Подскажите, плз, как поймать и отыскать "дыру" в системе.
Конфиг sendmail:
Код: Выделить всё
divert(-1)
divert(0)
VERSIONID(`$FreeBSD: src/etc/sendmail/freebsd.mc,v 1.37.2.2.2.1 2010/06/14 02:09:06 kensmith Exp $')
OSTYPE(freebsd6)
DOMAIN(generic)
FEATURE(access_db, `hash -o -T<TMPF> /etc/mail/access')
FEATURE(blacklist_recipients)
FEATURE(local_lmtp)
FEATURE(mailertable, `hash -o /etc/mail/mailertable')
FEATURE(virtusertable, `hash -o /etc/mail/virtusertable')
FEATURE(dnsbl, `bl.spamcop.net.')dnl
FEATURE(dnsbl, `zen.spamhaus.org.')dnl
define(`confCW_FILE', `-o /etc/mail/local-host-names')dnl
DAEMON_OPTIONS(`Name=IPv4, Family=inet')dnl
dnl define(`confLOG_LEVEL', `9')dnl
define(`confMAX_MESSAGE_SIZE', `107374182400')dnl
define(`confQUEUE_LA', `5')dnl
define(`confREFUSE_LA', `20')dnl
define(`confBIND_OPTS', `WorkAroundBrokenAAAA')dnl
define(`confNO_RCPT_ACTION', `add-to-undisclosed')dnl
define(`confPRIVACY_FLAGS', `authwarnings,noexpn,novrfy')dnl
define(`ALIAS_FILE', `/etc/mail/aliases')dnl
define(`confTO_CONNECT', `30s')dnl
define(`confTO_IDENT', `0')dnl
define(`confTO_COMMAND', `30s')dnl
define(`confTO_DATABLOCK', `2m')dnl
define(`confTO_STARTTLS', `2m')dnl
define(`confMAX_DAEMON_CHILDREN', `30')dnl
define(`CONNECTION_RATE_THROTTLE', `4')dnl
FEATURE(`use_cw_file')dnl
FEATURE(`genericstable', `hash -o /etc/mail/genericstable')dnl
GENERICS_DOMAIN_FILE( `/etc/mail/generics-domains')dnl
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
TRUST_AUTH_MECH( `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confSERVER_CERT', `/etc/mail/ssl/certs/sendmail.crt')dnl
define(`confSERVER_KEY', `/etc/mail/ssl/private/sendmail.key')dnl
define(`confCACERT', `/etc/mail/ssl/certs/sendmail.crt')dnl
define(`confCACERT_PATH', `/etc/mail/ssl/certs/CA')dnl
FEATURE(`delay_checks')dnl
FEATURE(`local_procmail')dnl
INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamass-milter.sock, F=T, T=C:15m;S:4m;R:4m;E:10m')dnl
define(`confTO_IDENT', `0')dnl
INPUT_MAIL_FILTER(`greylist',`S=local:/var/milter-greylist/milter-greylist.sock, F=, T=S:1m;R:1m')dnl
define(`confMILTER_MACROS_CONNECT', `j, {if_addr}')dnl
define(`confMILTER_MACROS_HELO', `{verify}, {cert_subject}')dnl
define(`confMILTER_MACROS_ENVFROM', `i, {auth_authen}')dnl
define(`confMILTER_MACROS_ENVRCPT', `{greylist}')dnl
MAILER(procmail)dnl
MAILER(local)
MAILER(smtp)Пример заголовков писем:
V8
T1351079203
K0
N0
P1501821
MService unavailable
Fs
$_impex.sc2000.net [64.88.221.38] (may be forged)
$rESMTP
$sUser
${daemon_flags}
${if_addr}5.9.87.184
S<jennifer@m2.dominomail.net>
MDeferred: Connection refused by etd.on.ca.ru.
rRFC822; info@etd.on.ca.ru
RPFD:<info@etd.on.ca>
MDeferred: 451 4.7.1 Please try again later
rRFC822; info@eurojuris.net
RPFD:<info@eurojuris.net>
MDeferred: 452 4.2.2 <info@evdomi.gr> Mailbox has exceeded the limit
rRFC822; info@evdomi.gr
RPFD:<info@evdomi.gr>
MDeferred: Operation timed out with mail.eventcentre.ca.
rRFC822; info@eventcentre.ca
RPFD:<info@eventcentre.ca>
MDeferred: Connection refused by exoticreplicacars.com.
