我收到大量针对随机用户名的垃圾邮件尝试。我知道所有邮件服务器都会遇到这种情况，但在过去两周内，由于邮件日志文件的大小，我的 VPS 磁盘配额已经满了！一周的日志几乎有 7GB，其他日志较小但不正常。我是阅读日志的新手，但这里有一小段随机选择的片段：
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 05DEA31470BF: from=<[email protected]>, size=1165, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 05DEA31470BF: to=<[email protected]>, relay=none, delay=358802, delays=358802/0.07/0/0, dsn=4.4.2, status=deferred (delivery temporarily suspended: lost connection with mta5.am0.yahoodns.net[66.196.118.34] while sending RCPT TO)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 00B053186BAE: from=<[email protected]>, size=1123, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27246]: 00DAD31454C1: to=<[email protected]>, relay=local, delay=391867, delays=391867/0.13/0/0.02, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "ginger_walton")
Sep 11 03:53:16 vps-1011517-5697 postfix/smtp[26812]: 0099B3136B26: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[74.125.204.27]:25, delay=107076, delays=107075/0/0.39/0.68, dsn=4.7.1, status=SOFTBOUNCE (host gmail-smtp-in.l.google.com[74.125.204.27] said: 550-5.7.1 [27.112.107.68 1] Our system has detected an unusual rate of 550-5.7.1 unsolicited mail originating from your IP address. To protect our 550-5.7.1 users from spam, mail sent from your IP address has been blocked. 550-5.7.1 Please visit 550-5.7.1 https://support.google.com/mail/?p=UnsolicitedIPError to review our 550 5.7.1 Bulk Email Senders Guidelines. q189si11097060pfq.189 - gsmtp (in reply to end of DATA command))
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 00ECD3169334: from=<[email protected]>, size=1106, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 00ECD3169334: to=<[email protected]>, relay=none, delay=246340, delays=246340/0.02/0/0, dsn=4.4.2, status=deferred (delivery temporarily suspended: lost connection with mta5.am0.yahoodns.net[66.196.118.34] while sending RCPT TO)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0231E3138414: from=<[email protected]>, size=1560, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0231E3138414: to=<[email protected]>, relay=none, delay=14482, delays=14482/0/0/0, dsn=4.4.2, status=deferred (delivery temporarily suspended: lost connection with mta5.am0.yahoodns.net[66.196.118.34] while sending RCPT TO)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 062593144D72: from=<>, size=3463, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 08A1D31498F3: from=<>, size=3045, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27247]: 062593144D72: to=<[email protected]>, relay=local, delay=396966, delays=396966/0.01/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "isabel_miles")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0D692313F1DA: from=<>, size=3078, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 00EA0313F88E: from=<>, size=3464, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27248]: 08A1D31498F3: to=<[email protected]>, relay=local, delay=321787, delays=321787/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "bridget_harrison")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0F2A33147B48: from=<>, size=3657, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27246]: 0D692313F1DA: to=<[email protected]>, relay=local, delay=430240, delays=430240/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "freda_gordon")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 046C83133878: from=<[email