求助！我的服务器是不是被劫持了，附LOG

hjohn · 发表于 2008-9-22 16:09:47

最近几天，邮件服务器忽然不能发邮件了，检查LOG后吓一大跳，这几天的SMTP（出）log文件全部都大到几个G！把我的硬盘空间占光了。检查这些LOG文件，发现有一个外部的邮件地址，通过我的服务器反复向别的地址发邮件，然后发不出去后，我的服务器又不停地返回递送失败的通知邮件，如此不停往复，造成服务器崩溃。现把LOG片段附在下面，请大家帮帮我，该如何处理？（其中服务器IP地址用***.***.***.***代替了，域名用*****.com代替）

Session 249; child 9
Mon 2008-09-22 11:51:52: Parsing Message <e:\mdaemon\queues\remote\retry\pd90000411508.msg>
Mon 2008-09-22 11:51:52: From: onlineservice@abbeynationals.co.uk
Mon 2008-09-22 11:51:52: To: harold@dovetailfoks.net
Mon 2008-09-22 11:51:52: Subject: =?windows-1251?B?SW1wb3J0YW50IEVycm9yIE5vdGlmaWNhdGlvbg==?=
Mon 2008-09-22 11:51:52: Message-ID: <[email=004801c919e4$e186204f$48c25dea@mskpvkm]004801c919e4$e186204f$48c25dea@mskpvkm[/email]>
Mon 2008-09-22 11:51:52: [dovetailfoks.net]的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Mon 2008-09-22 11:51:52: *  P=020 D=dovetailfoks.net TTL=(1440) MX=[secondary-mail.mailhoster.co.uk]
Mon 2008-09-22 11:51:52: *  P=010 D=dovetailfoks.net TTL=(1440) MX=[primary-mail.mailhoster.co.uk]
Mon 2008-09-22 11:51:52: Attempting MX: P=010 D=dovetailfoks.net TTL=(1440) MX=[primary-mail.mailhoster.co.uk]
Mon 2008-09-22 11:51:52: 正在试图 SMTP 连接到 [primary-mail.mailhoster.co.uk : 25]
Mon 2008-09-22 11:51:52: [primary-mail.mailhoster.co.uk]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Mon 2008-09-22 11:51:52: D=primary-mail.mailhoster.co.uk TTL=(284) A=[217.8.240.16]
Mon 2008-09-22 11:51:52: 正在试图 SMTP 连接到 [217.8.240.16 : 25]
Mon 2008-09-22 11:51:52: 等候 socket 连接...
Mon 2008-09-22 11:51:53: Socket 连接建立(***.***.***.*** : 2212 -> 217.8.240.16 : 25)
Mon 2008-09-22 11:51:53: 等候协议初始化...
Mon 2008-09-22 11:51:54: <-- 220 golf.xcalibre.co.uk ESMTP Exim 4.63 Mon, 22 Sep 2008 05:06:29 +0100
Mon 2008-09-22 11:51:54: --> EHLO ******.com
Mon 2008-09-22 11:51:54: <-- 250-golf.xcalibre.co.uk Hello ******.com [***.***.***.***]
Mon 2008-09-22 11:51:54: <-- 250-SIZE 31457280
Mon 2008-09-22 11:51:54: <-- 250-ETRN
Mon 2008-09-22 11:51:54: <-- 250-PIPELINING
Mon 2008-09-22 11:51:54: <-- 250 HELP
Mon 2008-09-22 11:51:54: --> MAIL From:<onlineservice@abbeynationals.co.uk> SIZE=4812
Mon 2008-09-22 11:51:54: <-- 250 OK
Mon 2008-09-22 11:51:54: --> RCPT To:<harold@dovetailfoks.net>
Mon 2008-09-22 11:51:55: <-- 550-Verification failed for <onlineservice@abbeynationals.co.uk>
Mon 2008-09-22 11:51:55: <-- 550-Unrouteable address
Mon 2008-09-22 11:51:55: <-- 550 Sender verify failed
Mon 2008-09-22 11:51:55: --> QUIT
Mon 2008-09-22 11:51:55: Attempting MX: P=020 D=dovetailfoks.net TTL=(1440) MX=[secondary-mail.mailhoster.co.uk]
