mailq 显示延迟队列中一堆指向看起来很奇怪的地址的连接超时。
D1115234D9 3037 Thu Feb 25 11:01:38 MAILER-DAEMON
(connect to mail.suchgt.top[63.143.32.55]:25: Connection timed out)
[email protected]
D7E46234B6 2992 Thu Feb 25 15:16:42 MAILER-DAEMON
(connect to mail.bravepb.top[46.19.138.77]:25: Connection timed out)
[email protected]
F10E2230E3 3003 Thu Feb 25 06:55:39 MAILER-DAEMON
(connect to mail.refillu.top[199.115.97.43]:25: Connection timed out)
[email protected]
F34F223661 3219 Thu Feb 25 12:03:30 MAILER-DAEMON
(connect to nlwe9u1qq.manorby.download[8.41.46.184]:25: Connection refused)
[email protected]
F3C0923133 3282 Thu Feb 25 06:55:14 MAILER-DAEMON
(lost connection with eschatological.gzgi.download[209.219.189.55] while receiving the initial server greeting)
[email protected]
-- 969 Kbytes in 266 Requests.
当我追踪其中一个消息 ID 并尝试查看是谁发送该消息时，我收到了=<>
grep "D7E46234B6" 邮件日志
Feb 25 15:16:42 c postfix/smtpd[11744]: D7E46234B6: client=localhost.localdomain[127.0.0.1]
Feb 25 15:16:42 c postfix/cleanup[11733]: D7E46234B6: message-id=<[email protected]>
Feb 25 15:16:42 c postfix/qmgr[2440]: D7E46234B6: from=<>, size=2992, nrcpt=1 (queue active)
Feb 25 15:16:42 c amavis[11668]: (11668-01) Passed CLEAN {RelayedOpenRelay}, <> -> <[email protected]>, Message-ID: <[email protected]>, mail_id: zbne-aplX4iS, Hits: 0.898, size: 2544, queued_as: D7E46234B6, 20276 ms
Feb 25 15:16:42 c postfix/smtp[11739]: A345D23687: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=20, delays=0.01/0/0.06/20, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as D7E46234B6)
Feb 25 15:16:43 c postfix/smtp[11763]: D7E46234B6: to=<[email protected]>, relay=none, delay=0.24, delays=0.02/0/0.21/0, dsn=4.4.1, status=deferred (connect to mail.bravepb.top[46.19.138.77]:25: Connection refused)
Feb 25 15:26:27 c postfix/qmgr[2440]: D7E46234B6: from=<>, size=2992, nrcpt=1 (queue active)
Feb 25 15:26:58 c postfix/smtp[12339]: D7E46234B6: to=<[email protected]>, relay=none, delay=615, delays=585/0.23/30/0, dsn=4.4.1, status=deferred (connect to mail.bravepb.top[46.19.138.77]:25: Connection timed out)
Feb 25 15:41:27 c postfix/qmgr[2440]: D7E46234B6: from=<>, size=2992, nrcpt=1 (queue active)
Feb 25 15:41:57 c postfix/smtp[12959]: D7E46234B6: to=<[email protected]>, relay=none, delay=1515, delays=1484/0.12/30/0, dsn=4.4.1, status=deferred (connect to mail.bravepb.top[46.19.138.77]:25: Connection timed out)
Feb 25 16:11:27 c postfix/qmgr[2440]: D7E46234B6: from=<>, size=2992, nrcpt=1 (queue active)
Feb 25 16:11:58 c postfix/smtp[14279]: D7E46234B6: to=<[email protected]>, relay=none, delay=3316, delays=3284/0.11/31/0, dsn=4.4.1, status=deferred (connect to mail.bravepb.top[46.19.138.77]:25: Connection timed out)
Feb 25 17:11:28 c postfix/qmgr[2440]: D7E46234B6: from=<>, size=2992, nrcpt=1 (queue active)
Feb 25 17:11:58 c postfix/smtp[16763]: D7E46234B6: to=<[email protected]>, relay=none, delay=6915, delays=6885/0.1/30/0, dsn=4.4.1, status=deferred (connect to mail.bravepb.top[46.19.138.77]:25: Connection timed out)
问题：有没有办法知道谁在试图发送这些虚假电子邮件，以便我可以阻止他们？这种攻击看起来像是来自 php 脚本、开放中继、被黑客入侵的电子邮件帐户或其他的漏洞？
我的研究失败后，我不知道下一步该去哪里进行诊断。谢谢你的帮助。
答案1
Postfix 没有像 Exim 那样的速查表“exim -Mvh 或 exim -Mvb”。但是，它们确实有类似http://www.postfix.org/BUILTIN_FILTER_README.html
我相信您刚刚经历的是“电子邮件欺骗”。为了确保任何授权者都无法通过您的域发送电子邮件，请在您的服务器上的 DNS 和 DKIM 中添加 SPF 记录。