主页 / server / 问题 / 701199
Accepted
Jérôme
Asked: 2015-06-25 00:02:07 +0800 CST

后缀日志显示狡猾的连接

  • 772

我有来自 OpenBL 列表中的 IP 的常规连接，我想了解它的作用。

如果它在身份验证阶段失败，我会收到身份验证错误（他会被 fail2ban 禁止）。

如果它成功发送消息，我会看到有关正在传递的消息的日志行。

在做任何事情之前，我想了解发生了什么。

这是双重详细模式（-v -v）的日志：

Jun 19 16:27:21 localhost postfix/smtpd[12172]: name_mask: all
Jun 19 16:27:21 localhost postfix/smtpd[12172]: inet_addr_local: configured 2 IPv4 addresses
Jun 19 16:27:21 localhost postfix/smtpd[12172]: inet_addr_local: configured 3 IPv6 addresses
Jun 19 16:27:21 localhost postfix/smtpd[12172]: process generation: 730 (730)
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: mynetworks ~? debug_peer_list
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: mynetworks ~? fast_flush_domains
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: mynetworks ~? mynetworks
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: relay_domains ~? debug_peer_list
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: relay_domains ~? fast_flush_domains
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: relay_domains ~? mynetworks
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: relay_domains ~? permit_mx_backup_networks
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: relay_domains ~? qmqpd_authorized_clients
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: relay_domains ~? smtpd_access_maps
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: relay_domains: no match
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: permit_mx_backup_networks ~? debug_peer_list
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: permit_mx_backup_networks ~? fast_flush_domains
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: permit_mx_backup_networks ~? mynetworks
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: permit_mx_backup_networks ~? permit_mx_backup_networks
Jun 19 16:27:21 localhost postfix/smtpd[12172]: connect to subsystem private/proxymap
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr request = open
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr table = unix:passwd.byname
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr flags = 0
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/proxymap socket: wanted attribute: status
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: status
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 0
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/proxymap socket: wanted attribute: flags
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: flags
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 16
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/proxymap socket: wanted attribute: (list terminator)
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: (end)
Jun 19 16:27:21 localhost postfix/smtpd[12172]: dict_proxy_open: connect to map=unix:passwd.byname status=0 server_flags=fixed
Jun 19 16:27:21 localhost postfix/smtpd[12172]: dict_open: proxy:unix:passwd.byname
Jun 19 16:27:21 localhost postfix/smtpd[12172]: Compiled against Berkeley DB: 5.1.29?
Jun 19 16:27:21 localhost postfix/smtpd[12172]: Run-time linked against Berkeley DB: 5.1.29?
Jun 19 16:27:21 localhost postfix/smtpd[12172]: dict_open: hash:/etc/aliases
Jun 19 16:27:21 localhost postfix/smtpd[12172]: Compiled against Berkeley DB: 5.1.29?
Jun 19 16:27:21 localhost postfix/smtpd[12172]: Run-time linked against Berkeley DB: 5.1.29?
Jun 19 16:27:21 localhost postfix/smtpd[12172]: dict_open: hash:/var/lib/mailman/data/aliases
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr request = open
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr table = pgsql:/etc/postfix/virtual-alias-maps.cf
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr flags = 0
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/proxymap socket: wanted attribute: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/proxymap socket: wanted attribute: flags 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: flags 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 16 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/proxymap socket: wanted attribute: (list terminator) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: (end) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: dict_proxy_open: connect to map=pgsql:/etc/postfix/virtual-alias-maps.cf status=0 server_flags=fixed 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: dict_open: proxy:pgsql:/etc/postfix/virtual-alias-maps.cf 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: Compiled against Berkeley DB: 5.1.29? 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: Run-time linked against Berkeley DB: 5.1.29? 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: dict_open: hash:/var/lib/mailman/data/virtual-mailman 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr request = open 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr table = pgsql:/etc/postfix/virtual-mailbox-maps.cf 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr flags = 0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/proxymap socket: wanted attribute: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/proxymap socket: wanted attribute: flags 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: flags 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 16 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/proxymap socket: wanted attribute: (list terminator) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: (end) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: dict_proxy_open: connect to map=pgsql:/etc/postfix/virtual-mailbox-maps.cf status=0 server_flags=fixed 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: dict_open: proxy:pgsql:/etc/postfix/virtual-mailbox-maps.cf 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: smtpd_access_maps ~? debug_peer_list 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: smtpd_access_maps ~? fast_flush_domains 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: smtpd_access_maps ~? mynetworks 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: smtpd_access_maps ~? permit_mx_backup_networks 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: smtpd_access_maps ~? qmqpd_authorized_clients 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: smtpd_access_maps ~? smtpd_access_maps 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: unknown_helo_hostname_tempfail_action = defer_if_permit 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: unknown_address_tempfail_action = defer_if_permit 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: unverified_recipient_tempfail_action = defer_if_permit 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: unverified_sender_tempfail_action = defer_if_permit 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: name_mask: 0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: auto_clnt_create: transport=local endpoint=private/tlsmgr 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: auto_clnt_open: connected to private/tlsmgr 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr request = seed 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr size = 32 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/tlsmgr: wanted attribute: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/tlsmgr: wanted attribute: seed 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: seed 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: BkwSErqQCehWb7QFIVoqNQDFcWGDIzh7N7jY0LHfZxM= 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/tlsmgr: wanted attribute: (list terminator) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: (end) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr request = policy 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr cache_type = smtpd 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/tlsmgr: wanted attribute: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/tlsmgr: wanted attribute: cachable 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: cachable 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 1 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/tlsmgr: wanted attribute: (list terminator) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: (end) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: fast_flush_domains ~? debug_peer_list 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_string: fast_flush_domains ~? fast_flush_domains 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: auto_clnt_create: transport=local endpoint=private/anvil 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: connection established 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: master_notify: status 0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: name_mask: resource 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: name_mask: software
Jun 19 16:27:21 localhost postfix/smtpd[12172]: connect from s72-38-252-2.static.datacom.cgocable.net[72.38.252.2] 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: s72-38-252-2.static.datacom.cgocable.net: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: 72.38.252.2: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: s72-38-252-2.static.datacom.cgocable.net: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: 72.38.252.2: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: smtp_stream_setup: maxtime=300 enable_deadline=0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_hostname: s72-38-252-2.static.datacom.cgocable.net ~? 127.0.0.0/8 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_hostaddr: 72.38.252.2 ~? 127.0.0.0/8 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: s72-38-252-2.static.datacom.cgocable.net: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: 72.38.252.2: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: auto_clnt_open: connected to private/anvil 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr request = connect 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr ident = smtp:72.38.252.2 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/anvil: wanted attribute: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/anvil: wanted attribute: count 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: count 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 1 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/anvil: wanted attribute: rate 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: rate 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 1 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/anvil: wanted attribute: (list terminator) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: (end) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 220 domain.tld ESMTP Postfix (Debian/GNU) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: xsasl_dovecot_server_create: SASL service=smtp, realm=(null) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: name_mask: noanonymous 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: xsasl_dovecot_server_connect: Connecting 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: xsasl_dovecot_server_connect: auth reply: VERSION?1?1 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: xsasl_dovecot_server_connect: auth reply: MECH?PLAIN?plaintext 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: name_mask: plaintext 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: xsasl_dovecot_server_connect: auth reply: SPID?11468 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: xsasl_dovecot_server_connect: auth reply: CUID?91 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: xsasl_dovecot_server_connect: auth reply: COOKIE?9df14148adb89ae414e824bc836238da 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: xsasl_dovecot_server_connect: auth reply: DONE 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: xsasl_dovecot_server_mech_filter: keep mechanism: PLAIN 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: < s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: EHLO User 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: s72-38-252-2.static.datacom.cgocable.net: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: 72.38.252.2: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 250-domain.tld 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 250-PIPELINING 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 250-SIZE 10240000 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 250-ETRN 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 250-STARTTLS 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 250-AUTH PLAIN 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 250-ENHANCEDSTATUSCODES 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 250-8BITMIME 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 250 DSN 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: < s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: QUIT 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: > s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: 221 2.0.0 Bye 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_hostname: s72-38-252-2.static.datacom.cgocable.net ~? 127.0.0.0/8 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_hostaddr: 72.38.252.2 ~? 127.0.0.0/8 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: s72-38-252-2.static.datacom.cgocable.net: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: match_list_match: 72.38.252.2: no match 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr request = disconnect 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: send attr ident = smtp:72.38.252.2 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/anvil: wanted attribute: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: status 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute value: 0 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: private/anvil: wanted attribute: (list terminator) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: input attribute name: (end) 
Jun 19 16:27:21 localhost postfix/smtpd[12172]: disconnect from s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]
Jun 19 16:27:21 localhost postfix/smtpd[12172]: master_notify: status 1
Jun 19 16:27:21 localhost postfix/smtpd[12172]: connection closed
Jun 19 16:27:26 localhost postfix/smtpd[12172]: proxymap stream disconnect
Jun 19 16:27:26 localhost postfix/smtpd[12172]: auto_clnt_close: disconnect private/tlsmgr stream