Mon 2008-09-22 11:51:55: 正在试图 SMTP 连接到 [secondary-mail.mailhoster.co.uk : 25]
Mon 2008-09-22 11:51:55: [secondary-mail.mailhoster.co.uk]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Mon 2008-09-22 11:51:55: D=secondary-mail.mailhoster.co.uk TTL=(194) A=[89.16.176.57]
Mon 2008-09-22 11:51:55: 正在试图 SMTP 连接到 [89.16.176.57 : 25]
Mon 2008-09-22 11:51:55: 等候 socket 连接...
Mon 2008-09-22 11:51:58: Socket 连接建立(***.***.***.*** : 2217 -> 89.16.176.57 : 25)
Mon 2008-09-22 11:51:58: 等候协议初始化...
Mon 2008-09-22 11:51:59: <-- 220 external-02.xcalibre.co.uk ESMTP Exim 4.63 Mon, 22 Sep 2008 05:06:35 +0100
Mon 2008-09-22 11:51:59: --> EHLO ******.com
Mon 2008-09-22 11:52:00: <-- 250-external-02.xcalibre.co.uk Hello ******.com [***.***.***.***]
Mon 2008-09-22 11:52:00: <-- 250-SIZE 31457280
Mon 2008-09-22 11:52:00: <-- 250-ETRN
Mon 2008-09-22 11:52:00: <-- 250-PIPELINING
Mon 2008-09-22 11:52:00: <-- 250 HELP
Mon 2008-09-22 11:52:00: --> MAIL From:<onlineservice@abbeynationals.co.uk> SIZE=4812
Mon 2008-09-22 11:52:00: <-- 250 OK
Mon 2008-09-22 11:52:00: --> RCPT To:<harold@dovetailfoks.net>
Mon 2008-09-22 11:52:01: <-- 550-Verification failed for <onlineservice@abbeynationals.co.uk>
Mon 2008-09-22 11:52:01: <-- 550-Unrouteable address
Mon 2008-09-22 11:52:01: <-- 550 Sender verify failed
Mon 2008-09-22 11:52:01: --> QUIT
Mon 2008-09-22 11:52:01: SMTP 连接被终止(字节入/出: 632/228)
Mon 2008-09-22 11:52:01: ----------
Mon 2008-09-22 11:52:03: Session 244; child 4
Mon 2008-09-22 11:51:56: Parsing Message <e:\mdaemon\queues\remote\retry\pd90000411554.msg>
Mon 2008-09-22 11:51:56: From: onlineservice@abbeynationals.co.uk
Mon 2008-09-22 11:51:56: To: harper@thewitts.net
Mon 2008-09-22 11:51:56: Subject: =?windows-1251?B?SW1wb3J0YW50IEVycm9yIE5vdGlmaWNhdGlvbg==?=
Mon 2008-09-22 11:51:56: Message-ID: <[email=000701c919e4$aab2c02b$f9a30774@woerltehmcjb]000701c919e4$aab2c02b$f9a30774@woerltehmcjb[/email]>
Mon 2008-09-22 11:51:56: [thewitts.net]的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Mon 2008-09-22 11:51:56: *  P=010 D=thewitts.net TTL=(480) MX=[rhea.easily.co.uk]
Mon 2008-09-22 11:51:56: *  P=010 D=thewitts.net TTL=(480) MX=[easymx2.easily.co.uk]
Mon 2008-09-22 11:51:56: Attempting MX: P=010 D=thewitts.net TTL=(480) MX=[easymx2.easily.co.uk]
Mon 2008-09-22 11:51:56: 正在试图 SMTP 连接到 [easymx2.easily.co.uk : 25]
Mon 2008-09-22 11:51:56: [easymx2.easily.co.uk]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Mon 2008-09-22 11:51:56: D=easymx2.easily.co.uk TTL=(0) A=[212.53.64.68]
