AskOverflow.Dev

AskOverflow.Dev Logo AskOverflow.Dev Logo

AskOverflow.Dev Navigation

  • 主页
  • 系统&网络
  • Ubuntu
  • Unix
  • DBA
  • Computer
  • Coding
  • LangChain

Mobile menu

Close
  • 主页
  • 系统&网络
    • 最新
    • 热门
    • 标签
  • Ubuntu
    • 最新
    • 热门
    • 标签
  • Unix
    • 最新
    • 标签
  • DBA
    • 最新
    • 标签
  • Computer
    • 最新
    • 标签
  • Coding
    • 最新
    • 标签
主页 / user-185825

OsakaWebbie's questions

Martin Hope
OsakaWebbie
Asked: 2023-11-30 11:03:05 +0800 CST

MariaDB 重新安装并升级到新版本后,Monit 抱怨校验和失败

  • 5

我有一个运行 CentOS 7 的 Linode VPS 和一些旧版本的 Web 相关服务(因为我编写的代码还没有准备好用于新版本 - 我计划使用新的一切和更新的代码构建一个新的 VPS,但是那需要时间)。

最近,VPS 迁移到了新硬件。重新启动后,MariaDB 10.2 将不会重新启动。经过两天的绞尽脑汁,我通过删除并重新安装 mariadb-server 让它工作起来,再加上仔细的文件管理让它识别我的 InnoDB 数据文件。

MariaDB 10.2 已结束生命周期,自 2022 年 5 月起不再受支持,因此不再位于http://yum.mariadb.org中,因此我必须安装 10.4(我只将 中的一位数字MariaDB.repo从更改baseurl=http://yum.mariadb.org/10.2/centos7-amd64为baseurl=http://yum.mariadb.org/10.4/centos7-amd64)。

据我所知,一切都运行良好。但是,每当我尝试让 Monit 再次开始监视该服务时,它都会拒绝,并且我收到两封通知电子邮件,内容为“Checksum failed Service mariadb_bin”和“Checksum failed Service mariadb_init”。

我用的是最权威的镜子吧?那么为什么会出现校验和问题呢?

这是 MariaDB 的 Monit 文件:

## Mariadb monitoring.

## Test the mariadb service.
check process mariadb with pidfile /run/mariadb/mariadb.pid
  group database
  start program = "/usr/bin/systemctl start mariadb"
  stop  program = "/usr/bin/systemctl stop mariadb"
  restart program  = "/usr/bin/systemctl restart mariadb"
  if failed port 3306 protocol mysql then restart
  if 3 restarts within 5 cycles then timeout
  # This process check depends on checking the binary if the mariadb
  # daemon and the init script.
  depends on mariadb_bin
  depends on mariadb_init
  alert [my email address] only on {timeout}

## Test the process binary.
check file mariadb_bin with path /usr/bin/mysqld_safe
  group database
  if failed checksum then unmonitor
  if failed permission 755 then unmonitor
  if failed uid root then unmonitor
  if failed gid root then unmonitor

## Test the init scripts.
check file mariadb_init with path /usr/lib/systemd/system/mariadb.service
  group database
  if failed checksum then unmonitor
  if failed permission 644 then unmonitor
  if failed uid root then unmonitor
  if failed gid root then unmonitor

所以显然 Monit 说 的校验和mariadb_bin与 的校验/usr/bin/mysqld_safe和不匹配,并且 的校验和与 的校验mariadb_init和不匹配/usr/lib/systemd/system/mariadb.service,尽管我不知道什么是“组数据库”。

centos7
  • 2 个回答
  • 65 Views
Martin Hope
OsakaWebbie
Asked: 2017-10-10 22:32:46 +0800 CST

Cron 每天运行两次

  • 3

在我的 CentOS 7 服务器上,由应该可以正常运行的夜间备份脚本生成的错误导致我检查我的 cron 活动。我发现它cron.daily运行了两次 - 这是我删除备份脚本后的相关部分,/var/log/cron看看它是否以某种方式导致了问题:

