我的日志中充斥着这些垃圾邮件尝试，我想知道是否有 ACL 可以阻止这些尝试。
maillog（这只是一个示例，我的日志一小时内将超过 1000 行）
2016-07-09 22:00:32 [2252] 1bM4ys-0000aK-QP H=192-159-50-175.oolw.qwirelessbb.net (avovj.com) [192.159.50.175]:41053 I=[10.0.1.1]:465 Warning: DEBUG load_avgx1000: 40 spam_score: 3.2 message_size: 3497
2016-07-09 22:00:32 [2252] 1bM4ys-0000aK-QP <= [email protected] H=192-159-50-175.oolw.qwirelessbb.net (avovj.com) [192.159.50.175]:41053 I=[10.0.1.1]:465 P=esmtpsa X=UNKNOWN:AES256-GCM-SHA384:256 CV=no A=login:[email protected] S=5167 [email protected] T="nouvelles" from <[email protected]> for [email protected] [email protected] [email protected] [email protected] [email protected]
2016-07-09 22:00:32 [2401] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1bM4ys-0000aK-QP
2016-07-09 22:00:34 [2401] 1bM4ys-0000aK-QP => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4156 H=gmail-smtp-in.l.google.com [74.125.136.27]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com" C="250 2.0.0 OK 1468119641 qt8si326075wjc.22 - gsmtp" QT=4s DT=2s
2016-07-09 22:00:39 [2401] 1bM4ys-0000aK-QP => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4156 H=mta5.am0.yahoodns.net [98.138.112.33]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net" C="250 ok dirdel 4/0" QT=9s DT=7s
2016-07-09 22:00:39 [2401] 1bM4ys-0000aK-QP -> [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4156 H=mta5.am0.yahoodns.net [98.138.112.33]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net" C="250 ok dirdel 4/0" QT=9s DT=7s
2016-07-09 22:00:39 [2401] 1bM4ys-0000aK-QP -> [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4156 H=mta5.am0.yahoodns.net [98.138.112.33]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net" C="250 ok dirdel 4/0" QT=9s DT=7s
2016-07-09 22:00:39 [2401] 1bM4ys-0000aK-QP -> [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4156 H=mta5.am0.yahoodns.net [98.138.112.33]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net" C="250 ok dirdel 4/0" QT=9s DT=7s
2016-07-09 22:00:39 [2401] 1bM4ys-0000aK-QP Completed QT=9s
2016-07-09 22:00:41 [2252] 1bM4z2-0000aK-1R H=192-159-50-175.oolw.qwirelessbb.net (avovj.com) [192.159.50.175]:41053 I=[10.0.1.1]:465 Warning: DEBUG load_avgx1000: 30 spam_score: 1.2 message_size: 3405
2016-07-09 22:00:41 [2252] 1bM4z2-0000aK-1R <= [email protected] H=192-159-50-175.oolw.qwirelessbb.net (avovj.com) [192.159.50.175]:41053 I=[10.0.1.1]:465 P=esmtpsa X=UNKNOWN:AES256-GCM-SHA384:256 CV=no A=login:[email protected] S=5002 [email protected] T="c\342\200\231est si excitant" from <[email protected]> for [email protected] [email protected] [email protected] [email protected] [email protected]
2016-07-09 22:00:41 [2444] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1bM4z2-0000aK-1R
2016-07-09 22:00:44 [2444] 1bM4z2-0000aK-1R => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4060 H=gmail-smtp-in.l.google.com [74.125.136.27]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com" C="250 2.0.0 OK 1468119651 y142si5687414wme.31 - gsmtp" QT=4s DT=2s
