unglaublich, was in den letzten Wochen auf meinem Server SMTP-maessig abgegangen ist und es wird immer schlimmer.
Pro Tag kommen bei 500 "echten" Mails ca 1500 Spammails rein bzw werden direkt vor der Annahme weggefischt und verworfen. Mein Server checkt auf RBL-Listen, Header- und Body-Content und natuerlich auch, ob es den Mailalias gibt.
Hier mal ein kleiner Auszug aus meinem Log von gestern, nur fuer eine meiner 40 Domains:
Nur ein kleiner Auszug wie gesagt, der eine Angreifer war noch viel aktiver.Jul 6 08:00:01 rootserver postfix/smtpd[30858]: NOQUEUE: reject: RCPT from unknown[219.241.51.21]: 554 Service unavailable; Client host [219.241.51.21] blocked using list.dsbl.org; http://dsbl.org/listing?ip=219.241.51.21; from=<ynwlarhsbfq@basemail.com.br> to=<leonard@domain.tld> proto=SMTP helo=<219.241.51.21>
Jul 6 08:00:02 rootserver postfix/smtpd[30858]: NOQUEUE: reject: RCPT from unknown[219.241.51.21]: 554 Service unavailable; Client host [219.241.51.21] blocked using list.dsbl.org; http://dsbl.org/listing?ip=219.241.51.21; from=<ynwlarhsbfq@basemail.com.br> to=<terry@domain.tld> proto=SMTP helo=<219.241.51.21>
Jul 6 08:00:02 rootserver postfix/smtpd[30858]: NOQUEUE: reject: RCPT from unknown[219.241.51.21]: 554 Service unavailable; Client host [219.241.51.21] blocked using list.dsbl.org; http://dsbl.org/listing?ip=219.241.51.21; from=<ynwlarhsbfq@basemail.com.br> to=<cruz@domain.tld> proto=SMTP helo=<219.241.51.21>
Jul 6 08:00:03 rootserver postfix/smtpd[30858]: NOQUEUE: reject: RCPT from unknown[219.241.51.21]: 554 Service unavailable; Client host [219.241.51.21] blocked using list.dsbl.org; http://dsbl.org/listing?ip=219.241.51.21; from=<ynwlarhsbfq@basemail.com.br> to=<thornton@domain.tld> proto=SMTP helo=<219.241.51.21>
Jul 6 08:00:04 rootserver postfix/smtpd[30858]: NOQUEUE: reject: RCPT from unknown[219.241.51.21]: 554 Service unavailable; Client host [219.241.51.21] blocked using list.dsbl.org; http://dsbl.org/listing?ip=219.241.51.21; from=<ynwlarhsbfq@basemail.com.br> to=<hanson@domain.tld> proto=SMTP helo=<219.241.51.21>
Jul 6 08:00:05 rootserver postfix/smtpd[30858]: NOQUEUE: reject: RCPT from unknown[219.241.51.21]: 554 Service unavailable; Client host [219.241.51.21] blocked using list.dsbl.org; http://dsbl.org/listing?ip=219.241.51.21; from=<ynwlarhsbfq@basemail.com.br> to=<schultz@domain.tld> proto=SMTP helo=<219.241.51.21>
Geht aber noch unverschaemter:
Viele Angreifer und das alles gleichzeit wenn man mal auf die Uhrzeit schaut. Da kamen gestern morgen mehrere Dutzend Versuche pro Sekunde, was natuerlich nach ca 60 Sekunden den MySQL-Server mit den standardmaessig eingestellten 100 gleichzeitigen Verbindungen in die Knie gezwungen hat.Jul 6 10:54:50 rootserver postfix/smtpd[1879]: NOQUEUE: reject: RCPT from unknown[62.211.132.72]: 550 <berry@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<uskhefwfuj@danbonet.dk> to=<berry@domain.tld> proto=SMTP helo=<danbonet.dk>
Jul 6 10:54:50 rootserver postfix/smtpd[1882]: NOQUEUE: reject: RCPT from catv-50629964.catv.broadband.hu[80.98.153.100]: 550 <pierce@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<bjefhdwqh@udms.co.za> to=<pierce@domain.tld> proto=SMTP helo=<udms.co.za>
