_domains = lsearch;/etc/virtual/domains
domainlist relay_domains = lsearch;/etc/virtual/domains : localhost
domainlist use_rbl_domains = lsearch;/etc/virtual/use_rbl_domains
hostlist auth_relay_hosts = *
hostlist bad_sender_hosts = lsearch;/etc/virtual/bad_sender_hosts
hostlist bad_sender_hosts_ip = net-lsearch;/etc/virtual/bad_sender_hosts
hostlist relay_hosts = net-lsearch;/etc/virtual/pophosts : 127.0.0.1
hostlist whitelist_hosts = lsearch;/etc/virtual/whitelist_hosts
hostlist whitelist_hosts_ip = net-lsearch;/etc/virtual/whitelist_hosts

allow_domain_literals = false
never_users = root
rfc1413_query_timeout = 0s
ignore_bounce_errors_after = 60m
timeout_frozen_after = 2d
smtp_enforce_sync = true

trusted_users = mail:majordomo:apache:diradmin

tls_certificate = /etc/exim.cert
tls_privatekey = /etc/exim.key

tls_advertise_hosts = *

begin acl

check_recipient:

  deny  domains       = +local_domains
        local_parts   = ^[.] : ^.*[@%!/|]

  deny  message       = "HELO/EHLO require by SMTP RFC"
        condition     = ${if eq{$sender_helo_name}{}{yes}{no}}

accept  authenticated = *

  deny  message       = "Your IP in HELO - access denied!"
        hosts         =  * : !+relay_from_hosts
        condition     = ${if eq{$sender_helo_name}{$sender_host_address}{true}{false}}

  deny  condition     = ${if eq{$sender_helo_name}{$interface_address}{yes}{no}}
        hosts         = !127.0.0.1 : !localhost : *
        message       = "main IP in your HELO! Access denied!"

  deny  condition     = ${if match{$sender_helo_name}{\N^\d+$\N}{yes}{no}}
        hosts         = !127.0.0.1 : !localhost : *
        message       = "can not be only number in HELO!"

  deny  message       = "your hostname is bad (adsl, poll, ppp & etc)."
        condition     = ${if match{$sender_host_name}{adsl|dialup|pool|peer|dhcp}{yes}{no}}

accept  hosts = +auth_relay_hosts
        condition = ${if eq {$interface_port}{587} {yes}{no}}
        endpass
        message = relay not permitted, authentication required
        authenticated = *

deny   message      =   "can not be only spaces in HELO"
        hosts      =   !127.0.0.1:!localhost:*
        condition   =   ${if match{$sender_helo_name} {\N^\s+$\N}{yes}{no}}

  deny  domains       = !+local_domains
        local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

  accept  hosts = :

  accept  sender_domains = +whitelist_domains

  accept  hosts = +whitelist_hosts
  accept  hosts = +whitelist_hosts_ip

  accept  senders = +whitelist_senders

  accept  local_parts = postmaster
          domains     = +local_domains

  accept  local_parts = abuse
          domains     = +local_domains

  accept  local_parts = hostmaster
          domains     =+local_domains

  deny message = Email blocked by LBL - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       sender_domains = +blacklist_domains

  deny message = Email blocked by BSHL - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       hosts = +bad_sender_hosts

  deny message = Email blocked by BSHL - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       hosts = +bad_sender_hosts_ip

  deny message = Email blocked by BSAL - to unblock see http://www.example.com/
        domains = use_rbl_domains
        deny senders = +blacklist_senders

require verify = sender

  deny message = Email blocked by SPAMHAUS - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       dnslists = sbl.spamhaus.org

  deny message = Email blocked by ORDB - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       dnslists = relays.ordb.org

  deny message = Email blocked by SORBS - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       dnslists = dnsbl.sorbs.net=127.0.0.5

  deny message = Email blocked by SPAMCOP - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = bl.spamcop.net

  deny message = Email blocked by NJABL - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = dnsbl.njabl.org

  deny message = Email blocked by CBL - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = cbl.abuseat.org

  deny message = Email blocked by SORBS - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = dnsbl.sorbs.net!=127.0.0.6

  deny message = Email blocked by SORBS - to unblock see http://www.example.com/
       domains =+use_rbl_domains
       dnslists = rhsbl.sorbs.net/$sender_address_domain

