嗨，我想知道是否有人可以帮忙。我收到一封来自主机公司的电子邮件，说我的服务器有一些奇怪的流量。快速查看日志文件后，发现了下面的示例日志。日志文件中有数千封电子邮件。
有人能建议我如何阻止从我的 Linux 服务器发送的所有电子邮件吗？我使用的是 Ubuntu 12.03 LTS，希望这能有所帮助。
Jan 31 09:52:30 myserver postfix/smtp[55852]: 03EC14869A: to=<[email protected]>, relay=exch-spam02.ulaval.ca[132.203.244.24]:25, delay=229193, delays=229193/0.17/0.47/0, dsn=4.0.0, status=deferred (host exch-spam02.ulaval.ca[132.203.244.24] refused to talk to me: 554-exch-spam02.ulaval.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: connect to cluster8.us.messagelabs.com[216.82.241.132]:25: Connection refused
Jan 31 09:52:30 myserver postfix/smtp[55849]: 5049348710: to=<[email protected]>, relay=mail3.uqam.ca[132.208.246.162]:25, delay=229188, delays=229187/0.15/0.52/0, dsn=4.0.0, status=deferred (host mail3.uqam.ca[132.208.246.162] refused to talk to me: 554-data.crochet.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: connect to cluster8a.us.messagelabs.com[85.158.139.103]:25: Connection refused
Jan 31 09:52:30 myserver postfix/smtp[55861]: 3437C4876E: to=<[email protected]>, relay=mail3.uqam.ca[132.208.246.162]:25, delay=229181, delays=229180/0.2/0.45/0, dsn=4.0.0, status=deferred (host mail3.uqam.ca[132.208.246.162] refused to talk to me: 554-data.crochet.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55846]: 8503348BF7: to=<[email protected]>, relay=mail2.csc-scc.gc.ca[198.103.56.136]:25, delay=228588, delays=228587/0.12/0.68/0, dsn=4.0.0, status=deferred (host mail2.csc-scc.gc.ca[198.103.56.136] refused to talk to me: 554-mxlaval.csc-scc.gc.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: connect to cluster8a.us.messagelabs.com[216.82.251.230]:25: Connection refused
Jan 31 09:52:30 myserver postfix/smtp[55865]: A5E364984A: to=<[email protected]>, relay=mail2.uqam.ca[132.208.246.165]:25, delay=228559, delays=228558/0.27/0.46/0, dsn=4.0.0, status=deferred (host mail2.uqam.ca[132.208.246.165] refused to talk to me: 554-data.hamecon.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: F0E6948932: to=<[email protected]>, relay=none, delay=229161, delays=229161/0.33/0.4/0, dsn=4.4.1, status=deferred (connect to cluster8a.us.messagelabs.com[216.82.251.230]:25: Connection refused)
Jan 31 09:52:30 myserver postfix/smtp[55843]: A83CA486EF: to=<[email protected]>, relay=exch-spam02.ulaval.ca[132.203.244.24]:25, delay=229191, delays=229190/0.27/0.48/0, dsn=4.0.0, status=deferred (host exch-spam02.ulaval.ca[132.203.244.24] refused to talk to me: 554-exch-spam02.ulaval.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55845]: 2E49B4866E: host mx11.exchange.telus.com[205.206.208.34] refused to talk to me: 554-mx21.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 31 09:52:30 myserver postfix/smtp[55856]: 12A4A4DF0A: to=<[email protected]>, relay=mxmta.bellnet.ca[67.69.240.61]:25, delay=231626, delays=231625/0.17/0.92/0, dsn=4.4.2, status=deferred (lost connection with mxmta.bellnet.ca[67.69.240.61] while receiving the initial server greeting)
Jan 31 09:52:30 myserver postfix/smtp[55845]: 2E49B4866E: host mx12.exchange.telus.com[205.206.208.35] refused to talk to me: 554-mx22.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 31 09:52:30 myserver postfix/smtp[55850]: 53A1948A8C: to=<[email protected]>, relay=presmtp.ex1.secureserver.net[72.167.238.201]:25, delay=228581, delays=228579/0.15/1.2/0, dsn=4.0.0, status=deferred (host presmtp.ex1.secureserver.net[72.167.238.201] refused to talk to me: 554-p3pismtp01-057.prod.phx3.secureserver.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:31 myserver postfix/smtp[55844]: 955704945F: to=<[email protected]>, relay=MX.cogeco.ca[216.221.81.26]:25, delay=228598, delays=228596/0.1/1.4/0, dsn=4.4.2, status=deferred (lost connection with MX.cogeco.ca[216.221.81.26] while receiving the initial server greeting)