2016-07-09 22:00:44 [2444] 1bM4z2-0000aK-1R -> [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4060 H=gmail-smtp-in.l.google.com [74.125.136.27]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com" C="250 2.0.0 OK 1468119651 y142si5687414wme.31 - gsmtp" QT=4s DT=2s
2016-07-09 22:00:46 [2444] 1bM4z2-0000aK-1R => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4060 H=mx4.hotmail.com [65.55.37.104]:25 X=UNKNOWN:ECDHE-RSA-AES256-SHA384:256 CV=no DN="/CN=*.hotmail.com" C="250 <[email protected]> Queued mail for delivery" QT=6s DT=4s
2016-07-09 22:00:51 [2444] 1bM4z2-0000aK-1R => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4060 H=mta5.am0.yahoodns.net [98.138.112.35]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net" C="250 ok dirdel" QT=11s DT=5s
2016-07-09 22:02:51 [2450] 1bM4z2-0000aK-1R mailrelay.tab.com.my [202.188.95.55]:25 Connection timed out
2016-07-09 22:02:51 [2444] 1bM4z2-0000aK-1R == [email protected] R=dnslookup T=remote_smtp defer (110): Connection timed out
2016-07-09 22:07:25 [2668] 1bM4z2-0000aK-1R == [email protected] R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2016-07-09 22:44:09 [3190] 1bM4z2-0000aK-1R mailrelay.tab.com.my [202.188.95.55]:25 Connection timed out
2016-07-09 22:44:09 [3189] 1bM4z2-0000aK-1R == [email protected] R=dnslookup T=remote_smtp defer (110): Connection timed out
2016-07-09 23:18:58 [5210] 1bM4z2-0000aK-1R mailrelay.tab.com.my [202.188.95.55]:25 Connection timed out
2016-07-09 23:18:58 [5209] 1bM4z2-0000aK-1R == [email protected] R=dnslookup T=remote_smtp defer (110): Connection timed out
2016-07-09 23:44:40 [5472] 1bM4z2-0000aK-1R mailrelay.tab.com.my [202.188.95.55]:25 Connection timed out
2016-07-09 23:44:40 [5471] 1bM4z2-0000aK-1R == [email protected] R=dnslookup T=remote_smtp defer (110): Connection timed out
2016-07-10 00:30:50 [6963] 1bM4z2-0000aK-1R mailrelay.tab.com.my [202.188.95.55]:25 Connection timed out
2016-07-10 00:30:50 [6962] 1bM4z2-0000aK-1R == [email protected] R=dnslookup T=remote_smtp defer (110): Connection timed out
2016-07-10 00:42:08 [7311] 1bM4z2-0000aK-1R == [email protected] R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2016-07-10 01:25:13 [9147] 1bM4z2-0000aK-1R == [email protected] R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2016-07-10 01:47:06 [9578] 1bM4z2-0000aK-1R failed to expand "${lookup mysql {SELECT domain FROM user WHERE domain='${quote_mysql:$domain}' UNION SELECT domain FROM alias WHERE domain='${quote_mysql:$domain}' UNION SELECT domain FROM catchall WHERE domain='${quote_mysql:$domain}'}}" while checking a list: lookup of "SELECT domain FROM user WHERE domain='tm.net.my' UNION SELECT domain FROM alias WHERE domain='tm.net.my' UNION SELECT domain FROM catchall WHERE domain='tm.net.my'" gave DEFER: MYSQL connection failed: Can't connect to local MySQL server through socket '/run/mysqld/mysqld.sock' (2 "No such file or directory")
