Postfix - interpretacja logów

Post autor: **LordRuthwen** » 07 lutego 2010, 20:57

Witam.
Odkąd uruchomiłem postfixa na 587 porcie zaczęły mi się w logach pojawiać dziwne rzeczy, prosiłbym o pomoc w interpretacji logów, jeszcze jak to:

Kod: Zaznacz cały

Feb  7 19:45:50 host postfix/smtpd[11606]: connect from unknown[58.140.75.79]
Feb  7 19:45:51 host postfix/smtpd[11606]: NOQUEUE: reject: RCPT from unknown[58.140.75.79]: 554 5.7.1 Service unavailable; Client host [58.140.75.79] blocked using dul.dnsbl.sorbs.net; Dynamic IP Addresses See: [url]http://www.sorbs.net/lookup.shtml?58.140.75.79;[/url] from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<UJTLHZWQU>
Feb  7 19:45:51 host postfix/smtpd[11606]: lost connection after DATA (0 bytes) from unknown[58.140.75.79]
Feb  7 19:45:51 host postfix/smtpd[11606]: disconnect from unknown[58.140.75.79]
Feb  7 19:49:11 host postfix/anvil[11608]: statistics: max connection rate 1/60s for (smtp:58.140.75.79) at Feb  7 19:45:50
Feb  7 19:49:11 host postfix/anvil[11608]: statistics: max connection count 1 for (smtp:58.140.75.79) at Feb  7 19:45:50
Feb  7 19:49:11 host postfix/anvil[11608]: statistics: max cache size 1 at Feb  7 19:45:50

Rozumiem, że zostało odrzucone, tak te poniżej mnie delikatnie przestraszyły, bo to wygląda tak, jakby ktoś wysyłał wiadomości z użytkownika www-data, co jest o tle ciekawe, że uwierzytelnienie kont jest poprzez hasło w bazie danych, i użytkownika www-data tam nie ma.

Kod: Zaznacz cały

Feb  7 20:02:39 host postfix/cleanup[12034]: 07E7923A3: message-id=<[email protected]>
Feb  7 20:02:39 host postfix/qmgr[846]: 07E7923A3: from=<[email protected]>, size=1139, nrcpt=1 (queue active)
Feb  7 20:02:39 host postfix/smtp[12041]: 07E7923A3: host gmail-smtp-in.l.google.com[209.85.220.57] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450 4.2.1 visit [url]http://mail.google.com/support/bin/answer.py?answer=6592[/url] 25si9201356fxm.11 (in reply to RCPT TO command)
Feb  7 20:02:40 host postfix/smtp[12041]: 07E7923A3: to=<[email protected]>, relay=alt1.gmail-smtp-in.l.google.com[209.85.135.114]:25, delay=1.1, delays=0.15/0.04/0.83/0.06, dsn=4.2.1, status=deferred (host alt1.gmail-smtp-in.l.google.com[209.85.135.114] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450 4.2.1 visit [url]http://mail.google.com/support/bin/answer.py?answer=6592[/url] 23si17500632mun.38 (in reply to RCPT TO command))
Feb  7 20:11:02 host postfix/qmgr[846]: 07E7923A3: from=<[email protected]>, size=1139, nrcpt=1 (queue active)
Feb  7 20:11:03 host postfix/smtp[12287]: 07E7923A3: host alt1.gmail-smtp-in.l.google.com[209.85.135.27] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450 4.2.1 visit [url]http://mail.google.com/support/bin/answer.py?answer=6592[/url] t10si17457951muh.11 (in reply to RCPT TO command)
Feb  7 20:11:04 host postfix/smtp[12287]: 07E7923A3: to=<[email protected]>, relay=alt2.gmail-smtp-in.l.google.com[209.85.222.24]:25, delay=505, delays=504/0.09/1.5/0.21, dsn=4.2.1, status=deferred (host alt2.gmail-smtp-in.l.google.com[209.85.222.24] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450 4.2.1 visit [url]http://mail.google.com/support/bin/answer.py?answer=6592[/url] 32si8583526pzk.96 (in reply to RCPT TO command))
Feb  7 20:21:02 host postfix/qmgr[846]: 07E7923A3: from=<[email protected]>, size=1139, nrcpt=1 (queue active)
Feb  7 20:21:03 host postfix/smtp[12529]: 07E7923A3: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[209.85.220.33]:25, delay=1104, delays=1103/0.09/0.15/0.78, dsn=2.0.0, status=sent (250 2.0.0 OK 1265570537 21si4581990fxm.27)
Feb  7 20:21:03 host postfix/qmgr[846]: 07E7923A3: removed

pegazior · Post autor: **pegazior** » 08 lutego 2010, 06:33

A skąd to [email protected] - http://www.bosasg.org.pl/ - Brygada Operacyjno Szturmowa ASG?
SpamAssassin zainstalowany?
Sprawdzałeć to http://www.sorbs.net/lookup.shtml?58.140.75.79?

Post autor: **LordRuthwen** » 08 lutego 2010, 07:11

Bo na tej maszynie zainstalowane jest kilka for z tematyki ASG, stąd.
Spamassassin instalowany był, greylisting też. Sprawdziłem, ale dalej nie wiem w jaki sposób on to wysyła.

pegazior · Post autor: **pegazior** » 08 lutego 2010, 20:47

Sprawdź konfigrację postfixa - może tu coś znajdziesz?
http://www.lemat.priv.pl/index.php?lang ... &pg_id=136

Post autor: **LordRuthwen** » 10 lutego 2010, 09:09

No właśnie problem w tym, że jak ustawiłem jak jest w tym howto to mi się nie chciał uruchomić proces:

Kod: Zaznacz cały

fatal: /etc/postfix/master.cf: line 13: bad transport type: smtpd_sasl_auth_enable=yes

I tak każda linia z -o ...
Problem z tamtymi rozwiązałem poprzez iptables, wiem, że to nie jest rozwiązanie docelowe, dlatego ma ktoś jakieś sugestie co z tym zrobić?

//edit:
już znalazłem - spacje i znaki końca linii, ale dalej mam tego typu logi jak w pierwszym moim poście