Mon 2008-09-22 11:51:56: 正在试图 SMTP 连接到 [212.53.64.68 : 25]
Mon 2008-09-22 11:51:56: 等候 socket 连接...
Mon 2008-09-22 11:51:59: Socket 连接建立(***.***.***.*** : 2219 -> 212.53.64.68 : 25)
Mon 2008-09-22 11:51:59: 等候协议初始化...
Mon 2008-09-22 11:52:00: <-- 220 coumta01.netbenefit.co.uk ESMTP ready at Mon, 22 Sep 2008 05:06:36 +0100
Mon 2008-09-22 11:52:00: --> EHLO ******.com
Mon 2008-09-22 11:52:01: <-- 250-coumta01.netbenefit.co.uk Hello ******.com [***.***.***.***]
Mon 2008-09-22 11:52:01: <-- 250-SIZE 104857600
Mon 2008-09-22 11:52:01: <-- 250-PIPELINING
Mon 2008-09-22 11:52:01: <-- 250 HELP
Mon 2008-09-22 11:52:01: --> MAIL From:<onlineservice@abbeynationals.co.uk> SIZE=4867
Mon 2008-09-22 11:52:01: <-- 550-Verification failed for <onlineservice@abbeynationals.co.uk>
Mon 2008-09-22 11:52:01: <-- 550-Unrouteable address
Mon 2008-09-22 11:52:01: <-- 550 Unable to verify sender
Mon 2008-09-22 11:52:01: --> QUIT
Mon 2008-09-22 11:52:01: Attempting MX: P=010 D=thewitts.net TTL=(480) MX=[rhea.easily.co.uk]
Mon 2008-09-22 11:52:01: 正在试图 SMTP 连接到 [rhea.easily.co.uk : 25]
Mon 2008-09-22 11:52:01: [rhea.easily.co.uk]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Mon 2008-09-22 11:52:01: D=rhea.easily.co.uk TTL=(3) A=[212.53.64.82]
Mon 2008-09-22 11:52:01: 正在试图 SMTP 连接到 [212.53.64.82 : 25]
Mon 2008-09-22 11:52:01: 等候 socket 连接...
Mon 2008-09-22 11:52:02: Socket 连接建立(***.***.***.*** : 2225 -> 212.53.64.82 : 25)
Mon 2008-09-22 11:52:02: 等候协议初始化...
Mon 2008-09-22 11:52:03: <-- 220 coumta58.netbenefit.co.uk ESMTP ready at Mon, 22 Sep 2008 05:06:38 +0100
Mon 2008-09-22 11:52:03: --> EHLO ******.com
Mon 2008-09-22 11:52:03: <-- 250-coumta58.netbenefit.co.uk Hello ******.com [***.***.***.***]
Mon 2008-09-22 11:52:03: <-- 250-SIZE 104857600
Mon 2008-09-22 11:52:03: <-- 250-PIPELINING
Mon 2008-09-22 11:52:03: <-- 250 HELP
Mon 2008-09-22 11:52:03: --> MAIL From:<onlineservice@abbeynationals.co.uk> SIZE=4867
Mon 2008-09-22 11:52:03: <-- 550-Verification failed for <onlineservice@abbeynationals.co.uk>
Mon 2008-09-22 11:52:03: <-- 550-Unrouteable address
Mon 2008-09-22 11:52:03: <-- 550 Unable to verify sender
Mon 2008-09-22 11:52:03: --> QUIT
Mon 2008-09-22 11:52:03: SMTP 连接被终止(字节入/出: 612/158)
Mon 2008-09-22 11:52:03: ----------
Mon 2008-09-22 11:52:04: Session 245; child 5
Mon 2008-09-22 11:51:59: Parsing Message <e:\mdaemon\queues\remote\retry\pd90000411555.msg>
Mon 2008-09-22 11:51:59: From: onlineservice@abbeynationals.co.uk
Mon 2008-09-22 11:51:59: To: harper@thewizardsquest.com