2016-07-10 01:47:06 [9578] 1bM4z2-0000aK-1R == [email protected] R=uservacation defer (-1): domains check lookup or other defer
2016-07-10 01:47:23 [9742] 1bM4z2-0000aK-1R == [email protected] routing defer (-51): retry time not reached
2016-07-10 01:47:24 [9801] cwd=/home/admin 68 args: exim -Mrm 1bM4z2-0000aK-1R 1bM51q-0000fL-1B 1bM52c-0000fL-AK 1bM52l-0000fL-Mn 1bM52v-0000fL-4U 1bM56n-0000hM-8O 1bM56r-0000hM-UJ 1bM575-0000hM-Hi 1bM5TM-0000li-AB 1bM5TS-0000li-Ra 1bM5Yq-0000mp-Gt 1bM5d4-0000pM-Jt 1bM5l8-0000qH-SC 1bM5lE-0000qH-Oq 1bM5lQ-0000qH-Gy 1bM5lT-0000qH-Kj 1bM5ld-0000qH-FR 1bM5mA-0000se-IN 1bM5mH-0000se-Jy 1bM5mP-0000se-65 1bM68I-0001Eg-Sw 1bM68x-0001Eg-ID 1bM6Xu-0001Pi-OD 1bM6ba-0001QJ-I8 1bM6bk-0001QJ-Om 1bM6bs-0001QJ-AT 1bM6bz-0001QJ-AL 1bM6c4-0001QJ-P4 1bM6cD-0001QJ-1b 1bM6oE-0001Si-IX 1bM6oR-0001Si-23 1bM6oX-0001Si-GL 1bM6yf-0001e4-Mf 1bM6yp-0001e4-TJ 1bM71Z-0001g8-2B 1bM71g-0001g8-Qm 1bM71o-0001g8-6z 1bM71t-0001g8-9L 1bM75g-0001jI-B6 1bM75t-0001jI-7W 1bM75z-0001jI-I3 1bM7Ki-0001pf-6t 1bM7Kv-0001pf-6e 1bM7L8-0001pn-Mk 1bM7dj-0001vg-2a 1bM7e1-0001vg-3w 1bM7e6-0001vg-TP 1bM7hP-0001xz-VL 1bM7kZ-00020e-19 1bM7kf-00020e-AH 1bM7kn-00020e-0G 1bM7ks-00020e-6h 1bM7ky-00020e-8q 1bM7l2-00020e-Or 1bM7l7-00020e-Ay 1bM7lC-00020e-8N 1bM7lI-00020e-6R 1bM7lN-00020e-Eh 1bM7qH-0002Bu-Mm 1bM7qY-0002Bu-IK 1bM8E9-0002OG-0J 1bM8EB-0002OG-HP 1bM8EE-0002OG-0j 1bM8EG-0002OG-GX 1bM8EI-0002OG-W7 1bM8EQ-0002OG-GW
2016-07-10 01:47:24 [9801] 1bM4z2-0000aK-1R removed by root
2016-07-10 01:47:24 [9801] 1bM4z2-0000aK-1R Completed
2016-07-09 22:01:28 [2252] 1bM4zm-0000aK-JP H=192-159-50-175.oolw.qwirelessbb.net (avovj.com) [192.159.50.175]:41053 I=[10.0.1.1]:465 Warning: DEBUG load_avgx1000: 10 spam_score: 3.2 message_size: 3482
2016-07-09 22:01:28 [2252] 1bM4zm-0000aK-JP <= [email protected] H=192-159-50-175.oolw.qwirelessbb.net (avovj.com) [192.159.50.175]:41053 I=[10.0.1.1]:465 P=esmtpsa X=UNKNOWN:AES256-GCM-SHA384:256 CV=no A=login:[email protected] S=5153 [email protected] T="c\342\200\231est si incroyable" from <[email protected]> for [email protected] [email protected] [email protected] [email protected] [email protected]
2016-07-09 22:01:28 [2508] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1bM4zm-0000aK-JP
2016-07-09 22:01:38 [2508] 1bM4zm-0000aK-JP => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4140 H=mta6.am0.yahoodns.net [98.136.217.203]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net" C="250 ok dirdel 2/0" QT=12s DT=6s
2016-07-09 22:01:38 [2508] 1bM4zm-0000aK-JP -> [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4140 H=mta6.am0.yahoodns.net [98.136.217.203]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net" C="250 ok dirdel 2/0" QT=12s DT=6s
2016-07-09 22:01:39 [2508] 1bM4zm-0000aK-JP => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4140 H=cx1.1govuc.gov.my [103.245.89.1]:25 X=UNKNOWN:DHE-RSA-AES256-GCM-SHA384:256 CV=no DN="/C=CN/ST=Bj/L=Bj/O=Websense/CN=Email/[email protected]" C="250 2.0.0 Ok: queued as 01AE0514FBB62" QT=13s DT=7s