Oct 10 02:28:01 mail CROND[1750]: (root) CMD (run-parts /etc/cron.hourly)
Oct 10 02:28:01 mail run-parts(/etc/cron.hourly)[1750]: starting 0anacron
Oct 10 02:28:01 mail anacron[1759]: Anacron started on 2017-10-10
Oct 10 02:28:01 mail run-parts(/etc/cron.hourly)[1761]: finished 0anacron
Oct 10 02:28:01 mail anacron[1759]: Normal exit (0 jobs run)
Oct 10 02:30:01 mail CROND[1766]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 02:40:01 mail CROND[1847]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 02:50:01 mail CROND[1936]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 03:00:01 mail CROND[2032]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 03:10:01 mail CROND[2148]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 03:17:01 mail CROND[2223]: (root) CMD (run-parts /etc/cron.daily)
Oct 10 03:17:01 mail run-parts(/etc/cron.daily)[2223]: starting kizunademo
Oct 10 03:17:02 mail run-parts(/etc/cron.daily)[2259]: finished kizunademo
Oct 10 03:17:02 mail run-parts(/etc/cron.daily)[2223]: starting logrotate
Oct 10 03:17:02 mail run-parts(/etc/cron.daily)[2266]: finished logrotate
Oct 10 03:17:02 mail run-parts(/etc/cron.daily)[2223]: starting man-db.cron
Oct 10 03:17:02 mail run-parts(/etc/cron.daily)[2277]: finished man-db.cron
Oct 10 03:20:01 mail CROND[2288]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 03:28:01 mail CROND[2367]: (root) CMD (run-parts /etc/cron.hourly)
Oct 10 03:28:01 mail run-parts(/etc/cron.hourly)[2367]: starting 0anacron
Oct 10 03:28:01 mail anacron[2376]: Anacron started on 2017-10-10
Oct 10 03:28:01 mail run-parts(/etc/cron.hourly)[2378]: finished 0anacron
Oct 10 03:28:01 mail anacron[2376]: Will run job `cron.daily' in 35 min.
Oct 10 03:28:01 mail anacron[2376]: Jobs will be executed sequentially
Oct 10 03:30:01 mail CROND[2381]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 03:40:01 mail CROND[2462]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 03:50:02 mail CROND[2547]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 04:00:01 mail CROND[2670]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Oct 10 04:03:01 mail anacron[2376]: Job `cron.daily' started
Oct 10 04:03:01 mail run-parts(/etc/cron.daily)[2685]: starting kizunademo
Oct 10 04:03:02 mail run-parts(/etc/cron.daily)[2721]: finished kizunademo
Oct 10 04:03:02 mail run-parts(/etc/cron.daily)[2685]: starting logrotate
Oct 10 04:03:02 mail run-parts(/etc/cron.daily)[2728]: finished logrotate
Oct 10 04:03:02 mail run-parts(/etc/cron.daily)[2685]: starting man-db.cron
Oct 10 04:03:03 mail run-parts(/etc/cron.daily)[2739]: finished man-db.cron
Oct 10 04:03:03 mail anacron[2376]: Job `cron.daily' terminated
Oct 10 04:03:03 mail anacron[2376]: Normal exit (1 job run)

为什么要cron.daily运行两次?如您所见,日志包含与第二次运行相关的一些条目,但在第一次运行时不存在:两行宣布即将运行,另外两行表示它以正常退出而终止。第一次运行只是简单地运行脚本,没有额外的宣传。我认为这意味着什么,但我不知道是什么。

我检查了所有我能想到的东西的两倍。我很确定我已经阅读了有关该主题的所有类似主题,因此请在将其称为重复问题之前与以下内容进行比较。基于为什么 cron 运行两次?我检查了额外的进程 - 完整的输出ps aux | grep cron如下,所以只有一个进程:

root      9383  0.0  0.2 112672  2340 pts/0    S+   15:18   0:00 grep --color=auto cron
root     25624  0.0  0.0 126248   320 ?        Ss   Sep30   0:02 /usr/sbin/crond -n

基于运行两次的 Cron 作业-我还检查了Ubuntu 服务器 12.04 crontab -l -u root,它说no crontab for root。

这是我的 /etc/crontab:

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=my@email.com

28 * * * * root run-parts /etc/cron.hourly
17 3 * * * root run-parts /etc/cron.daily
44 2 * * 0 root run-parts /etc/cron.weekly
8 2 7 * * root run-parts /etc/cron.monthly

想法?