Jul 6 10:54:50 rootserver postfix/smtpd[1904]: NOQUEUE: reject: RCPT from unknown[82.77.42.194]: 550 <bowen@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<gakaja@vsicorp.com> to=<bowen@domain.tld> proto=SMTP helo=<vsicorp.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1899]: NOQUEUE: reject: RCPT from unknown[195.244.142.189]: 554 Service unavailable; Client host [195.244.142.189] blocked using list.dsbl.org; http://dsbl.org/listing?ip=195.244.142.189; from=<maccu@cisdk.dk> to=<west@domain.tld> proto=SMTP helo=<cisdk.dk>
Jul 6 10:54:50 rootserver postfix/smtpd[1888]: NOQUEUE: reject: RCPT from unknown[195.150.133.13]: 550 <barber@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<lmegjyw@blackhillsproperties.com> to=<barber@domain.tld> proto=SMTP helo=<blackhillsproperties.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1885]: NOQUEUE: reject: RCPT from chello080109195026.4.graz.surfer.at[80.109.195.26]: 550 <hines@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<omrtlo@emailthis.com> to=<hines@domain.tld> proto=SMTP helo=<emailthis.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1882]: NOQUEUE: reject: RCPT from catv-50629964.catv.broadband.hu[80.98.153.100]: 550 <reeves@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<bjefhdwqh@udms.co.za> to=<reeves@domain.tld> proto=SMTP helo=<udms.co.za>
Jul 6 10:54:50 rootserver postfix/smtpd[1904]: NOQUEUE: reject: RCPT from unknown[82.77.42.194]: 550 <santos@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<gakaja@vsicorp.com> to=<santos@domain.tld> proto=SMTP helo=<vsicorp.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1885]: NOQUEUE: reject: RCPT from chello080109195026.4.graz.surfer.at[80.109.195.26]: 550 <tate@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<omrtlo@emailthis.com> to=<tate@domain.tld> proto=SMTP helo=<emailthis.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1879]: NOQUEUE: reject: RCPT from unknown[62.211.132.72]: 550 <burgess@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<uskhefwfuj@danbonet.dk> to=<burgess@domain.tld> proto=SMTP helo=<danbonet.dk>
Jul 6 10:54:50 rootserver postfix/smtpd[1888]: NOQUEUE: reject: RCPT from unknown[195.150.133.13]: 550 <garner@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<lmegjyw@blackhillsproperties.com> to=<garner@domain.tld> proto=SMTP helo=<blackhillsproperties.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1899]: NOQUEUE: reject: RCPT from unknown[195.244.142.189]: 554 Service unavailable; Client host [195.244.142.189] blocked using list.dsbl.org; http://dsbl.org/listing?ip=195.244.142.189; from=<maccu@cisdk.dk> to=<cross@domain.tld> proto=SMTP helo=<cisdk.dk>
Jul 6 10:54:50 rootserver postfix/smtpd[1868]: NOQUEUE: reject: RCPT from ACaen-202-1-1-63.w81-53.abo.wanadoo.fr[81.53.140.63]: 554 Service unavailable; Client host [81.53.140.63] blocked using list.dsbl.org; http://dsbl.org/listing?ip=81.53.140.63; from=<jjdpwu@ellishayward.co.uk> to=<jordan@domain.tld> proto=SMTP helo=<ellishayward.co.uk>
