邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 垃圾邮件用我们自己的邮件地址给我们自己发邮件 [打印本页]

作者: iamrobot 时间: 2010-3-1 14:30
标题: 垃圾邮件用我们自己的邮件地址给我们自己发邮件
怎么办
平台是exchange2007sp1

下面是日志
2010-02-28T19:23:18.843Z,EX07\Default EX07,08CC7312B1F04CDE,0,10.10.10.10:25,124.50.119.6:29846,+,,
2010-02-28T19:23:18.843Z,EX07\Default EX07,08CC7312B1F04CDE,1,10.10.10.10:25,124.50.119.6:29846,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2010-02-28T19:23:18.843Z,EX07\Default EX07,08CC7312B1F04CDE,2,10.10.10.10:25,124.50.119.6:29846,>,"220 mail.abc.com.cn Microsoft ESMTP MAIL Service ready at Mon, 1 Mar 2010 03:23:17 +0800",
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,3,10.10.10.10:25,124.50.119.6:29846,<,EHLO [124.50.119.6],
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,4,10.10.10.10:25,124.50.119.6:29846,>,250-mail.abc.com.cn Hello [124.50.119.6],
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,5,10.10.10.10:25,124.50.119.6:29846,>,250-SIZE,
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,6,10.10.10.10:25,124.50.119.6:29846,>,250-PIPELINING,
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,7,10.10.10.10:25,124.50.119.6:29846,>,250-DSN,
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,8,10.10.10.10:25,124.50.119.6:29846,>,250-ENHANCEDSTATUSCODES,
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,9,10.10.10.10:25,124.50.119.6:29846,>,250-AUTH NTLM LOGIN,
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,10,10.10.10.10:25,124.50.119.6:29846,>,250-8BITMIME,
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,11,10.10.10.10:25,124.50.119.6:29846,>,250-BINARYMIME,
2010-02-28T19:23:18.905Z,EX07\Default EX07,08CC7312B1F04CDE,12,10.10.10.10:25,124.50.119.6:29846,>,250 CHUNKING,
2010-02-28T19:23:18.983Z,EX07\Default EX07,08CC7312B1F04CDE,13,10.10.10.10:25,124.50.119.6:29846,<,MAIL FROM:<abc@abc.com.cn> SIZE=1799,
2010-02-28T19:23:18.983Z,EX07\Default EX07,08CC7312B1F04CDE,14,10.10.10.10:25,124.50.119.6:29846,*,08CC7312B1F04CDE;2010-02-28T19:23:18.843Z;1,receiving message
2010-02-28T19:23:18.983Z,EX07\Default EX07,08CC7312B1F04CDE,15,10.10.10.10:25,124.50.119.6:29846,>,250 2.1.0 Sender OK,
2010-02-28T19:23:19.062Z,EX07\Default EX07,08CC7312B1F04CDE,16,10.10.10.10:25,124.50.119.6:29846,<,RCPT TO:<abc@abc.com.cn>,
2010-02-28T19:23:19.062Z,EX07\Default EX07,08CC7312B1F04CDE,17,10.10.10.10:25,124.50.119.6:29846,>,250 2.1.5 Recipient OK,
2010-02-28T19:23:19.140Z,EX07\Default EX07,08CC7312B1F04CDE,18,10.10.10.10:25,124.50.119.6:29846,<,DATA,
2010-02-28T19:23:19.140Z,EX07\Default EX07,08CC7312B1F04CDE,19,10.10.10.10:25,124.50.119.6:29846,>,354 Start mail input; end with <CRLF>.<CRLF>,
2010-02-28T19:23:19.452Z,EX07\Default EX07,08CC7312B1F04CDE,20,10.10.10.10:25,124.50.119.6:29846,>,250 2.6.0 <5753d810-215c-4727-b9a2-b7c567c409c6@ex07.abc.com.cn> Queued mail for delivery,
2010-02-28T19:23:19.530Z,EX07\Default EX07,08CC7312B1F04CDE,21,10.10.10.10:25,124.50.119.6:29846,<,QUIT,
2010-02-28T19:23:19.530Z,EX07\Default EX07,08CC7312B1F04CDE,22,10.10.10.10:25,124.50.119.6:29846,>,221 2.0.0 Service closing transmission channel,
2010-02-28T19:23:19.530Z,EX07\Default EX07,08CC7312B1F04CDE,23,10.10.10.10:25,124.50.119.6:29846,-,,Local