编辑(本次讨论沉默 9 个月后):

今天来自 Marin Velikov 的评论让我意识到有一个anacrontab文件(我知道这很愚蠢,但我什至没有想到)。这是它的内容:

SHELL=/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
# the maximal random delay added to the base delay of the jobs
RANDOM_DELAY=45
# the jobs will be started during the following hours only
START_HOURS_RANGE=3-22

#period in days   delay in minutes   job-identifier   command
1       5       cron.daily              nice run-parts /etc/cron.daily
7       25      cron.weekly             nice run-parts /etc/cron.weekly
@monthly 45     cron.monthly            nice run-parts /etc/cron.monthly

所以这就是原因。但是为什么系统会被配置为同时运行呢?我认为比我聪明的人会这样设置它,所以在知道目的之前我会犹豫不决。如果我确实应该删除其中一个crontab或中的条目anacrontab,哪一个是最好的?Anacron 显然是更复杂的工具,但清空一个crontab. 我是不是太老派了?

cron
  • 2 个回答
  • 2361 Views
Martin Hope
OsakaWebbie
Asked: 2016-09-12 21:15:10 +0800 CST

如何将后缀设置为仅忽略发给不存在用户的邮件

  • 0

我收到了大量针对随机用户名的垃圾邮件尝试。我知道这在某种程度上发生在所有邮件服务器上,但是在过去的两周里,我的 VPS 磁盘分配空间太大了,仅仅因为邮件日志文件的大小就被填满了!一周的日志差不多有7GB,其他的小一些但不正常。我是阅读日志的新手,但这里有一个随机选择的小片段:

Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 05DEA31470BF: from=<glenda_fitzgerald@l4jp.com>, size=1165, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 05DEA31470BF: to=<smith88@yahoo.com>, relay=none, delay=358802, delays=358802/0.07/0/0, dsn=4.4.2, status=deferred (delivery temporarily suspended: lost connection with mta5.am0.yahoodns.net[66.196.118.34] while sending RCPT TO)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 00B053186BAE: from=<minnie_duncan@l4jp.com>, size=1123, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27246]: 00DAD31454C1: to=<ginger_walton@l4jp.com>, relay=local, delay=391867, delays=391867/0.13/0/0.02, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "ginger_walton")
Sep 11 03:53:16 vps-1011517-5697 postfix/smtp[26812]: 0099B3136B26: to=<aziz.toska@gmail.com>, relay=gmail-smtp-in.l.google.com[74.125.204.27]:25, delay=107076, delays=107075/0/0.39/0.68, dsn=4.7.1, status=SOFTBOUNCE (host gmail-smtp-in.l.google.com[74.125.204.27] said: 550-5.7.1 [27.112.107.68       1] Our system has detected an unusual rate of 550-5.7.1 unsolicited mail originating from your IP address. To protect our 550-5.7.1 users from spam, mail sent from your IP address has been blocked. 550-5.7.1 Please visit 550-5.7.1  https://support.google.com/mail/?p=UnsolicitedIPError to review our 550 5.7.1 Bulk Email Senders Guidelines. q189si11097060pfq.189 - gsmtp (in reply to end of DATA command))
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 00ECD3169334: from=<lauren_christensen@l4jp.com>, size=1106, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 00ECD3169334: to=<judelaws67@yahoo.com>, relay=none, delay=246340, delays=246340/0.02/0/0, dsn=4.4.2, status=deferred (delivery temporarily suspended: lost connection with mta5.am0.yahoodns.net[66.196.118.34] while sending RCPT TO)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0231E3138414: from=<david_moon@l4jp.com>, size=1560, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0231E3138414: to=<colbypeoples44@yahoo.com>, relay=none, delay=14482, delays=14482/0/0/0, dsn=4.4.2, status=deferred (delivery temporarily suspended: lost connection with mta5.am0.yahoodns.net[66.196.118.34] while sending RCPT TO)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 062593144D72: from=<>, size=3463, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 08A1D31498F3: from=<>, size=3045, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27247]: 062593144D72: to=<isabel_miles@l4jp.com>, relay=local, delay=396966, delays=396966/0.01/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "isabel_miles")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0D692313F1DA: from=<>, size=3078, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 00EA0313F88E: from=<>, size=3464, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27248]: 08A1D31498F3: to=<bridget_harrison@l4jp.com>, relay=local, delay=321787, delays=321787/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "bridget_harrison")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0F2A33147B48: from=<>, size=3657, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27246]: 0D692313F1DA: to=<freda_gordon@l4jp.com>, relay=local, delay=430240, delays=430240/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "freda_gordon")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 046C83133878: from=<shelley_garcia@l4jp.com>, size=1180, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27247]: 00EA0313F88E: to=<amelia_hanson@l4jp.com>, relay=local, delay=425180, delays=425180/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "amelia_hanson")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 035633144D87: from=<>, size=3087, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 019673137E30: from=<marguerite_lee@l4jp.com>, size=1161, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27248]: 0F2A33147B48: to=<della_wright@l4jp.com>, relay=local, delay=347073, delays=347073/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "della_wright")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 01F593146A8D: from=<>, size=3579, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27246]: 035633144D87: to=<kelley_strickland@l4jp.com>, relay=local, delay=396952, delays=396952/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "kelley_strickland")
Sep 11 03:53:16 vps-1011517-5697 postfix/smtp[27074]: 0423D31361AE: to=<ka-abdel@hotmail.fr>, relay=mx3.hotmail.com[65.55.37.72]:25, delay=33557, delays=33557/0.01/0.38/0.12, dsn=4.0.0, status=SOFTBOUNCE (host mx3.hotmail.com[65.55.37.72] said: 550 SC-002 (COL004-MC1F20) Unfortunately, messages from 27.112.107.68 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors. (in reply to MAIL FROM command))
Sep 11 03:53:16 vps-1011517-5697 postfix/smtp[27074]: 0423D31361AE: lost connection with mx3.hotmail.com[65.55.37.72] while sending RCPT TO
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 078CF312D56D: from=<>, size=3751, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27247]: 01F593146A8D: to=<eva_morrison@l4jp.com>, relay=local, delay=371261, delays=371261/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "eva_morrison")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0CB143130F4A: from=<>, size=3022, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27248]: 078CF312D56D: to=<gwen_mendoza@l4jp.com>, relay=local, delay=321700, delays=321700/0.01/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "gwen_mendoza")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 02A0C31284D7: from=<>, size=3032, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27246]: 0CB143130F4A: to=<marcia_harvey@l4jp.com>, relay=local, delay=242903, delays=242903/0.01/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "marcia_harvey")