Mon 2008-09-22 11:51:59: Subject: =?windows-1251?B?SW1wb3J0YW50IEVycm9yIE5vdGlmaWNhdGlvbg==?=
Mon 2008-09-22 11:51:59: Message-ID: <[email=000701c919e4$aab2c02b$f9a30774@woerltehmcjb]000701c919e4$aab2c02b$f9a30774@woerltehmcjb[/email]>
Mon 2008-09-22 11:51:59: [thewizardsquest.com]的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Mon 2008-09-22 11:52:00: *  P=010 D=thewizardsquest.com TTL=(1440) MX=[mail.thewizardsquest.com]
Mon 2008-09-22 11:52:00: Attempting MX: P=010 D=thewizardsquest.com TTL=(1440) MX=[mail.thewizardsquest.com]
Mon 2008-09-22 11:52:00: 正在试图 SMTP 连接到 [mail.thewizardsquest.com : 25]
Mon 2008-09-22 11:52:00: [mail.thewizardsquest.com]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Mon 2008-09-22 11:52:00: D=mail.thewizardsquest.com TTL=(1440) A=[65.99.236.139]
Mon 2008-09-22 11:52:00: 正在试图 SMTP 连接到 [65.99.236.139 : 25]
Mon 2008-09-22 11:52:00: 等候 socket 连接...
Mon 2008-09-22 11:52:00: Socket 连接建立(***.***.***.*** : 2223 -> 65.99.236.139 : 25)
Mon 2008-09-22 11:52:00: 等候协议初始化...
Mon 2008-09-22 11:52:01: <-- 220 ws13.dnshub.net ESMTP
Mon 2008-09-22 11:52:01: --> EHLO ******.com
Mon 2008-09-22 11:52:01: <-- 250-ws13.dnshub.net
Mon 2008-09-22 11:52:01: <-- 250-AUTH=LOGIN CRAM-MD5 PLAIN
Mon 2008-09-22 11:52:01: <-- 250-AUTH LOGIN CRAM-MD5 PLAIN
Mon 2008-09-22 11:52:01: <-- 250-STARTTLS
Mon 2008-09-22 11:52:01: <-- 250-PIPELINING
Mon 2008-09-22 11:52:01: <-- 250 8BITMIME
Mon 2008-09-22 11:52:01: --> MAIL From:<onlineservice@abbeynationals.co.uk>
Mon 2008-09-22 11:52:01: <-- 250 ok
Mon 2008-09-22 11:52:01: --> RCPT To:<harper@thewizardsquest.com>
Mon 2008-09-22 11:52:04: <-- 550 sorry, no mailbox here by that name. (#5.7.17)
Mon 2008-09-22 11:52:04: --> QUIT
Mon 2008-09-22 11:52:04: SMTP 连接被终止(字节入/出: 215/107)
Mon 2008-09-22 11:52:04: ----------
Mon 2008-09-22 11:52:04: Session 245; child 5
Mon 2008-09-22 11:52:04: Parsing Message <e:\mdaemon\queues\remote\pd75000796693.msg>
Mon 2008-09-22 11:52:04: From: (sender not specified)
Mon 2008-09-22 11:52:04: To: onlineservice@abbeynationals.co.uk
Mon 2008-09-22 11:52:04: Subject: 永久递送失败
Mon 2008-09-22 11:52:04: Message-ID: <[email=MDAEMON0005200809221151.AA5148468@******.com]MDAEMON0005200809221151.AA5148468@******.com[/email]>
Mon 2008-09-22 11:52:04: [abbeynationals.co.uk]的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Mon 2008-09-22 11:52:04: 名称服务器报告域名未知
Mon 2008-09-22 11:52:04: 正在试图 SMTP 连接到 [abbeynationals.co.uk : 25]
Mon 2008-09-22 11:52:04: [abbeynationals.co.uk]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Mon 2008-09-22 11:52:04: 名称服务器报告域名未知