protected]>, size=1180, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27247]: 00EA0313F88E: to=<[email protected]>, relay=local, delay=425180, delays=425180/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "amelia_hanson")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 035633144D87: from=<>, size=3087, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 019673137E30: from=<[email protected]>, size=1161, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27248]: 0F2A33147B48: to=<[email protected]>, relay=local, delay=347073, delays=347073/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "della_wright")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 01F593146A8D: from=<>, size=3579, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27246]: 035633144D87: to=<[email protected]>, relay=local, delay=396952, delays=396952/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "kelley_strickland")
Sep 11 03:53:16 vps-1011517-5697 postfix/smtp[27074]: 0423D31361AE: to=<[email protected]>, relay=mx3.hotmail.com[65.55.37.72]:25, delay=33557, delays=33557/0.01/0.38/0.12, dsn=4.0.0, status=SOFTBOUNCE (host mx3.hotmail.com[65.55.37.72] said: 550 SC-002 (COL004-MC1F20) Unfortunately, messages from 27.112.107.68 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors. (in reply to MAIL FROM command))
Sep 11 03:53:16 vps-1011517-5697 postfix/smtp[27074]: 0423D31361AE: lost connection with mx3.hotmail.com[65.55.37.72] while sending RCPT TO
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 078CF312D56D: from=<>, size=3751, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27247]: 01F593146A8D: to=<[email protected]>, relay=local, delay=371261, delays=371261/0.02/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "eva_morrison")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 0CB143130F4A: from=<>, size=3022, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27248]: 078CF312D56D: to=<[email protected]>, relay=local, delay=321700, delays=321700/0.01/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "gwen_mendoza")
Sep 11 03:53:16 vps-1011517-5697 postfix/qmgr[31514]: 02A0C31284D7: from=<>, size=3032, nrcpt=1 (queue active)
Sep 11 03:53:16 vps-1011517-5697 postfix/local[27246]: 0CB143130F4A: to=<[email protected]>, relay=local, delay=242903, delays=242903/0.01/0/0, dsn=4.1.1, status=SOFTBOUNCE (unknown user: "marcia_harvey")
三个思考：
- 我对“软反弹”的理解并不符合这种情况 - 无效用户名应该是硬反弹，对吗？无论如何，我宁愿没有任何反弹，因为这既浪费资源，又会给垃圾邮件发送者太多信息。
- 我不明白 Google 服务器的投诉文本 - 数字“500-5.7.1”似乎是随机插入到句子中的。但我认为，如果这些外发的退回邮件数量足够多，它们本身就可以被解释为垃圾邮件，对吗？
- 法国 Hotmail 对黑名单的投诉可能是由我的服务器或其他人的服务器引起的；检查 107 个黑名单后，只有两个报告了我的 IP，因此我认为我的网站上没有真正的垃圾邮件生成器或类似的东西。
无论如何，我在域中只有一个有效用户名，那么是否可以配置 postfix 以简单地放弃向任何其他用户名发送邮件的任何尝试？如果没有发送退回邮件，甚至日志文件中没有任何内容，我会很高兴，因为正如我所说，日志文件本身已经满了。或者如果有更好的方法来处理这种攻击，我愿意倾听。
编辑＃1：为了回应关于连接/断开连接条目的评论，我搜索了第一次出现的“ connect ”（周围有空格 - 否则我会得到所有“丢失连接”条目），然后 grep 了对同一邮件服务器的后续引用。这是第一个序列，它们发生在两秒的时间内，因此可能与同一封电子邮件尝试有关：
Sep 11 03:53:25 vps-1011517-5697 postfix/smtpd[20505]: connect from simcoe209srvr.owm.bell.net[184.150.200.209]
Sep 11 03:53:25 vps-1011517-5697 postfix/smtpd[20505]: setting up TLS connection from simcoe209srvr.owm.bell.net[184.150.200.209]
Sep 11 03:53:26 vps-1011517-5697 postfix/smtpd[20505]: TLS connection established from simcoe209srvr.owm.bell.net[184.150.200.209]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bi
ts)
Sep 11 03:53:26 vps-1011517-5697 postfix/smtpd[20505]: NOQUEUE: reject: RCPT from simcoe209srvr.owm.bell.net[184.150.200.209]: 450 4.1.1 <[email protected]>: Recipient address
