☰

25 端口流量泛滥

tag-icon • tag-icon smtp sendmail
25 端口流量泛滥

我在端口 25 上获得了数千次点击，一天内有超过 400,000 个连接。

我在 Debian 7 上使用 sendmail 默认设置。邮件服务器尚未配置。

请参阅以下 Nginx 访问日志

root@zone:/usr/local/nginx/logs# tail access.log
61.231.81.100 - - [12/Sep/2013:23:56:46 +0530] "CONNECT 203.188.197.111:25 HTTP/1.0" 400 172 "-" "-"
61.231.82.166 - - [12/Sep/2013:23:56:46 +0530] "CONNECT 27.123.206.55:25 HTTP/1.0" 400 172 "-" "-"
61.228.19.219 - - [12/Sep/2013:23:56:46 +0530] "CONNECT 203.188.197.111:25 HTTP/1.0" 400 172 "-" "-"
61.231.83.31 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 114.34.96.143:25 HTTP/1.0" 400 172 "-" "-"
61.228.19.219 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 203.188.197.119:25 HTTP/1.0" 400 172 "-" "-"
61.231.82.166 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 27.123.206.55:25 HTTP/1.0" 400 172 "-" "-"
61.231.90.113 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 27.123.206.55:25 HTTP/1.0" 400 172 "-" "-"
61.231.84.210 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 203.188.197.111:25 HTTP/1.0" 400 172 "-" "-"
61.231.82.166 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 203.188.197.111:25 HTTP/1.0" 400 172 "-" "-"
61.231.87.39 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 27.123.206.55:25 HTTP/1.0" 400 172 "-" "-"

现在我已经阻止了 Nginx 的整个子网

deny 61.231.0.0/16;
deny 61.228.0.0/16;

我收到以下访问日志：

tail access.log
111.241.32.138 - - [13/Sep/2013:01:12:02 +0530] "GET http://www.google.com.tw/ HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
111.241.32.138 - - [13/Sep/2013:01:12:02 +0530] "CONNECT mta7.am0.yahoodns.net:25 HTTP/1.0" 400 172 "-" "-"
184.75.210.226 - - [13/Sep/2013:01:12:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
61.231.2.232 - - [13/Sep/2013:01:12:38 +0530] "GET http://www.google.co.jp HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
61.231.2.232 - - [13/Sep/2013:01:12:39 +0530] "CONNECT mx3.mail2000.com.tw:25 HTTP/1.0" 400 172 "-" "-"
61.231.87.103 - - [13/Sep/2013:01:12:44 +0530] "GET http://www.google.com/intl/zh-CN/ HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
61.231.87.103 - - [13/Sep/2013:01:12:45 +0530] "CONNECT mta5.am0.yahoodns.net:25 HTTP/1.0" 400 172 "-" "-"
61.231.83.158 - - [13/Sep/2013:01:12:55 +0530] "GET http://www.google.com.tw HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
61.231.83.158 - - [13/Sep/2013:01:12:56 +0530] "CONNECT mx3.mail2000.com.tw:25 HTTP/1.0" 400 172 "-" "-"
61.228.22.143 - - [13/Sep/2013:01:13:09 +0530] "GET http://www.google.com/ HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"

从 iptables 阻止子网，停止从这些子网获取流量。

-I INPUT -s 61.231.0.0/16 -j DROP
-I INPUT -s 111.241.0.0/16 -j DROP
-I INPUT -s 61.228.0.0/16 -j DROP
 tail access.log
78.40.124.16 - - [13/Sep/2013:02:53:39 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
67.205.67.76 - - [13/Sep/2013:02:54:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
46.165.195.139 - - [13/Sep/2013:02:55:39 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
46.165.195.139 - - [13/Sep/2013:02:55:40 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
174.34.162.242 - - [13/Sep/2013:02:56:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
123.125.71.114 - - [13/Sep/2013:02:56:44 +0530] "GET / HTTP/1.1" 200 8553 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
220.181.108.153 - - [13/Sep/2013:02:56:55 +0530] "GET / HTTP/1.1" 200 23153 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
95.141.32.46 - - [13/Sep/2013:02:57:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
95.211.217.68 - - [13/Sep/2013:02:58:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
91.109.115.41 - - [13/Sep/2013:02:59:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"

我认为有人正在使用我的服务器主机名或 IP 作为 SMTP？
请建议永久补救措施来解决此问题，因为这是客户的网站并且具有全球访问权限，因此从同一子网访问网站的真实用户可能会受到影响。

我怎样才能阻止这种情况？

答案1

您实际上并不是通过 Web 服务器在端口 25 上接收流量，而是在端口 80 上接收流量。

此流量试图使用您的服务器作为代理来伪装流量来源。我们通常将此类服务器称为开放代理，它们在发送垃圾邮件和对其他网站进行攻击方面非常有用。

出于某种原因，有些人似乎认为您的 IP 地址有一个开放的代理服务器，但日志条目显示请求被拒绝。

如果请求量过大，我建议使用防火墙封锁 IP 地址块，而不是简单地在 nginx 中拒绝它们。例如：

iptables -I INPUT -s 61.231.0.0/16 -j DROP

相关内容