Mam problem z moim serwerem poczty. Konfiguracja dosyć standardowa postfix, clamav, spammasasin, postgrey
Partycje /var mam stosunkowo małą 2GB. Zaczęło się się od tego, że nagle pliki logów zapychały mi partycje.
Ich tempo przyrostu jest zatrważające jak na pliki logów - 16MB na godzinę. Zarówno mail.log, mail.warn.
Wewnątrz ich jest masa jakiegoś syfu:
mail.log w ciągu sekundy:
Kod: Zaznacz cały
May 21 10:56:55 vbb postgrey: action=greylist, reason=new, client_name=unknown, client_address=84.79.199.100, [email protected], recipient=smtppa
May 21 10:56:55 vbb postfix/smtpd[25767]: NOQUEUE: reject: RCPT from unknown[84.79.199.100]: 554 5.7.1 <[email protected]>: Recipient address rejected: Access den
May 21 10:56:55 vbb postgrey: action=greylist, reason=new, client_name=unknown, client_address=84.79.199.100, [email protected], recipient=rino@b
May 21 10:56:55 vbb postfix/smtpd[25767]: NOQUEUE: reject: RCPT from unknown[84.79.199.100]: 554 5.7.1 <[email protected]>: Recipient address rejected: Access denied; fr
May 21 10:56:55 vbb postfix/smtpd[25767]: lost connection after DATA (0 bytes) from unknown[84.79.199.100]
May 21 10:56:55 vbb postfix/smtpd[25767]: disconnect from unknown[84.79.199.100]
May 21 10:56:55 vbb postgrey: action=greylist, reason=new, client_name=unknown, client_address=190.84.2.70, [email protected], [email protected]
May 21 10:56:55 vbb postfix/smtpd[26837]: NOQUEUE: reject: RCPT from unknown[190.84.2.70]: 554 5.7.1 <[email protected]>: Recipient address rejected: Access denied; fr
May 21 10:56:55 vbb postgrey: action=greylist, reason=new, client_name=unknown, client_address=190.84.2.70, [email protected], recipient=rt@era-security.
May 21 10:56:55 vbb postfix/smtpd[26837]: NOQUEUE: reject: RCPT from unknown[190.84.2.70]: 554 5.7.1 <[email protected]>: Recipient address rejected: Access denied; f
May 21 10:56:55 vbb postgrey: action=pass, reason=recipient whitelist, client_name=unknown, client_address=188.92.192.176, [email protected], recipient
May 21 10:56:55 vbb postfix/smtpd[27055]: NOQUEUE: reject: RCPT from unknown[188.92.192.176]: 554 5.7.1 <[email protected]>: Recipient address rejected: Access den
May 21 10:56:55 vbb postgrey: action=greylist, reason=new, client_name=unknown, client_address=118.96.134.140, [email protected], recipient=confezi
May 21 10:56:55 vbb postfix/smtpd[26839]: NOQUEUE: reject: RCPT from unknown[118.96.134.140]: 554 5.7.1 <[email protected]>: Recipient address rejected: Acce
May 21 10:56:55 vbb postfix/smtpd[26837]: lost connection after DATA (0 bytes) from unknown[190.84.2.70]
May 21 10:56:55 vbb postfix/smtpd[26837]: disconnect from unknown[190.84.2.70]
May 21 10:56:55 vbb postfix/smtpd[27055]: lost connection after DATA (0 bytes) from unknown[188.92.192.176]
Kod: Zaznacz cały
May 21 11:06:00 vbb postfix/smtpd[27741]: warning: 188.231.175.195: hostname 188.231.175.195.freenet.com.ua verification failed: Name or service not known
May 21 11:06:01 vbb postfix/smtpd[26046]: warning: 118.96.8.118: hostname 118.static.118-96-8.astinet.telkom.net.id verification failed: Name or service not known
May 21 11:06:02 vbb postfix/smtpd[27149]: warning: 188.92.192.176: hostname pppoe-192-176.prtcom.ru verification failed: Name or service not known
May 21 11:06:04 vbb postfix/smtpd[27037]: warning: 201.250.24.241: hostname 201-250-24-241.speedy.com.ar verification failed: Name or service not known
May 21 11:06:04 vbb postfix/smtpd[27742]: warning: 89.121.201.110: hostname adsl89-121-201-110.romtelecom.net verification failed: Name or service not known
May 21 11:06:09 vbb postfix/smtpd[27035]: warning: 122.160.245.100: hostname ABTS-North-Static-100.245.160.122.airtelbroadband.in verification failed: Name or service n
May 21 11:06:10 vbb postfix/smtpd[27739]: warning: 81.196.162.66: hostname 81.196.162.66.constanta.rdsnet.ro verification failed: Name or service not known
May 21 11:06:14 vbb postfix/smtpd[27149]: warning: 188.92.192.176: hostname pppoe-192-176.prtcom.ru verification failed: Name or service not known
May 21 11:06:28 vbb postfix/smtpd[27742]: warning: 82.160.142.237: address not listed for hostname 142-237.aerostrada.pl
May 21 11:06:34 vbb postfix/smtpd[27155]: warning: 196.46.252.82: hostname 252.46.196-wimax.slc.dz verification failed: Name or service not known
May 21 11:06:45 vbb postfix/smtpd[27151]: warning: 124.107.88.107: hostname 124.107.88.107.pldt.net verification failed: Name or service not known
May 21 11:06:47 vbb postfix/smtpd[27739]: warning: 124.107.88.107: hostname 124.107.88.107.pldt.net verification failed: Name or service not known
May 21 11:06:48 vbb postfix/smtpd[27148]: warning: 195.149.118.196: hostname 196-tami.tami.pl verification failed: Name or service not known
May 21 11:06:51 vbb postfix/smtpd[27037]: warning: 190.84.2.70: hostname Dynamic-IP-19084270.cable.net.co verification failed: Name or service not known
May 21 11:06:57 vbb postfix/smtpd[26048]: warning: 190.84.2.70: hostname Dynamic-IP-19084270.cable.net.co verification failed: Name or service not known
May 21 11:06:57 vbb postfix/smtpd[27743]: warning: 124.107.88.107: hostname 124.107.88.107.pldt.net verification failed: Name or service not known
Nie ma w logach żadnej powtarzalności. Prawie ciągle inne domeny i inne adresy pojawiają się w logach.
Nie wiem, czy dobrze interpretuje logi ale mam wrażenie, że sytuacja wygląda następująco:
mój serwer pocztowy został wciągnięty na jakąś dziwną listę. Z tego powodu jakieś roboty próbują masowo wysyłać z mojego serwera maile z nadzieją, że serwer poczty wychodzącej nie wymaga autoryzacji, nie jest tak jednak więc są one blokowane ale ruch i logi są generowane.
Czy to prawdopodobne?
Proszę o opinie i porady.
