Recibidos correos extraños

Jose_minglein2 · #1 (**permalink**) 08/05/2007, 03:53

Hola,

estoy recibiendo durante todo el día, correos del tipo:

Código:

This is the mail system at host relay-hostels.ntu-kpi.kiev.ua.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<[email protected]>: host ussr.ntu-kpi.kiev.ua[10.118.254.2] said: 550
    5.1.1 <[email protected]>: Recipient address rejected: User unknown
    in local recipient table (in reply to RCPT TO command)



Reporting-MTA: dns; relay-hostels.ntu-kpi.kiev.ua
X-Postfix-Queue-ID: 4344C440CE4
X-Postfix-Sender: rfc822; [email protected]
Arrival-Date: Tue,  8 May 2007 12:46:51 +0300 (EEST)

Final-Recipient: rfc822; [email protected]
Original-Recipient: rfc822;[email protected]
Action: failed
Status: 5.1.1
Remote-MTA: dns; ussr.ntu-kpi.kiev.ua
Diagnostic-Code: smtp; 550 5.1.1 <[email protected]>: Recipient address
    rejected: User unknown in local recipient table



Received: from relay-hostels.ntu-kpi.kiev.ua (localhost [127.0.0.1])
	by relay-hostels.ntu-kpi.kiev.ua (Postfix) with ESMTP id 4344C440CE4
	for <[email protected]>; Tue,  8 May 2007 12:46:51 +0300 (EEST)
Received: from eth0.kretyn.1000lecie.pl (eth0.kretyn.1000lecie.pl [195.177.64.66])
	by relay-hostels.ntu-kpi.kiev.ua (Postfix) with ESMTP id 414B8441D28
	for <[email protected]>; Tue,  8 May 2007 12:45:59 +0300 (EEST)
Received: from localhost (localhost [127.0.0.1])
	by eth0.kretyn.1000lecie.pl (Postfix) with ESMTP id AD60914B7DD;
	Tue,  8 May 2007 11:18:51 +0200 (CEST)
X-Virus-Scanned: amavisd-new at 1000lecie.pl
X-Spam-Score: -4.399
X-Spam-Level: 
X-Spam-Status: No, score=-4.399 tagged_above=-9999 required=4
	tests=[ALL_TRUSTED=-1.8, BAYES_00=-2.599]
Received: from eth0.kretyn.1000lecie.pl ([127.0.0.1])
	by localhost (1000lecie.pl [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id UpWIkj1OuF30; Tue,  8 May 2007 11:18:50 +0200 (CEST)
Received: from blackspider.tys86.1000lecie.pl (blackspider.tys86.1000lecie.pl [195.177.67.241])
	by eth0.kretyn.1000lecie.pl (Postfix) with SMTP id ED66E149A8C;
	Tue,  8 May 2007 10:53:33 +0200 (CEST)
Message-ID: <[email protected]>
From: =?Windows-1251?Q?=C8=EB=FC=FF_=C5=E2=E3=E5=ED=FC=E5=E2=E8=F7_=D2=F0=F3=F1=E8=EB=EE=E2?= <[email protected]>
To: =?Windows-1251?Q?=DF=EA=EE=E2_=D0=EE=EC=E0=ED=EE=E2=E8=F7_=CA=EE=ED=EE=E1=E5=E5=E2?= <[email protected]>
Subject: =?Windows-1251?Q?Re:_=F3=EF=F0=E0=E2=EB=E5=ED=E8=E5_=EF=E5=F0=F1=EE=ED=E0=EB=EE=EC?=
Date: Tue, 8 May 2007 02:53:38 -0700
MIME-Version: 1.0
Content-Type: text/plain;
        charset="windows-1251"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Virus-Scanned: ClamAV at relay-hostels.ntu-kpi.kiev.ua

En una de las cuentas alojadas en mi servidor. Éste tiene autenticación sasl activada y utiliza postfix. Me da rollo que alguien esté utilizando mi servidor para enviar spam, pero me parece muy raro, leyendo las cabeceras del mismo, parece como si el error no lo devolviese a mi servidor, si no que fuese un mail enviado con las caracteristicas de un error.

¿Alguien podría decirme algo a este respecto?¿Es normal?¿Como lo evito?

PS. Tengo amavisd y spamassasin instalados también

Muchas gracias.