作者: tdk 时间: 2010-3-1 17:33
需要去掉匿名的一个提交邮件权限
具体可以搜搜
http://bbs.5dmail.net/thread-180588-1-2.html

http://bbs.5dmail.net/viewthread.php?tid=180584

作者: iamrobot 时间: 2010-3-17 11:52
谢谢
这个问题困扰了我很长时间
当天发帖以后
不知道哪边天神附体
居然自己摸索到了解决方法
当时还暗暗窃喜一下想上来发个攻略

作者: 钉子 时间: 2010-3-17 15:58
哪就把你的经验整理一下发上来吧。支持原创。

作者: iamrobot 时间: 2010-3-18 11:17
解决方法和2楼一样
去掉匿名用户的ms-Exch-SMTP-Accept-Authoritative-Domain-Sender
感觉exchange2007权限控制做的太粗糙
贴一下自己写的文档（也许只有我自己看得懂）

最近发现有垃圾邮件用我们自己的邮件地址发送给我们内部用户
以下为日志
2010-02-28T19:23:18.843Z,exchange\Default exchange,08CC7312B1F04CDE,0,10.10.10.10:25,124.50.119.6:29846,+,,
2010-02-28T19:23:18.843Z,exchange\Default exchange,08CC7312B1F04CDE,1,10.10.10.10:25,124.50.119.6:29846,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2010-02-28T19:23:18.843Z,exchange\Default exchange,08CC7312B1F04CDE,2,10.10.10.10:25,124.50.119.6:29846,>,"220 email.mydomain.com Microsoft ESMTP MAIL Service ready at Mon, 1 Mar 2010 03:23:17 +0800",
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,3,10.10.10.10:25,124.50.119.6:29846,<,EHLO [124.50.119.6],
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,4,10.10.10.10:25,124.50.119.6:29846,>,250-email.mydomain.com Hello [124.50.119.6],
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,5,10.10.10.10:25,124.50.119.6:29846,>,250-SIZE,
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,6,10.10.10.10:25,124.50.119.6:29846,>,250-PIPELINING,
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,7,10.10.10.10:25,124.50.119.6:29846,>,250-DSN,
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,8,10.10.10.10:25,124.50.119.6:29846,>,250-ENHANCEDSTATUSCODES,
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,9,10.10.10.10:25,124.50.119.6:29846,>,250-AUTH NTLM LOGIN,
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,10,10.10.10.10:25,124.50.119.6:29846,>,250-8BITMIME,
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,11,10.10.10.10:25,124.50.119.6:29846,>,250-BINARYMIME,
2010-02-28T19:23:18.905Z,exchange\Default exchange,08CC7312B1F04CDE,12,10.10.10.10:25,124.50.119.6:29846,>,250 CHUNKING,
2010-02-28T19:23:18.983Z,exchange\Default exchange,08CC7312B1F04CDE,13,10.10.10.10:25,124.50.119.6:29846,<,MAIL FROM:<mymail@mydomain.com> SIZE=1799,
2010-02-28T19:23:18.983Z,exchange\Default exchange,08CC7312B1F04CDE,14,10.10.10.10:25,124.50.119.6:29846,*,08CC7312B1F04CDE;2010-02-28T19:23:18.843Z;1,receiving message
2010-02-28T19:23:18.983Z,exchange\Default exchange,08CC7312B1F04CDE,15,10.10.10.10:25,124.50.119.6:29846,>,250 2.1.0 Sender OK,
2010-02-28T19:23:19.062Z,exchange\Default exchange,08CC7312B1F04CDE,16,10.10.10.10:25,124.50.119.6:29846,<,RCPT TO:<mymail@mydomain.com>,
2010-02-28T19:23:19.062Z,exchange\Default exchange,08CC7312B1F04CDE,17,10.10.10.10:25,124.50.119.6:29846,>,250 2.1.5 Recipient OK,
2010-02-28T19:23:19.140Z,exchange\Default exchange,08CC7312B1F04CDE,18,10.10.10.10:25,124.50.119.6:29846,<,DATA,
2010-02-28T19:23:19.140Z,exchange\Default exchange,08CC7312B1F04CDE,19,10.10.10.10:25,124.50.119.6:29846,>,354 Start mail input; end with <CRLF>.<CRLF>,
2010-02-28T19:23:19.452Z,exchange\Default exchange,08CC7312B1F04CDE,20,10.10.10.10:25,124.50.119.6:29846,>,250 2.6.0 <5753d810-215c-4727-b9a2-b7c567c409c6@exchange.mydomain.com> Queued mail for delivery,
2010-02-28T19:23:19.530Z,exchange\Default exchange,08CC7312B1F04CDE,21,10.10.10.10:25,124.50.119.6:29846,<,QUIT,
2010-02-28T19:23:19.530Z,exchange\Default exchange,08CC7312B1F04CDE,22,10.10.10.10:25,124.50.119.6:29846,>,221 2.0.0 Service closing transmission channel,
2010-02-28T19:23:19.530Z,exchange\Default exchange,08CC7312B1F04CDE,23,10.10.10.10:25,124.50.119.6:29846,-,,Local