2016-07-09 22:01:41 [2508] 1bM4zm-0000aK-JP => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4140 H=mx-eu.mail.am0.yahoodns.net [188.125.69.79]:25 X=UNKNOWN:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no DN="/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net" C="250 ok dirdel" QT=15s DT=3s
2016-07-09 22:01:43 [2508] 1bM4zm-0000aK-JP => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4140 H=mx3.hotmail.com [65.55.92.136]:25 X=UNKNOWN:ECDHE-RSA-AES256-SHA384:256 CV=no DN="/CN=*.hotmail.com" C="250 <[email protected]> Queued mail for delivery" QT=17s DT=4s
2016-07-09 22:01:43 [2508] 1bM4zm-0000aK-JP Completed QT=17s
2016-07-09 22:04:23 [2563] 1bM52c-0000fL-AK H=(mdju.com) [187.28.85.176]:39330 I=[10.0.1.1]:465 Warning: DEBUG load_avgx1000: 200 spam_score: 2.4 message_size: 3449
2016-07-09 22:04:23 [2563] 1bM52c-0000fL-AK <= [email protected] H=(mdju.com) [187.28.85.176]:39330 I=[10.0.1.1]:465 P=esmtpsa X=UNKNOWN:AES256-GCM-SHA384:256 CV=no A=login:[email protected] S=5051 [email protected] T="choses faciles" from <[email protected]> for [email protected] [email protected] [email protected] [email protected] [email protected]
2016-07-09 22:04:23 [2614] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1bM52c-0000fL-AK
2016-07-09 22:04:27 [2614] 1bM52c-0000fL-AK => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4073 H=mailemv.find-xtrem.com [91.121.142.105]:25 C="250 ok 1468119589 qp 6905" QT=5s DT=1s
2016-07-09 22:04:27 [2614] 1bM52c-0000fL-AK => [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4073 H=smtpe1.emv3.com [81.92.120.9]:25 C="250 2.0.0 Ok: queued as 3CD9E1DC87A" QT=5s DT=1s
2016-07-09 22:04:28 [2614] 1bM52c-0000fL-AK ** [email protected] F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<[email protected]>: host vidf.web-amour.net [91.121.142.105]: 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)
2016-07-09 22:04:28 [2614] 1bM52c-0000fL-AK => [email protected] <[email protected]> F=<[email protected]> P=<[email protected]> R=dnslookup T=remote_smtp S=4073 H=spectacles91.fr.mail-in.bp01.net [83.206.208.149]:25 C="250 2.6.0 message received" QT=6s DT=0s
2016-07-09 22:05:27 [2617] 1bM52c-0000fL-AK Remote host offrir-fleurs.net [192.230.66.93] closed connection in response to initial connection
2016-07-09 22:06:28 [2617] 1bM52c-0000fL-AK Remote host offrir-fleurs.net [192.230.74.93] closed connection in response to initial connection
2016-07-09 22:06:28 [2614] 1bM52c-0000fL-AK == [email protected] R=dnslookup T=remote_smtp defer (-18): Remote host offrir-fleurs.net [192.230.74.93] closed connection in response to initial connection
2016-07-09 22:06:28 [2643] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1bM52c-0000fL-AK
2016-07-09 22:06:28 [2643] 1bM54e-0000gd-A4 <= <> R=1bM52c-0000fL-AK U=exim P=local S=6066 T="Mail delivery failed: returning message to sender" from <> for [email protected]