rRFC822; info@exoticreplicacars.com
RPFD:<info@exoticreplicacars.com>
MDeferred: 451 Greylisted, please try again in 60 seconds
rRFC822; info@explainerdc.com.gh
RPFD:<info@explainerdc.com.gh>
rRFC822; info@faematoronto.com
RPFD:<info@faematoronto.com>
rRFC822; info@fafnmail.com
RPFD:<info@fafnmail.com>
rRFC822; info@fairwaychalets.com
RPFD:<info@fairwaychalets.com>
rRFC822; info@fakhrolaw.com
RPFD:<info@fakhrolaw.com>
rRFC822; info@fallbrooktech.com
RPFD:<info@fallbrooktech.com>
rRFC822; info@familylawnb.ca
RPFD:<info@familylawnb.ca>
rRFC822; info@familypastimes.com
RPFD:<info@familypastimes.com>
rRFC822; info@familyserviceregina.com
RPFD:<info@familyserviceregina.com>
rRFC822; info@fantasysports.ca
RPFD:<info@fantasysports.ca>
rRFC822; info@farmfolkcityfolk.ca
RPFD:<info@farmfolkcityfolk.ca>
rRFC822; info@farsnews.ir
RPFD:<info@farsnews.ir>
rRFC822; info@fashionnews.gr
RPFD:<info@fashionnews.gr>
rRFC822; info@fatherhood.org
RPFD:<info@fatherhood.org>
rRFC822; info@fauxwoodbeams.com
RPFD:<info@fauxwoodbeams.com>
rRFC822; info@faw.co.uk
RPFD:<info@faw.co.uk>
rRFC822; info@fcm.ca
RPFD:<info@fcm.ca>
rRFC822; info@feederassoc.com
RPFD:<info@feederassoc.com>
rRFC822; info@femaide.ca
RPFD:<info@femaide.ca>
rRFC822; info@fentonwebdesignfirm.com
RPFD:<info@fentonwebdesignfirm.com>
rRFC822; info@festivalacadien.ca
RPFD:<info@festivalacadien.ca>
rRFC822; info@festivalsandeventsontario.ca
RPFD:<info@festivalsandeventsontario.ca>
rRFC822; info@etasa.gr
RPFD:<info@etasa.gr>
H?P?Return-Path: <Ѓg>
H??Received: from User (impex.sc2000.net [64.88.221.38] (may be forged))
(authenticated bits=0)
by mayer-clients.ru (8.14.5/8.14.5) with ESMTP id q9OBkgeS017783;
Wed, 24 Oct 2012 15:46:43 +0400 (MSK)
(envelope-from jennifer@m2.dominomail.net)
H?M?Message-Id: <201210241146.q9OBkgeS017783@mayer-clients.ru>
H??Reply-To: <info_officeofthepres@myway.com>
H??From: "COMPENSATION OFFICE"<jennifer@m2.dominomail.net>
H??Subject: *****SPAM***** TO YOUR ATTENTION:VICTIMS?
H??Date: Wed, 24 Oct 2012 06:47:25 -0500
H??MIME-Version: 1.0
H??Content-Type: text/plain;
charset="Windows-1251"
H??Content-Transfer-Encoding: 7bit
H??X-Priority: 3
H??X-MSMail-Priority: Normal
H??X-Mailer: Microsoft Outlook Express 6.00.2600.0000
H??X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
H??To: undisclosed-recipients:;
H??X-Spam-Flag: YES
H??X-Spam-Status: Yes, score=43.6 required=5.0 tests=ADVANCE_FEE_2_NEW_FORM,
ADVANCE_FEE_3_NEW,ADVANCE_FEE_3_NEW_FORM,ADVANCE_FEE_4_NEW,
ADVANCE_FEE_4_NEW_FORM,AXB_XMAILER_MIMEOLE_OL_024C2,FILL_THIS_FORM,
FILL_THIS_FORM_LOAN,FILL_THIS_FORM_LONG,FORGED_MUA_OUTLOOK,FORM_FRAUD_5,
FROM_MISSPACED,FROM_MISSP_EH_MATCH,FROM_MISSP_MSFT,FROM_MISSP_NO_TO,
FROM_MISSP_USER,FSL_CTYPE_WIN1251,FSL_MISSP_REPLYTO,FSL_NEW_HELO_USER,
FSL_RCVD_USER,FSL_UA,FSL_XM_419,HK_SCAM_N8,MISSING_HEADERS,MISSING_MID,
NSL_RCVD_FROM_USER,REPLYTO_WITHOUT_TO_CC,SUBJ_ALL_CAPS,TO_NO_BRKTS_FROM_MSSP,
T_FRT_BELOW2,UNPARSEABLE_RELAY autolearn=disabled version=3.3.2
H??X-Spam-Report:
* 1.8 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
* 1.5 FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam
* 3.1 NSL_RCVD_FROM_USER Received from User
* 0.0 FSL_RCVD_USER FSL_RCVD_USER
* 1.6 SUBJ_ALL_CAPS Subject is all capitals
* 1.2 MISSING_HEADERS Missing To: header
* 0.4 HK_SCAM_N8 BODY: HK_SCAM_N8
* 0.0 T_FRT_BELOW2 BODY: ReplaceTags: Below (2)
* 1.1 FSL_UA FSL_UA
* 0.1 MISSING_MID Missing Message-Id: header
* 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
* 4.2 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
* 0.0 FROM_MISSP_NO_TO From misspaced, To missing
* 0.0 FSL_NEW_HELO_USER FSL_NEW_HELO_USER
* 2.2 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2
* 2.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to
* 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
* 1.8 FROM_MISSP_USER From misspaced, from "User"
* 1.9 FROM_MISSPACED From: missing whitespace
* 0.0 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
* 0.4 FROM_MISSP_EH_MATCH From misspaced, matches envelope
* 1.5 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
* 2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
* 3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
* 0.0 FILL_THIS_FORM Fill in a form with personal information
* 3.5 FILL_THIS_FORM_LONG Fill in a form with personal information
* 2.2 ADVANCE_FEE_3_NEW_FORM Advance Fee fraud and a form
* 1.9 ADVANCE_FEE_4_NEW_FORM Advance Fee fraud and a form
* 2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
* 0.0 ADVANCE_FEE_2_NEW_FORM Advance Fee fraud and a form
* 0.5 FORM_FRAUD_5 Fill a form and many fraud phrases
H??X-Spam-Level: *******************************************
H??X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mayer-clients.ru
H??X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (mayer-clients.ru [5.9.87.184]); Wed, 24 Oct 2012 15:47:30 +0400 (MSK)
.
Куда смотреть еще?
Регулярно вижу в очереди сотни процессов smtp