  accept  domains = +local_domains
          endpass
          message = "Unknown User"
          verify = recipient

  accept  domains = +relay_domains
          endpass
          verify=recipient

  accept  hosts = +relay_hosts
  accept  hosts = +auth_relay_hosts
          endpass
          message = authentication required
          authenticated = *
  deny    message = relay not permitted

  deny    message = relay not permitted

check_message:
  accept

begin authenticators

plain:
    driver = plaintext
    public_name = PLAIN
    server_condition = "${perl{smtpauth}}"
    server_set_id = $2

login:
    driver = plaintext
    public_name = LOGIN
    server_prompts = "Username:: : Password::"
    server_condition = "${perl{smtpauth}}"
    server_set_id = $1

begin routers

spam_warning:
  driver = redirect
  domains = lsearch;/etc/virtual/domainowners
  condition = ${if and { {def:header_X-Spam-Flag:} { eq {$h_X-Spam-Flag:} {YES} } } {1}{0}}
  data = spam@istokauto.ru

lookuphost:
  driver = dnslookup
  domains = ! +local_domains
  ignore_target_hosts = 127.0.0.0/8
  condition = "${perl{check_limits}}"
  transport = remote_smtp
  no_more

spamcheck_director:
  driver = accept
  condition = "${if and { \
                        {!def:h_X-Spam-Flag:} \
                        {!eq {$received_protocol}{spam-scanned}} \
                        {!eq {$received_protocol}{local}} \
                        {exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \
                } {1}{0}}"
  retry_use_local_part
  transport = spamcheck
  no_verify

majordomo_aliases:
  driver = redirect
  allow_defer
  allow_fail
  data = ${if exists{/etc/virtual/${domain}/majordomo/list.aliases}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/majordomo/list.aliases}}}}
  domains = lsearch;/etc/virtual/domainowners
  file_transport = address_file
  group = daemon
  pipe_transport = majordomo_pipe
  retry_use_local_part
  no_rewrite
  user = majordomo

majordomo_private:
  driver = redirect
  allow_defer
  allow_fail
  condition = "${if or { {eq {$received_protocol} {local}} \
                         {eq {$received_protocol} {spam-scanned}} } {true} {false} }"
  data = ${if exists{/etc/virtual/${domain}/majordomo/private.aliases}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/majordomo/private.aliases}}}}
  domains = lsearch;/etc/virtual/domainowners
  file_transport = address_file
  group = daemon
  pipe_transport = majordomo_pipe
  retry_use_local_part
  user = majordomo

domain_filter:
  driver = redirect
  allow_filter
  no_check_local_user
  condition = "${if exists{/etc/virtual/${domain}/filter}{yes}{no}}"
  user = "mail"
  file = /etc/virtual/${domain}/filter
  file_transport = address_file
  pipe_transport = virtual_address_pipe
  retry_use_local_part
  no_verify

uservacation:
   driver = accept
   condition = ${lookup{$local_part} lsearch {/etc/virtual/${domain}/vacation.conf}{yes}{no}}
   require_files = /etc/virtual/${domain}/reply/${local_part}.msg
   transport = uservacation
   unseen

userautoreply:
   driver = accept
   condition = ${lookup{$local_part} lsearch {/etc/virtual/${domain}/autoresponder.conf}{yes}{no}}
   require_files = /etc/virtual/${domain}/reply/${local_part}.msg
   transport = userautoreply
   unseen

virtual_aliases_nostar:
  driver = redirect
  allow_defer
  allow_fail
  data = ${if exists{/etc/virtual/${domain}/aliases}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/aliases}}}}
  file_transport = address_file
  group = mail
  pipe_transport = virtual_address_pipe
  retry_use_local_part
  unseen

virtual_user:
  driver = accept
  condition = ${if eq {}{${if exists{/etc/virtual/${domain}/passwd}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/passwd}}}}}{no}{yes}}
  domains = lsearch;/etc/virtual/domainowners
  group = mail
  retry_use_local_part
  transport = virtual_localdelivery