Jul 6 10:54:50 rootserver postfix/smtpd[1885]: NOQUEUE: reject: RCPT from chello080109195026.4.graz.surfer.at[80.109.195.26]: 550 <thornton@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<omrtlo@emailthis.com> to=<thornton@domain.tld> proto=SMTP helo=<emailthis.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1882]: NOQUEUE: reject: RCPT from catv-50629964.catv.broadband.hu[80.98.153.100]: 550 <moss@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<bjefhdwqh@udms.co.za> to=<moss@domain.tld> proto=SMTP helo=<udms.co.za>
Jul 6 10:54:50 rootserver postfix/smtpd[1878]: NOQUEUE: reject: RCPT from p54801099.dip.t-dialin.net[84.128.16.153]: 550 <elliott@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<jckmhtds@marpi.net> to=<elliott@domain.tld> proto=SMTP helo=<marpi.net>
Jul 6 10:54:50 rootserver postfix/smtpd[1904]: NOQUEUE: reject: RCPT from unknown[82.77.42.194]: 550 <dennis@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<gakaja@vsicorp.com> to=<dennis@domain.tld> proto=SMTP helo=<vsicorp.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1879]: NOQUEUE: reject: RCPT from unknown[62.211.132.72]: 550 <mcgee@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<uskhefwfuj@danbonet.dk> to=<mcgee@domain.tld> proto=SMTP helo=<danbonet.dk>
Jul 6 10:54:50 rootserver postfix/smtpd[1888]: NOQUEUE: reject: RCPT from unknown[195.150.133.13]: 550 <delgado@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<lmegjyw@blackhillsproperties.com> to=<delgado@domain.tld> proto=SMTP helo=<blackhillsproperties.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1885]: NOQUEUE: reject: RCPT from chello080109195026.4.graz.surfer.at[80.109.195.26]: 550 <glover@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<omrtlo@emailthis.com> to=<glover@domain.tld> proto=SMTP helo=<emailthis.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1882]: NOQUEUE: reject: RCPT from catv-50629964.catv.broadband.hu[80.98.153.100]: 550 <vega@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<bjefhdwqh@udms.co.za> to=<vega@domain.tld> proto=SMTP helo=<udms.co.za>
Jul 6 10:54:50 rootserver postfix/smtpd[1868]: NOQUEUE: reject: RCPT from ACaen-202-1-1-63.w81-53.abo.wanadoo.fr[81.53.140.63]: 554 Service unavailable; Client host [81.53.140.63] blocked using list.dsbl.org; http://dsbl.org/listing?ip=81.53.140.63; from=<jjdpwu@ellishayward.co.uk> to=<aguilar@domain.tld> proto=SMTP helo=<ellishayward.co.uk>
Jul 6 10:54:50 rootserver postfix/smtpd[1904]: NOQUEUE: reject: RCPT from unknown[82.77.42.194]: 550 <robbins@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<gakaja@vsicorp.com> to=<robbins@domain.tld> proto=SMTP helo=<vsicorp.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1881]: NOQUEUE: reject: RCPT from cha-gw-02-212186187219.chello.fr[212.186.187.219]: 550 <perkins@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<sxirp@autoatlas.dk> to=<perkins@domain.tld> proto=SMTP helo=<autoatlas.dk>
Jul 6 10:54:50 rootserver postfix/smtpd[1878]: NOQUEUE: reject: RCPT from p54801099.dip.t-dialin.net[84.128.16.153]: 550 <rodgers@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<jckmhtds@marpi.net> to=<rodgers@domain.tld> proto=SMTP helo=<marpi.net>
Jul 6 10:54:50 rootserver postfix/smtpd[1899]: NOQUEUE: reject: RCPT from unknown[195.244.142.189]: 554 Service unavailable; Client host [195.244.142.189] blocked using list.dsbl.org; http://dsbl.org/listing?ip=195.244.142.189; from=<maccu@cisdk.dk> to=<cohen@domain.tld> proto=SMTP helo=<cisdk.dk>