rejected: User unknown in local recipient table; from=<> to=<[email protected]> proto=ESMTP helo=<torfep04.bell.net>
Sep 11 03:53:27 vps-1011517-5697 postfix/smtpd[20505]: disconnect from simcoe209srvr.owm.bell.net[184.150.200.209]
这些不是日志中的连续条目；在相同的两秒钟内有大量不相关的条目。但是如果你想让我在中间搜索相关的东西，只要告诉我要寻找什么就行了。
编辑＃2：回复 JennyD，这是我的 /etc/postfix/main.cf（当然，删除了注释）：
soft_bounce = yes
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
mail_owner = postfix
myhostname = l4jp.com
mydomain = l4jp.com
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
unknown_local_recipient_reject_code = 550
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
debug_peer_level = 2
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
xxgdb $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.3.3/samples
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
# THE FOLLOWING IS FROM: http://www.anchor.com.au/hosting/dedicated/Postfix-SASL-setup
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
permit_mynetworks
permit_sasl_authenticated
reject_unauth_destination
smtpd_tls_security_level = may
smtpd_tls_key_file = /etc/ssl/smtpd.key
smtpd_tls_cert_file = /etc/ssl/smtpd.crt
smtpd_tls_auth_only = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
#My settings for virtual mailbox domains (which I don't think I actually use for anything)
virtual_mailbox_domains = /etc/postfix/vhosts.txt
virtual_mailbox_base = /var/spool/vmail
virtual_mailbox_maps = hash:/etc/postfix/vmaps.txt
virtual_minimum_uid = 100
virtual_uid_maps = static:101
virtual_gid_maps = static:101
message_size_limit = 30720000
编辑＃3：Dom 建议将 softbounce 设置为 no。我在进行此项更改之前和之后都发送了一封测试电子邮件 - 以下是相关日志条目（已清理发件人地址）：
Sep 12 20:38:39 vps-1011517-5697 postfix/smtpd[5343]: connect from gateway21.websitewelcome.com[192.185.45.43]
Sep 12 20:38:39 vps-1011517-5697 postfix/smtpd[5343]: setting up TLS connection from gateway21.websitewelcome.com[192.185.45.43]
Sep 12 20:38:39 vps-1011517-5697 postfix/smtpd[5343]: TLS connection established from gateway21.websitewelcome.com[192.185.45.43]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Sep 12 20:38:40 vps-1011517-5697 postfix/smtpd[5343]: NOQUEUE: reject: RCPT from gateway21.websitewelcome.com[192.185.45.43]: 450 4.1.1 <[email protected]>: Recipient address rejected: User unknown in local recipient table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<gateway21.websitewelcome.com>
Sep 12 20:38:40 vps-1011517-5697 postfix/smtpd[5343]: disconnect from gateway21.websitewelcome.com[192.185.45.43]
Sep 12 20:43:06 vps-1011517-5697 postfix/smtpd[6400]: connect from gateway23.websitewelcome.com[192.185.50.119]
Sep 12 20:43:06 vps-1011517-5697 postfix/smtpd[6400]: setting up TLS connection from gateway23.websitewelcome.com[192.185.50.119]
Sep 12 20:43:07 vps-1011517-5697 postfix/smtpd[6400]: TLS connection established from gateway23.websitewelcome.com[192.185.50.119]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Sep 12 20:43:07 vps-1011517-5697 postfix/smtpd[6400]: NOQUEUE: reject: RCPT from gateway23.websitewelcome.com[192.185.50.119]: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in local recipient table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<gateway23.websitewelcome.com>
Sep 12 20:43:07 vps-1011517-5697 postfix/smtpd[6400]: disconnect from gateway23.websitewelcome.com[192.185.50.119]
两种情况下都有五个条目 - 日志中唯一的区别是错误代码（如预期的那样）。但在更改之后，我收到了发送到我发送测试的地址的实际退回邮件。这对垃圾邮件发送者来说难道不是一件坏事吗？