三个沉思:

  • 我对“SOFTBOUNCE”的理解不适合这种情况——无效的用户名应该是硬退回,对吧?无论如何,我宁愿根本没有任何反弹,因为这既浪费资源又给垃圾邮件发送者太多信息。
  • 我不明白来自 Google 服务器的投诉文本 - 句子中似乎随机插入了数字“500-5.7.1”。但我认为如果有足够多的这些传出的反弹,它们本身就可以被解释为垃圾邮件,对吧?
  • 来自 French Hotmail 的关于阻止列表的投诉可能是由我的服务器或其他人的服务器引起的;对 107 个黑名单的检查仅在其中两个上报告了我的 IP,所以我认为我的网站上没有真正的垃圾邮件生成器或类似的东西。

无论如何,我在域上只有一个有效的用户名,所以是否可以配置 postfix 以简单地将任何邮件尝试丢弃到任何其他用户名?如果没有发送退回邮件,甚至没有在日志文件中输入任何内容,我会很高兴,因为正如我所说,日志文件本身正在填满。或者,如果有更好的方法来处理这种攻击,我会全神贯注。

编辑#1:针对询问连接/断开连接条目的评论,我搜索了第一次出现的“连接”(周围有空格 - 否则我会得到所有“丢失的连接”条目),然后grepped后续引用同一个邮件服务器。这是其中的第一个序列,发生在两秒内,因此可能与同一电子邮件尝试有关:

Sep 11 03:53:25 vps-1011517-5697 postfix/smtpd[20505]: connect from simcoe209srvr.owm.bell.net[184.150.200.209]
Sep 11 03:53:25 vps-1011517-5697 postfix/smtpd[20505]: setting up TLS connection from simcoe209srvr.owm.bell.net[184.150.200.209]
Sep 11 03:53:26 vps-1011517-5697 postfix/smtpd[20505]: TLS connection established from simcoe209srvr.owm.bell.net[184.150.200.209]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bi
ts)
Sep 11 03:53:26 vps-1011517-5697 postfix/smtpd[20505]: NOQUEUE: reject: RCPT from simcoe209srvr.owm.bell.net[184.150.200.209]: 450 4.1.1 <louise_bryant@l4jp.com>: Recipient address
 rejected: User unknown in local recipient table; from=<> to=<louise_bryant@l4jp.com> proto=ESMTP helo=<torfep04.bell.net>
Sep 11 03:53:27 vps-1011517-5697 postfix/smtpd[20505]: disconnect from simcoe209srvr.owm.bell.net[184.150.200.209]