Jul 6 10:54:50 rootserver postfix/smtpd[1885]: NOQUEUE: reject: RCPT from chello080109195026.4.graz.surfer.at[80.109.195.26]: 550 <townsend@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<omrtlo@emailthis.com> to=<townsend@domain.tld> proto=SMTP helo=<emailthis.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1888]: NOQUEUE: reject: RCPT from unknown[195.150.133.13]: 550 <potter@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<lmegjyw@blackhillsproperties.com> to=<potter@domain.tld> proto=SMTP helo=<blackhillsproperties.com>
Jul 6 10:54:50 rootserver postfix/smtpd[1882]: NOQUEUE: reject: RCPT from catv-50629964.catv.broadband.hu[80.98.153.100]: 550 <walton@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<bjefhdwqh@udms.co.za> to=<walton@domain.tld> proto=SMTP helo=<udms.co.za>
Jul 6 10:54:51 rootserver postfix/smtpd[1879]: NOQUEUE: reject: RCPT from unknown[62.211.132.72]: 550 <rowe@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<uskhefwfuj@danbonet.dk> to=<rowe@domain.tld> proto=SMTP helo=<danbonet.dk>
Jul 6 10:54:51 rootserver postfix/smtpd[1875]: NOQUEUE: reject: RCPT from tss.pptus.ru[212.73.100.166]: 550 <nichols@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<sstnva@refco.com.sg> to=<nichols@domain.tld> proto=SMTP helo=<refco.com.sg>
Jul 6 10:54:51 rootserver postfix/smtpd[1904]: NOQUEUE: reject: RCPT from unknown[82.77.42.194]: 550 <joseph@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<gakaja@vsicorp.com> to=<joseph@domain.tld> proto=SMTP helo=<vsicorp.com>
Jul 6 10:54:51 rootserver postfix/smtpd[1868]: NOQUEUE: reject: RCPT from ACaen-202-1-1-63.w81-53.abo.wanadoo.fr[81.53.140.63]: 554 Service unavailable; Client host [81.53.140.63] blocked using list.dsbl.org; http://dsbl.org/listing?ip=81.53.140.63; from=<jjdpwu@ellishayward.co.uk> to=<swanson@domain.tld> proto=SMTP helo=<ellishayward.co.uk>
Jul 6 10:54:51 rootserver postfix/smtpd[1878]: NOQUEUE: reject: RCPT from p54801099.dip.t-dialin.net[84.128.16.153]: 550 <francis@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<jckmhtds@marpi.net> to=<francis@domain.tld> proto=SMTP helo=<marpi.net>
Jul 6 10:54:51 rootserver postfix/smtpd[1882]: NOQUEUE: reject: RCPT from catv-50629964.catv.broadband.hu[80.98.153.100]: 550 <rios@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<bjefhdwqh@udms.co.za> to=<rios@domain.tld> proto=SMTP helo=<udms.co.za>
Jul 6 10:54:51 rootserver postfix/smtpd[1888]: NOQUEUE: reject: RCPT from unknown[195.150.133.13]: 550 <conner@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<lmegjyw@blackhillsproperties.com> to=<conner@domain.tld> proto=SMTP helo=<blackhillsproperties.com>
Jul 6 10:54:51 rootserver postfix/smtpd[1881]: NOQUEUE: reject: RCPT from cha-gw-02-212186187219.chello.fr[212.186.187.219]: 550 <erickson@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<sxirp@autoatlas.dk> to=<erickson@domain.tld> proto=SMTP helo=<autoatlas.dk>
Jul 6 10:54:51 rootserver postfix/smtpd[1868]: NOQUEUE: reject: RCPT from ACaen-202-1-1-63.w81-53.abo.wanadoo.fr[81.53.140.63]: 554 Service unavailable; Client host [81.53.140.63] blocked using list.dsbl.org; http://dsbl.org/listing?ip=81.53.140.63; from=<jjdpwu@ellishayward.co.uk> to=<hammond@domain.tld> proto=SMTP helo=<ellishayward.co.uk>