2016-07-09 22:07:25 [2670] 1bM52c-0000fL-AK == [email protected] R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2016-07-09 22:52:23 [3486] 1bM52c-0000fL-AK == [email protected] R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2016-07-09 23:11:58 [4614] 1bM52c-0000fL-AK == [email protected] R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2016-07-09 23:39:43 [5416] 1bM52c-0000fL-AK == [email protected] R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2016-07-10 00:45:56 [7367] 1bM52c-0000fL-AK == [email protected] R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2016-07-10 00:50:25 [7414] 1bM52c-0000fL-AK == [email protected] R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2016-07-10 01:47:07 [9590] 1bM52c-0000fL-AK failed to expand "${lookup mysql {SELECT domain FROM user WHERE domain='${quote_mysql:$domain}' UNION SELECT domain FROM alias WHERE domain='${quote_mysql:$domain}' UNION SELECT domain FROM catchall WHERE domain='${quote_mysql:$domain}'}}" while checking a list: lookup of "SELECT domain FROM user WHERE domain='offrir-fleurs.net' UNION SELECT domain FROM alias WHERE domain='offrir-fleurs.net' UNION SELECT domain FROM catchall WHERE domain='offrir-fleurs.net'" gave DEFER: MYSQL connection failed: Can't connect to local MySQL server through socket '/run/mysqld/mysqld.sock' (2 "No such file or directory")
2016-07-10 01:47:07 [9590] 1bM52c-0000fL-AK == [email protected] R=uservacation defer (-1): domains check lookup or other defer
2016-07-10 01:47:23 [9762] 1bM52c-0000fL-AK == [email protected] routing defer (-51): retry time not reached
2016-07-10 01:47:24 [9801] cwd=/home/admin 68 args: exim -Mrm 1bM4z2-0000aK-1R 1bM51q-0000fL-1B 1bM52c-0000fL-AK 1bM52l-0000fL-Mn 1bM52v-0000fL-4U 1bM56n-0000hM-8O 1bM56r-0000hM-UJ 1bM575-0000hM-Hi 1bM5TM-0000li-AB 1bM5TS-0000li-Ra 1bM5Yq-0000mp-Gt 1bM5d4-0000pM-Jt 1bM5l8-0000qH-SC 1bM5lE-0000qH-Oq 1bM5lQ-0000qH-Gy 1bM5lT-0000qH-Kj 1bM5ld-0000qH-FR 1bM5mA-0000se-IN 1bM5mH-0000se-Jy 1bM5mP-0000se-65 1bM68I-0001Eg-Sw 1bM68x-0001Eg-ID 1bM6Xu-0001Pi-OD 1bM6ba-0001QJ-I8 1bM6bk-0001QJ-Om 1bM6bs-0001QJ-AT 1bM6bz-0001QJ-AL 1bM6c4-0001QJ-P4 1bM6cD-0001QJ-1b 1bM6oE-0001Si-IX 1bM6oR-0001Si-23 1bM6oX-0001Si-GL 1bM6yf-0001e4-Mf 1bM6yp-0001e4-TJ 1bM71Z-0001g8-2B 1bM71g-0001g8-Qm 1bM71o-0001g8-6z 1bM71t-0001g8-9L 1bM75g-0001jI-B6 1bM75t-0001jI-7W 1bM75z-0001jI-I3 1bM7Ki-0001pf-6t 1bM7Kv-0001pf-6e 1bM7L8-0001pn-Mk 1bM7dj-0001vg-2a 1bM7e1-0001vg-3w 1bM7e6-0001vg-TP 1bM7hP-0001xz-VL 1bM7kZ-00020e-19 1bM7kf-00020e-AH 1bM7kn-00020e-0G 1bM7ks-00020e-6h 1bM7ky-00020e-8q 1bM7l2-00020e-Or 1bM7l7-00020e-Ay 1bM7lC-00020e-8N 1bM7lI-00020e-6R 1bM7lN-00020e-Eh 1bM7qH-0002Bu-Mm 1bM7qY-0002Bu-IK 1bM8E9-0002OG-0J 1bM8EB-0002OG-HP 1bM8EE-0002OG-0j 1bM8EG-0002OG-GX 1bM8EI-0002OG-W7 1bM8EQ-0002OG-GW
2016-07-10 01:47:24 [9801] 1bM52c-0000fL-AK removed by root
2016-07-10 01:47:24 [9801] 1bM52c-0000fL-AK Completed
答案1
看起来您正在运行开放中继。将您的服务器配置为仅排队并清除假脱机中的垃圾邮件。 mailq并且exim4 -Mad这些命令可能会有所帮助。
解决问题时，您可能需要防火墙或/以及关闭服务器。除非服务器宕机几天，否则合法的来信不会退回。
检查您的配置中的relay_domains和relay_nets设置。Relay_domains应该为空。Relay_nets应该为空，或者至少仅限于您的LAN网络。如果您使用默认配置，这应该可以解决您的问题。