virtual_aliases:
  driver = redirect
  allow_defer
  allow_fail
  data = ${if exists{/etc/virtual/$domain/aliases}{${lookup{$local_part}lsearch*{/etc/virtual/$domain/aliases}}}}
  file_transport = address_file
  group = mail
  pipe_transport = virtual_address_pipe
  retry_use_local_part

userforward:
  driver = redirect
  allow_filter
  check_ancestor
  check_local_user
  no_expn
  file = $home/.forward
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply
  no_verify

system_aliases:
  driver = redirect
  allow_defer
  allow_fail
  data = ${lookup{$local_part}lsearch{/etc/aliases}}
  file_transport = address_file
  pipe_transport = address_pipe
  retry_use_local_part

localuser:
  driver = accept
  check_local_user
  condition = "${if eq {$domain} {$primary_hostname} {yes} {no}}"
  transport = local_delivery

begin transports

spamcheck:
  driver = pipe
  batch_max = 100
  command = /usr/sbin/exim -oMr spam-scanned -bS
  current_directory = "/tmp"
  group = mail
  home_directory = "/tmp"
  log_output
  message_prefix =
  message_suffix =
  return_fail_output
  no_return_path_add
  transport_filter = /usr/bin/spamc -u ${lookup{$domain}lsearch*{/etc/virtual/domainowners}{$value}}
  use_bsmtp
  user = mail


majordomo_pipe:
  driver = pipe
  group = daemon
  return_fail_output
  user = majordomo

local_delivery:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  file = /var/mail/$local_part
  group = mail
  mode = 0660
  return_path_add
  user = ${local_part}

virtual_localdelivery:
  driver = appendfile
  create_directory
  delivery_date_add
  directory_mode = 700
  envelope_to_add
  file = /var/spool/virtual/${domain}/${local_part}
  group = mail
  mode = 660
  return_path_add
  user = "${lookup{$domain}lsearch*{/etc/virtual/domainowners}{$value}}"
  quota = ${if exists{/etc/virtual/${domain}/quota}{${lookup{$local_part}lsearch*{/etc/virtual/${domain}/quota}{$value}{0}}}{0}}

uservacation:
  driver = autoreply
  file = /etc/virtual/${domain}/reply/${local_part}.msg
  from = "${local_part}@${domain}"
  log = /etc/virtual/${domain}/reply/${local_part}.log
  no_return_message
  subject = "${if def:h_Subject: {Autoreply: ${quote:${escape:$h_Subject:}}} {I am on vacation}}"
  text = "\
        ------                                                           ------\n\n\
        This message was automatically generated by email software\n\
        The delivery of your message has not been affected.\n\n\
        ------                                                           ------\n\n"
  to = "${sender_address}"
  user = mail

userautoreply:
  driver = autoreply
  bcc = ${lookup{${local_part}} lsearch {/etc/virtual/${domain}/autoresponder.conf}{$value}}
  file = /etc/virtual/${domain}/reply/${local_part}.msg
  from = "${local_part}@${domain}"
  log = /etc/virtual/${domain}/reply/${local_part}.log
  no_return_message
  subject = "${if def:h_Subject: {Autoreply: ${quote:${escape:$h_Subject:}}} {Autoreply Message}}"
  to = "${sender_address}"
  user = mail

remote_smtp:
  driver = smtp

address_pipe:
  driver = pipe
  return_output

virtual_address_pipe:
  driver = pipe
  group = nobody
  return_output
  user = "${lookup{$domain}lsearch* {/etc/virtual/domainowners}{$value}}"

address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add

address_reply:
  driver = autoreply

begin retry

[Alex Keda]

особо не приглядывался - но нормальный конфиг.
ищщите откуда письма взялись что в очереди висят

[garrotte]

Alex Keda ага, вот пытаюсь что-то нарыть, пока правда без особых успехов
я в принципе проверял, то есть коннектился с удаленной машины телнетов на 25 порт, он не дает отсылать письма без авторизации, тогда закрались первые подозрения что в системе живет дятел

[garrotte]

Alex Keda, кстати, а возможен вариант что это у кого-то из легальных юзеров на машине бот сидит, или искать нужно именно в недрах сервака ?

[blade_007]

Сделайте sudo /usr/sbin/exim -Mvh Message-ID и посмотрите от кого отправляется данная почта.

[garrotte]

blade_007 ага, спасибо воспользуюсь обязательно