Jul 6 10:54:51 rootserver postfix/smtpd[1899]: NOQUEUE: reject: RCPT from unknown[195.244.142.189]: 554 Service unavailable; Client host [195.244.142.189] blocked using list.dsbl.org; http://dsbl.org/listing?ip=195.244.142.189; from=<maccu@cisdk.dk> to=<cobb@domain.tld> proto=SMTP helo=<cisdk.dk>
Jul 6 10:54:51 rootserver postfix/smtpd[1879]: NOQUEUE: reject: RCPT from unknown[62.211.132.72]: 550 <flowers@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<uskhefwfuj@danbonet.dk> to=<flowers@domain.tld> proto=SMTP helo=<danbonet.dk>
Jul 6 10:54:51 rootserver postfix/smtpd[1876]: NOQUEUE: reject: RCPT from unknown[202.153.39.133]: 550 <daniels@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<aainocifp@ano.dk> to=<daniels@domain.tld> proto=SMTP helo=<ano.dk>
Jul 6 10:54:51 rootserver postfix/smtpd[1875]: NOQUEUE: reject: RCPT from tss.pptus.ru[212.73.100.166]: 550 <moody@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<sstnva@refco.com.sg> to=<moody@domain.tld> proto=SMTP helo=<refco.com.sg>
Jul 6 10:54:51 rootserver postfix/smtpd[1923]: NOQUEUE: reject: RCPT from e56002.upc-e.chello.nl[213.93.56.2]: 550 <kelley@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<sewdryr@stingraydesigns.com> to=<kelley@domain.tld> proto=SMTP helo=<stingraydesigns.com>
Jul 6 10:54:52 rootserver postfix/smtpd[1885]: NOQUEUE: reject: RCPT from unknown[157.158.28.5]: 550 <chapman@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<fhiwxqmynj@csassessors.com> to=<chapman@domain.tld> proto=SMTP helo=<csassessors.com>
Jul 6 10:54:52 rootserver postfix/smtpd[1900]: NOQUEUE: reject: RCPT from 81-202-81-75.user.ono.com[81.202.81.75]: 550 <greene@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<sllllfen@xanderdewit.myweb.nl> to=<greene@domain.tld> proto=SMTP helo=<xanderdewit.myweb.nl>
Jul 6 10:54:52 rootserver postfix/smtpd[1919]: NOQUEUE: reject: RCPT from cliente-217217055219.ubrsed01.supercable.es[217.217.55.219]: 550 <carroll@domain.tld>: Recipient address rejected: User unknown in virtual mailbox table; from=<jeieeqyyk@victerry.com> to=<carroll@domain.tld> proto=SMTP helo=<victerry.com>
Was kann man gegen so etwas machen? Ich verwende zwar RBLs, allerdings nur die, die mir als so sicher erscheinen, dass keine Mails verloren gehen. Ausserdem verwende ich Content-Filter, als Vorlage haben mir da die Files von suppenuser gedient (vielen Dank an der Stelle), allerdings auch sehr ausgeduennt, da mir vieles zu restriktiv erschien.
Ich wuerde das Thema gerne von einer ganz anderen Seite angehen, naemlich das betrachten wie ein Vorfall, der normalerweise von einem IDS-System abgefangen wird oder werden koennte, also im Prinzip wie einer, der nen Portscan probiert und dann nach dem 3ten erfolglosen Versuch dann komplett geblockt wird.
Szenario: Mails prasseln rein wie oben aufgelistet. Postfix merkt, dass da innerhalb von 2 Sekunden 5 Versuche mit fehlerhaften Aliasen kommen. Postfix meldet an iptables, dass die IP zu sperren ist fuer einige Zeit. Ist sowas umsetzbar oder gibts das eventuell schon?
So wuerde Postfix naemlich in Ruhe gelassen werden und somit auch der MySQL-Server.
CU,
Roi