Mon 2008-09-22 11:52:04: 此信已经过了 0 分；在这个队列还剩余 60 分
Mon 2008-09-22 11:52:04: SMTP 连接被终止(字节入/出: 0/0)
Mon 2008-09-22 11:52:04: ----------
Mon 2008-09-22 11:52:04: Session 245; child 5
Mon 2008-09-22 11:52:04: Parsing Message <e:\mdaemon\queues\remote\pd75000796694.msg>
Mon 2008-09-22 11:52:04: From: (sender not specified)
Mon 2008-09-22 11:52:04: To: onlineservice@abbeynationals.co.uk
Mon 2008-09-22 11:52:04: Subject: 永久递送失败
Mon 2008-09-22 11:52:04: Message-ID: <[email=MDAEMON0006200809221151.AA5148468@******.com]MDAEMON0006200809221151.AA5148468@******.com[/email]>
Mon 2008-09-22 11:52:04: [abbeynationals.co.uk]的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Mon 2008-09-22 11:52:04: 名称服务器报告域名未知
Mon 2008-09-22 11:52:04: 正在试图 SMTP 连接到 [abbeynationals.co.uk : 25]
Mon 2008-09-22 11:52:04: [abbeynationals.co.uk]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Mon 2008-09-22 11:52:04: 名称服务器报告域名未知
Mon 2008-09-22 11:52:04: 此信已经过了 0 分；在这个队列还剩余 60 分
Mon 2008-09-22 11:52:04: SMTP 连接被终止(字节入/出: 0/0)
Mon 2008-09-22 11:52:04: ----------
Mon 2008-09-22 11:52:04: Session 245; child 5
Mon 2008-09-22 11:52:04: Parsing Message <e:\mdaemon\queues\remote\pd75000796695.msg>
Mon 2008-09-22 11:52:04: From: (sender not specified)
Mon 2008-09-22 11:52:04: To: onlineservice@abbeynationals.co.uk
Mon 2008-09-22 11:52:04: Subject: 永久递送失败
Mon 2008-09-22 11:52:04: Message-ID: <[email=MDAEMON0008200809221151.AA5148484@******.com]MDAEMON0008200809221151.AA5148484@******.com[/email]>
Mon 2008-09-22 11:52:04: [abbeynationals.co.uk]的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Mon 2008-09-22 11:52:04: 名称服务器报告域名未知
Mon 2008-09-22 11:52:04: 正在试图 SMTP 连接到 [abbeynationals.co.uk : 25]
Mon 2008-09-22 11:52:04: [abbeynationals.co.uk]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Mon 2008-09-22 11:52:04: 名称服务器报告域名未知
Mon 2008-09-22 11:52:04: 此信已经过了 0 分；在这个队列还剩余 60 分
Mon 2008-09-22 11:52:04: SMTP 连接被终止(字节入/出: 0/0)

wxhsh · 发表于 2008-9-22 16:22:15

只要设置禁用中继应该不会这样的，另外，看日志好象你邮服也设置了通过中继发送了吧？这个帐号还有效吗？

hjohn · 发表于 2008-9-22 17:36:54

感谢楼上回复！
我的邮服是8.03版本，在“中继设置”中这样设的：

wxhsh · 发表于 2008-9-23 08:35:43

此设置没什么问题，最好看下设置-主域-递送里是否设置了中继发送。

hjohn · 发表于 2008-9-23 16:15:33

我对这两句感到很奇怪：
Mon 2008-09-22 11:52:04: From: (sender not specified)
Mon 2008-09-22 11:52:04: To: onlineservice@abbeynationals.co.uk

正常情况下，如果无法递送，应该是mdaemon@*****.com这个系统默认帐号来发送通知邮件的，但是这里为什么显示发送者未指定呢？

能不能找到一个设置，强制检查所以发送或接收的邮件，必须指定发送和接收地址，未指定地址的不予处理？

		自动登录	找回密码
密码			会员注册

[求助] 求助！我的服务器是不是被劫持了，附LOG

回复 1楼 hjohn 的帖子

回复 3楼 hjohn 的帖子

浏览过的版块