Jan 31 09:52:31 myserver postfix/smtp[55845]: 2E49B4866E: host mx13.exchange.telus.com[209.171.64.82] refused to talk to me: 554-mx24.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 31 09:52:31 myserver postfix/smtp[55845]: 2E49B4866E: to=<[email protected]>, relay=mx14.exchange.telus.com[209.171.64.83]:25, delay=229196, delays=229194/0.1/1.6/0, dsn=4.0.0, status=deferred (host mx14.exchange.telus.com[209.171.64.83] refused to talk to me: 554-mx25.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:31 myserver postfix/smtp[55862]: 343EB486F0: to=<[email protected]>, relay=none, delay=229190, delays=229188/0.21/1.5/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=inrs-ete.uquebec.ca type=MX: Host not found, try again)
Jan 31 09:52:33 myserver postfix/smtp[55847]: 611C348731: to=<[email protected]>, relay=none, delay=229189, delays=229185/0.13/3.3/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=coastalwinds.com type=MX: Host not found, try again)
Jan 31 09:52:33 myserver postfix/smtp[55848]: 6146948685: to=<[email protected]>, relay=mail3.uqam.ca[132.208.246.162]:25, delay=229195, delays=229191/0.14/3.5/0, dsn=4.0.0, status=deferred (host mail3.uqam.ca[132.208.246.162] refused to talk to me: 554-data.crochet.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:59 myserver postfix/smtp[55854]: connect to gmail.co[173.194.34.182]:25: Connection timed out
Jan 31 09:52:59 myserver postfix/smtp[55860]: connect to hortmail.com[65.55.39.10]:25: Connection timed out
Jan 31 09:52:59 myserver postfix/smtp[55855]: connect to saskpower.ca[65.39.140.84]:25: Connection timed out
Jan 31 09:52:59 myserver postfix/smtp[55855]: 022C148CCF: to=<[email protected]>, relay=none, delay=229153, delays=229123/0.15/30/0, dsn=4.4.1, status=deferred (connect to saskpower.ca[65.39.140.84]:25: Connection timed out)
Jan 31 09:53:00 myserver postfix/smtp[55866]: connect to remax-lethbridge.com[208.91.196.163]:25: Connection timed out
Jan 31 09:53:00 myserver postfix/smtp[55866]: B370A48B44: to=<[email protected]>, relay=none, delay=229168, delays=229137/0.28/30/0, dsn=4.4.1, status=deferred (connect to remax-lethbridge.com[208.91.196.163]:25: Connection timed out)
Jan 31 09:53:29 myserver postfix/smtp[55854]: connect to gmail.co[173.194.34.181]:25: Connection timed out
Jan 31 09:53:29 myserver postfix/smtp[55854]: 056994B723: to=<[email protected]>, relay=none, delay=228541, delays=228481/0.19/60/0, dsn=4.4.1, status=deferred (connect to gmail.co[173.194.34.181]:25: Connection timed out)
Jan 31 09:53:29 myserver postfix/smtp[55860]: connect to hortmail.com[64.4.6.100]:25: Connection timed out
Jan 31 09:53:29 myserver postfix/smtp[55860]: 3F3DE48F58: to=<[email protected]>, relay=none, delay=229137, delays=229076/0.19/60/0, dsn=4.4.1, status=deferred (connect to hortmail.com[64.4.6.100]:25: Connection timed out)
答案1
postsuper -h ALL将停止从您的服务器发送邮件。就这么做。现在就做。是的，这会影响实际的邮件。但是您的服务器已被列入黑名单，因此您的大部分实际邮件无论如何都无法投递。查看其中一封垃圾邮件的标题。这样你就能知道它们来自哪里。如果没有看到这些标题，我就无法给你更多信息。
清除队列中的垃圾邮件。如果您不关心队列中是否有任何“真实”邮件，删除整个队列将是最快捷、最容易的。使用 即可完成
postqueue -d ALL。如果您不想删除整个队列，请使用 打印出队列内容postqueue -p。然后，对于您确实想要发送的每封邮件，查看该邮件的队列 ID，并使用 将其从保留状态中删除postsuper -H queue_ID。完成此操作后（并复制了一些垃圾邮件的内容以供进一步分析），您可以通过运行 清除保留队列中剩余的垃圾邮件postsuper -d ALL hold。如果有，您需要立即关闭 postfix。在找出垃圾邮件的来源并确定已阻止垃圾邮件之前，请不要重新启动它。有关如何保护 postfix 服务器的信息，请访问后缀文档。如果您已经这样做了，但垃圾邮件仍然会通过，那么它可能是通过某些网络服务或其他恶意软件发送的。弄清楚这一点超出了这个问题的范围。
您的邮件服务器被列入黑名单。您需要通过 ISP 服务器等设置邮件中继，或者您需要退出黑名单。有关这方面的信息请访问http://www.spamhaus.org/。
答案2
您提供的日志片段不足以给您答复。此日志片段仅显示向未响应的服务器的传送尝试。它们似乎也是拼写错误的地址（gmail.co、hortmail.com，...）
答案3
造成这种情况的原因可能有以下几点。
您的服务器是否接受端口 25 上的传入连接？如果是，是否需要？它可能是一个开放代理，允许任何人使用您的 SMTP 服务器分发电子邮件。
如果它是网络服务器，则可能通过论坛软件或 WordPress 安装了恶意软件（对于后者，您可以使用自动扫描软件，例如http://wordpress.org/plugins/gotmls/）。
这将有助于查明电子邮件是从哪里发送的。
答案4
您添加的新日志显示其他邮件服务器拒绝来自您服务器的电子邮件，因为您的服务器在黑名单中，很可能是因为垃圾邮件是从您这边发送的（或曾经是）。这可能就是您的托管服务提供商所说的奇怪流量。
该日志显示，是的，您的服务器正在发送垃圾邮件，现在已被列入反垃圾邮件黑名单，但这还不足以找出原因。
我建议检查你的系统是否存在 rootkit/后门。此工具可能有帮助：