这些不是日志中的连续条目;在相同的两秒钟内有大量不相关的条目。但是,如果您要我在其中搜索相关的内容,请告诉我要查找的内容。

编辑#2:作为对 JennyD 的回应,这是我的 /etc/postfix/main.cf (当然删除了评论):

soft_bounce = yes
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
mail_owner = postfix
myhostname = l4jp.com
mydomain = l4jp.com
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
unknown_local_recipient_reject_code = 550
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
debug_peer_level = 2
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         xxgdb $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.3.3/samples
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
# THE FOLLOWING IS FROM: http://www.anchor.com.au/hosting/dedicated/Postfix-SASL-setup
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    reject_unauth_destination
smtpd_tls_security_level = may
smtpd_tls_key_file = /etc/ssl/smtpd.key
smtpd_tls_cert_file = /etc/ssl/smtpd.crt
smtpd_tls_auth_only = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
#My settings for virtual mailbox domains (which I don't think I actually use for anything)
virtual_mailbox_domains = /etc/postfix/vhosts.txt
virtual_mailbox_base = /var/spool/vmail
virtual_mailbox_maps = hash:/etc/postfix/vmaps.txt
virtual_minimum_uid = 100
virtual_uid_maps = static:101
virtual_gid_maps = static:101
message_size_limit = 30720000

编辑#3: Dom 推荐 softbounce=no。我在进行更改之前和之后发送了一封测试电子邮件 - 以下是相关的日志条目(发件人地址已清理):

Sep 12 20:38:39 vps-1011517-5697 postfix/smtpd[5343]: connect from gateway21.websitewelcome.com[192.185.45.43]
Sep 12 20:38:39 vps-1011517-5697 postfix/smtpd[5343]: setting up TLS connection from gateway21.websitewelcome.com[192.185.45.43]
Sep 12 20:38:39 vps-1011517-5697 postfix/smtpd[5343]: TLS connection established from gateway21.websitewelcome.com[192.185.45.43]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Sep 12 20:38:40 vps-1011517-5697 postfix/smtpd[5343]: NOQUEUE: reject: RCPT from gateway21.websitewelcome.com[192.185.45.43]: 450 4.1.1 <testing@l4jp.com>: Recipient address rejected: User unknown in local recipient table; from=<myotheremail@otherdomain.com> to=<testing@l4jp.com> proto=ESMTP helo=<gateway21.websitewelcome.com>
Sep 12 20:38:40 vps-1011517-5697 postfix/smtpd[5343]: disconnect from gateway21.websitewelcome.com[192.185.45.43]

Sep 12 20:43:06 vps-1011517-5697 postfix/smtpd[6400]: connect from gateway23.websitewelcome.com[192.185.50.119]
Sep 12 20:43:06 vps-1011517-5697 postfix/smtpd[6400]: setting up TLS connection from gateway23.websitewelcome.com[192.185.50.119]
Sep 12 20:43:07 vps-1011517-5697 postfix/smtpd[6400]: TLS connection established from gateway23.websitewelcome.com[192.185.50.119]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Sep 12 20:43:07 vps-1011517-5697 postfix/smtpd[6400]: NOQUEUE: reject: RCPT from gateway23.websitewelcome.com[192.185.50.119]: 550 5.1.1 <testing@l4jp.com>: Recipient address rejected: User unknown in local recipient table; from=<myotheremail@otherdomain.com> to=<testing@l4jp.com> proto=ESMTP helo=<gateway23.websitewelcome.com>
Sep 12 20:43:07 vps-1011517-5697 postfix/smtpd[6400]: disconnect from gateway23.websitewelcome.com[192.185.50.119]

在这两种情况下都有五个条目 - 日志中的唯一区别是错误代码(如预期的那样)。但是在更改之后,我收到了一条实际退回邮件到我发送测试的地址。发送给垃圾邮件发送者不是一件坏事吗?