感谢您的任何提示。

postfix

1 个回答

  1. Best Answer

    远程 SMTP 客户端甚至不会尝试进行身份验证，也不会尝试发送消息。您的日志文件显示它在收到对其EHLO User命令的响应后简单地退出：

    < s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: EHLO User
...
< s72-38-252-2.static.datacom.cgocable.net[72.38.252.2]: QUIT

    我怀疑远程客户端正在检查对其EHLO命令的响应中的特定内容（应该有一个完全限定的域名而不是User）。不同的 SMTP 服务器对此类命令的响应不同，例如，您的 Postfixsmtpd表明它支持STARTTLS和AUTH PLAIN.

    EHLO命令本身是原始 SMTP命令的扩展 SMTPHELO扩展；ESMTP 服务器以成功（代码 250 后跟服务器功能列表）、失败（代码 550）或错误（代码 500、501、502、504 或 421）来响应它，具体取决于其配置。

    远程主机可能正在检查一个特定的响应，该响应表明它可能会被利用。如果它没有得到那个指示，它就会放弃。

    根据我的经验，“野蛮”破解尝试的方式存在很大差异；有些人比其他人更微妙（大概是为了避免引起不必要的注意）。

    拒绝无效的 HELO 命令

    如果您将接受来自许多不同 SMTP 客户端的连接，最好不要拒绝没有 FQDN 的无效 EHLO 命令。HELO我遇到了一些 SMTP 客户端（在打印机/扫描仪上、包含邮件功能的旧 Windows 软件等），它们没有使用/EHLO命令发送格式正确、完全限定的域名。Red Hat Enterprise Linux 5 提供的默认 Postfix 配置不限制HELO使用，甚至不需要它。

    如果您知道所有合法客户端都会发送 valid HELO，则可能有助于减少用于处理非法尝试的处理（我自己没有尝试过）。

    • 2

相关问题