编辑#4：回应 masegaloeh 的评论，要求提供与同一消息队列 ID 相关的所有条目。他作为示例给出的 ID 来自我关闭 soft_bounce 之前的原始文件，但我怀疑没有 soft_bounce 的 ID 更有用，因此这里有一个非常最近的随机示例：
[root](10:27:06)[~]$ grep E6CBF312663B /var/log/maillog
Sep 15 10:26:11 vps-1011517-5697 postfix/cleanup[10347]: E6CBF312663B: message-id=<[email protected]>
Sep 15 10:26:11 vps-1011517-5697 postfix/bounce[10292]: 47A8E3126F85: sender non-delivery notification: E6CBF312663B
Sep 15 10:26:11 vps-1011517-5697 postfix/qmgr[8701]: E6CBF312663B: from=<>, size=3801, nrcpt=1 (queue active)
Sep 15 10:26:11 vps-1011517-5697 postfix/local[10477]: E6CBF312663B: to=<[email protected]>, relay=local, delay=0, delays=0/0/0/0, dsn=5.1.1, status=bounced (unknown user: "eula_mcdonald")
Sep 15 10:26:11 vps-1011517-5697 postfix/qmgr[8701]: E6CBF312663B: removed
当前日志文件仅在约 2.5 天内就增长到 1.2GB。我无法维持这种速度……
编辑＃5：接下来，masegaloeh 提出了以下要求：
[root](09:03:50)[/var/log]$ grep 47A8E3126F85 maillog
Sep 15 10:26:10 vps-1011517-5697 postfix/pickup[10444]: 47A8E3126F85: uid=500 from=<[email protected]>
Sep 15 10:26:10 vps-1011517-5697 postfix/cleanup[10347]: 47A8E3126F85: message-id=<[email protected]>
Sep 15 10:26:10 vps-1011517-5697 postfix/qmgr[8701]: 47A8E3126F85: from=<[email protected]>, size=1153, nrcpt=1 (queue active)
Sep 15 10:26:11 vps-1011517-5697 postfix/smtp[9981]: 47A8E3126F85: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[64.233.189.27]:25, delay=1.7, delays=0.02/0.39/0.51/0.75, dsn=5.7.1, status=bounced (host gmail-smtp-in.l.google.com[64.233.189.27] said: 550-5.7.1 [27.112.107.68 1] Our system has detected an unusual rate of 550-5.7.1 unsolicited mail originating from your IP address. To protect our 550-5.7.1 users from spam, mail sent from your IP address has been blocked. 550-5.7.1 Please visit 550-5.7.1 https://support.google.com/mail/?p=UnsolicitedIPError to review our 550 5.7.1 Bulk Email Senders Guidelines. n130si231260oig.169 - gsmtp (in reply to end of DATA command))
Sep 15 10:26:11 vps-1011517-5697 postfix/bounce[10292]: 47A8E3126F85: sender non-delivery notification: E6CBF312663B
Sep 15 10:26:11 vps-1011517-5697 postfix/qmgr[8701]: 47A8E3126F85: removed
编辑#6：采取了 Michael Hampton 建议的措施后，我再次查看了日志的尾部。“接受投递”字样引起了我的注意，因为我没有发送或接收任何真正的邮件 - 以下是与我注意到的邮件相关的一系列信息：
[root](15:01:16)[/var/log]$ grep 638BD3122039 maillog
Sep 17 14:59:34 vps-1011517-5697 postfix/pickup[8959]: 638BD3122039: uid=500 from=<[email protected]>
Sep 17 14:59:34 vps-1011517-5697 postfix/cleanup[9099]: 638BD3122039: message-id=<[email protected]>
Sep 17 14:59:34 vps-1011517-5697 postfix/qmgr[7492]: 638BD3122039: from=<[email protected]>, size=1185, nrcpt=1 (queue active)
Sep 17 14:59:38 vps-1011517-5697 postfix/smtp[9109]: 638BD3122039: to=<[email protected]>, relay=gw-eur1.smtp.philips.com[212.159.218.9]:25, delay=3.6, delays=0.07/0.01/1.6/2, dsn=2.0.0, status=sent (250 2.0.0 kVzb1t0041UaJoz01VzcmY mail accepted for delivery)
Sep 17 14:59:38 vps-1011517-5697 postfix/qmgr[7492]: 638BD3122039: removed
当然这里没有 juanita_ellis。什么原因导致该消息被发送？我真的在发送垃圾邮件吗？
答案1
我没有看到mynetworks =您 Postfix 配置中指定的内容main.cf。
如果未指定，则与您位于同一本地网络上的任何人都可以通过您的服务器转发邮件而无需身份验证，从而使您的邮件服务器至少在某种程度上成为开放的中继。如果您的系统具有全局 IP 地址，例如因为您托管在某种 VPS 提供商（如 Digital Ocean）上，那么这使得它容易受到附近托管在同一提供商上的机器的攻击。
这应该修复立即地。
将其锁定，以便只有本地主机可以通过服务器发送未经身份验证的邮件：
mynetworks = 127.0.0.0/8 [::1]/128
另外，请考虑删除服务器上所有排队的邮件（垃圾邮件！），以便 Postfix 不会尝试重新发送它。
使用 查看队列mailq，如果没有看到任何合法内容，请使用 删除所有内容postsuper -d ALL。
您的最后编辑清楚地表明，系统上的本地进程正在生成邮件。该进程以 uid 500 运行，这很可能是您的帐户。因此，看起来您已被入侵。从轨道上将其核爆；这是唯一可以确定的方法。