编辑#4:响应 masegaloeh 的评论,要求提供与同一消息队列 ID 相关的所有条目。他作为示例给出的 ID 来自我关闭 soft_bounce 之前的原始文件,但我怀疑没有 soft_bounce 的 ID 更有用,所以这里是一个最近的随机示例:

[root](10:27:06)[~]$ grep E6CBF312663B /var/log/maillog
Sep 15 10:26:11 vps-1011517-5697 postfix/cleanup[10347]: E6CBF312663B: message-id=<20160915012611.E6CBF312663B@l4jp.com>
Sep 15 10:26:11 vps-1011517-5697 postfix/bounce[10292]: 47A8E3126F85: sender non-delivery notification: E6CBF312663B
Sep 15 10:26:11 vps-1011517-5697 postfix/qmgr[8701]: E6CBF312663B: from=<>, size=3801, nrcpt=1 (queue active)
Sep 15 10:26:11 vps-1011517-5697 postfix/local[10477]: E6CBF312663B: to=<eula_mcdonald@l4jp.com>, relay=local, delay=0, delays=0/0/0/0, dsn=5.1.1, status=bounced (unknown user: "eula_mcdonald")
Sep 15 10:26:11 vps-1011517-5697 postfix/qmgr[8701]: E6CBF312663B: removed

当前的日志文件仅用了大约 2.5 天就增长到了 1.2GB。我无法承受这样的速度……

编辑#5:接下来,masegaloeh 要求这样做:

[root](09:03:50)[/var/log]$ grep 47A8E3126F85 maillog
Sep 15 10:26:10 vps-1011517-5697 postfix/pickup[10444]: 47A8E3126F85: uid=500 from=<eula_mcdonald@l4jp.com>
Sep 15 10:26:10 vps-1011517-5697 postfix/cleanup[10347]: 47A8E3126F85: message-id=<7adc4f0bc266b560e0ec0521654f81b8@l4jp.com>
Sep 15 10:26:10 vps-1011517-5697 postfix/qmgr[8701]: 47A8E3126F85: from=<eula_mcdonald@l4jp.com>, size=1153, nrcpt=1 (queue active)
Sep 15 10:26:11 vps-1011517-5697 postfix/smtp[9981]: 47A8E3126F85: to=<nashvilleguy717@gmail.com>, relay=gmail-smtp-in.l.google.com[64.233.189.27]:25, delay=1.7, delays=0.02/0.39/0.51/0.75, dsn=5.7.1, status=bounced (host gmail-smtp-in.l.google.com[64.233.189.27] said: 550-5.7.1 [27.112.107.68       1] Our system has detected an unusual rate of 550-5.7.1 unsolicited mail originating from your IP address. To protect our 550-5.7.1 users from spam, mail sent from your IP address has been blocked. 550-5.7.1 Please visit 550-5.7.1  https://support.google.com/mail/?p=UnsolicitedIPError to review our 550 5.7.1 Bulk Email Senders Guidelines. n130si231260oig.169 - gsmtp (in reply to end of DATA command))
Sep 15 10:26:11 vps-1011517-5697 postfix/bounce[10292]: 47A8E3126F85: sender non-delivery notification: E6CBF312663B
Sep 15 10:26:11 vps-1011517-5697 postfix/qmgr[8701]: 47A8E3126F85: removed

编辑#6:在采取迈克尔汉普顿建议的行动之后,我再次查看了日志的尾部。“接受投递”这句话引起了我的注意,因为我没有发送或接收任何真正的邮件 - 这是与我注意到的那个相关的系列:

[root](15:01:16)[/var/log]$ grep 638BD3122039 maillog
Sep 17 14:59:34 vps-1011517-5697 postfix/pickup[8959]: 638BD3122039: uid=500 from=<juanita_ellis@l4jp.com>
Sep 17 14:59:34 vps-1011517-5697 postfix/cleanup[9099]: 638BD3122039: message-id=<106604bcf476c97586ba8590c7db683e@l4jp.com>
Sep 17 14:59:34 vps-1011517-5697 postfix/qmgr[7492]: 638BD3122039: from=<juanita_ellis@l4jp.com>, size=1185, nrcpt=1 (queue active)
Sep 17 14:59:38 vps-1011517-5697 postfix/smtp[9109]: 638BD3122039: to=<john.timmermans@philips.com>, relay=gw-eur1.smtp.philips.com[212.159.218.9]:25, delay=3.6, delays=0.07/0.01/1.6/2, dsn=2.0.0, status=sent (250 2.0.0 kVzb1t0041UaJoz01VzcmY mail accepted for delivery)
Sep 17 14:59:38 vps-1011517-5697 postfix/qmgr[7492]: 638BD3122039: removed

当然这里没有 juanita_ellis。什么可能导致该消息被发送?我真的发送垃圾邮件???