经查发现接受连接器(default)可以接受任何域名的邮件地址发邮件。
首先想启用“反垃圾邮件”－“发件人ID”，通过地址反解析阻止垃圾邮件。但措施无效
通过测试，发现伪造163.com的发件人是不能通过邮件服务器检测的，但是伪造我院自己的邮件地址即可通过邮件服务器检测。
原因可能是外网DNS记录中没有增加我院邮件SPF记录，而且exchange文档中说明不对自己域名做SPF检查。

后通过对接受连接器权限研究（baidu搜索 Exchange 2007 接收连接器的安全权限），可能是因为接受连接器对匿名用户具有ms-Exch-SMTP-Accept-Authoritative-Domain-Sender权限。
运行以下命令
[PS] C:\Documents and Settings\Administrator.JSPDI>Get-ReceiveConnector exchange\de* | Get-ADPermission | where {&{$_.user -like "*anon*"} | format-list

User             : NT AUTHORITY\ANONYMOUS LOGON
Identity          : exchange\Default exchange
Deny             : False
AccessRights       : {ExtendedRight}
ExtendedRights    : {ms-Exch-SMTP-Submit}
IsInherited       : False
Properties       :
ChildObjectTypes :
InheritedObjectType :
InheritanceType    : All

User             : NT AUTHORITY\ANONYMOUS LOGON
Identity          : exchange\Default exchange
Deny             : False
AccessRights       : {ExtendedRight}
ExtendedRights    : {ms-Exch-SMTP-Accept-Any-Sender}
IsInherited       : False
Properties       :
ChildObjectTypes :
InheritedObjectType :
InheritanceType    : All

User             : NT AUTHORITY\ANONYMOUS LOGON *
Identity          : exchange\Default exchange *
Deny             : False *
AccessRights       : {ExtendedRight} *
ExtendedRights    : {ms-Exch-SMTP-Accept-Authoritative-Domain-Sender} *
IsInherited       : False *
Properties       :
ChildObjectTypes :
InheritedObjectType :
InheritanceType    : All

User             : NT AUTHORITY\ANONYMOUS LOGON
Identity          : exchange\Default exchange
Deny             : False
AccessRights       : {ExtendedRight}
ExtendedRights    : {ms-Exch-Accept-Headers-Routing}
IsInherited       : False
Properties       :
ChildObjectTypes :
InheritedObjectType :
InheritanceType    : All

User             : NT AUTHORITY\ANONYMOUS LOGON
Identity          : exchange\Default exchange
Deny             : False
AccessRights       : {GenericRead}
ExtendedRights    :
IsInherited       : True
Properties       :
ChildObjectTypes :
InheritedObjectType : ms-Exch-Public-MDB
InheritanceType    : Descendents

User             : NT AUTHORITY\ANONYMOUS LOGON
Identity          : exchange\Default exchange
Deny             : False
AccessRights       : {ExtendedRight}
ExtendedRights    : {ms-Exch-Create-Public-Folder}
IsInherited       : True
Properties       :
ChildObjectTypes :
InheritedObjectType :
InheritanceType    : All

User             : NT AUTHORITY\ANONYMOUS LOGON
Identity          : exchange\Default exchange
Deny             : False
AccessRights       : {ExtendedRight}
ExtendedRights    : {ms-Exch-Store-Create-Named-Properties}
IsInherited       : True
Properties       :
ChildObjectTypes :
InheritedObjectType :
InheritanceType    : All

User             : NT AUTHORITY\ANONYMOUS LOGON
Identity          : exchange\Default exchange
Deny             : False
AccessRights       : {GenericRead}
ExtendedRights    :
IsInherited       : True
Properties       :
ChildObjectTypes :
InheritedObjectType : ms-Exch-Private-MDB
InheritanceType    : Descendents

ms-Exch-SMTP-Accept-Authoritative-Domain-Sender权限的解释 “如果smtp接收线程没该权限，服务器会拒绝“mailfrom”中使用　权威域名　邮件。”

对匿名用户删除该权限
Get-ReceiveConnector exchange\de* | remove-adpermission -user "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTP-Accept-Authoritative-Domain-Sender"

测试，服务器拒绝匿名用户使用mydomain.com的域名发邮件，但公司oe，foxmail等因为通过域认证，仍然可以发送邮件。

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.net/)