logging spam postfix email-bounces
  • 1 个回答
  • 1214 Views
Martin Hope
OsakaWebbie
Asked: 2013-08-16 23:21:48 +0800 CST

SSH 连接到 VPS 的频繁中断

  • 2

我的 SSH 会话在看似随机的时间终止 - 响应将停止,然后几秒钟后,PuTTY 会弹出一条消息,“服务器意外关闭网络连接。 ”它似乎最常在空闲时发生,但并非总是如此 -当我输入 vim 或其他东西时,它甚至可能死掉(非常令人沮丧!)。但它非常频繁 - 如果我很幸运,它可能会存活几个小时,但如果我不走运,它可能会在登录后的几秒钟或几分钟内死亡。

  • 服务器:带有 CentOS 5.6、WebMin 1.62、OpenSSH 4.3 的 VPS
  • 客户:
    1. FTTH(或更准确地说,到建筑物:104 套公寓)
    2. 路由器 #1 运行 NAT 和安全性
    3. 路由器 #2 作为无线接入点运行
    4. Windows 7 笔记本电脑(但我在 XP 台式机上遇到了同样的问题)
    5. 腻子 0.62

大多数时候我什至不使用wifi,而只是将TCP-IP(带有集线器)连接到路由器#1 - 但问题仍然存在。我认为根本原因是我的 ISP 连接(或建筑物中的某些东西)出现问题,但我可能无法解决这个问题,所以我在 ServerFault 上问这个的原因是因为我只是想配置 SSH(或PuTTY 或其他任何东西),这样它就不会那么容易地终止会话。

我尝试了其他人认为有用的各种方法:

  • 将 PuTTY 的 Connection->"Seconds between keepalives" 设置为各种非零值(我不知道该设置是像 TCPKeepAlive 还是更像 ServerAliveInterval,但它是 PuTTY 中唯一可用的设置)

  • 尝试通过关闭 PuTTY 的 keepalive (0) 然后打开服务器来使服务器完成工作,包括在 sshd_config 中:

    TCPKeepAlive no
    ClientAliveInterval 60
    ClientAliveCountMax 3000
    
  • 更改为我的 PC 的静态 IP(这是SuperUser.com 上此问题的解决方案)

但它仍然在所有变体中都消失了——很难判断一组设置是否比另一组略好,但即使在今天不到一个小时,每个设置都失败了。从长远来看,这个问题是相当一致的 - 我已经忍受了几年我一直在管理这个服务器(我主要是一名程序员,所以我不会在 SSH 上花费大量时间,但是当我确实需要它,不断失去我的会话令人沮丧)。有什么想法吗?

centos
  • 2 个回答
  • 3039 Views

Sidebar

Stats

  • 问题 205573
  • 回答 270741
  • 最佳答案 135370
  • 用户 68524
  • 热门
  • 回答
  • Marko Smith

    新安装后 postgres 的默认超级用户用户名/密码是什么?

    • 5 个回答
  • Marko Smith

    SFTP 使用什么端口?

    • 6 个回答
  • Marko Smith

    命令行列出 Windows Active Directory 组中的用户?

    • 9 个回答
  • Marko Smith

    什么是 Pem 文件,它与其他 OpenSSL 生成的密钥文件格式有何不同?

    • 3 个回答
  • Marko Smith

    如何确定bash变量是否为空?

    • 15 个回答
  • Martin Hope
    Tom Feiner 如何按大小对 du -h 输出进行排序 2009-02-26 05:42:42 +0800 CST
  • Martin Hope
    Noah Goodrich 什么是 Pem 文件,它与其他 OpenSSL 生成的密钥文件格式有何不同? 2009-05-19 18:24:42 +0800 CST
  • Martin Hope
    Brent 如何确定bash变量是否为空? 2009-05-13 09:54:48 +0800 CST
  • Martin Hope
    cletus 您如何找到在 Windows 中打开文件的进程? 2009-05-01 16:47:16 +0800 CST

热门标签

linux nginx windows networking ubuntu domain-name-system amazon-web-services active-directory apache-2.4 ssh

Explore

  • 主页
  • 问题
    • 最新
    • 热门
  • 标签
  • 帮助

Footer

AskOverflow.Dev

关于我们

  • 关于我们
  • 联系我们

Legal Stuff

  • Privacy Policy

Language

  • Pt
  • Server
  • Unix

© 2023 AskOverflow.DEV All Rights Reserve