Jose_minglein2 · #2 (**permalink**) 08/05/2007, 04:58

Añado que las salidas:
grep 4344C440CE4 /var/log/mail.log
y
grep ED66E149A8C /var/log/mail.log

no me devuelven nada, y son los supuesto identificadores de los mensajes que he enviado. Sin embargo la salida:
grep A999F7AC0EE /var/log/mail.log, siendo A999F7AC0EE el ID que me aparecen la cabecera del mail que he recibido, me muestra:

Código:

May  8 11:42:09 avancexxi postfix/smtpd[15473]: A999F7AC0EE: client=unknown[195.245.194.39]
May  8 11:42:09 avancexxi postfix/cleanup[16025]: A999F7AC0EE: message-id=<[email protected]>
May  8 11:42:09 avancexxi postfix/qmgr[13305]: A999F7AC0EE: from=<>, size=4375, nrcpt=1 (queue active)
May  8 11:42:14 avancexxi postfix/smtp[16026]: A999F7AC0EE: to=<[email protected]>, relay=127.0.0.1[127.0.0.1], delay=5, status=sent (250 2.6.0 Ok, id=15894-08, from MTA: 250 Ok: queued as 806C67AC0F7)
May  8 11:42:14 avancexxi postfix/qmgr[13305]: A999F7AC0EE: removed

Esta es mi main.cf

Cita:

smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous

smtpd_sasl_local_domain = vhcs.net

broken_sasl_auth_clients = yes

#smtpd_delay_reject = no

smtpd_recipient_restrictions =
permit_sasl_authenticated,
permit_mynetworks,
reject_unauth_destination

content_filter = smtp-amavis:[127.0.0.1]:10024

Gracias de nuevo

Jose_minglein2 · #3 (**permalink**) 08/05/2007, 10:39

He estado investigando un poco, y me encuentro con esto en la mayoría de la decenas de mensajes que estoy recibiendo:

Cita:

his report relates to a message you sent with the following header fields:

Message-id: <[email protected]>
Date: Tue, 08 May 2007 06:44:58 -0600
From:
=?Windows-1251?Q?=C8=E2=E0=ED_=D4=E5=EB=E8=EA=F1=EE=E2=E8=F7 _=D5=EE=E7=FF=E8=ED=EE=E2?=
<[email protected]>
To:
=?Windows-1251?Q?=C1=EE=F0=E8=F1_=C1=EE=F0=E8=F1=EE=E2=E8=F7 _=CA=E0=EF=E0=F7=E5=ED=FF?=
<[email protected]>
Subject:
=?Windows-1251?Q?Re:_=EC=EE=F2=E8=E2=E0=F6=E8=FF_=EF=E5=F0=F 1=EE=ED=E0=EBa?=

Your message cannot be delivered to the following recipients:

Recipient address: [email protected]
Reason: Remote SMTP server has rejected address
Diagnostic code: smtp;550 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table
Remote system: dns;relay1.eurocom.od.ua (TCP|195.114.161.58|58645|212.15.128.6|25) (mail.eurocom.od.ua ESMTP Postfix)

Reporting-MTA: dns;drybek.inetia.pl

Action: failed
Status: 5.0.0 (Remote SMTP server has rejected address)
Original-recipient: rfc822;[email protected]
Final-recipient: rfc822;[email protected]
Remote-MTA: dns;relay1.eurocom.od.ua (TCP|195.114.161.58|58645|212.15.128.6|25)
(mail.eurocom.od.ua ESMTP Postfix)
Diagnostic-code: smtp;550 <[email protected]>: Recipient address rejected:
User unknown in virtual mailbox table

Asunto:
Re: мотивация персоналa
De:
Иван Феликсович Хозяинов <[email protected]>
Fecha:
Tue, 08 May 2007 06:44:58 -0600
Para:
Борис Борисович Капаченя <[email protected]>
Return-path: avance21 @ xxxxxx.com
Received:
from tcp-daemon by drybek.inetia.pl (Sun Internet Mail Server sims.4.0.2000.10.12.16.25.p8) id <[email protected]>; Tue, 08 May 2007 15:28:05 +0200 (MET DST)
Received:
from 213-238-66-99.adsl.inetia.pl (213-238-66-99.adsl.inetia.pl [213.238.66.99]) by drybek.inetia.pl (Sun Internet Mail Server sims.4.0.2000.10.12.16.25.p8) with SMTP id <[email protected]> for [email protected]; Tue, 08 May 2007 14:45:06 +0200 (MET DST)
Message-ID:
<[email protected]>
MIME-Version:
1.0
X-MIMEOLE:
Produced By Microsoft MimeOLE V6.00.2800.1106
X-Mailer:
Microsoft Outlook Express 6.00.2800.1106
Content-type:
text/plain; charset=windows-1251
Content-transfer-encoding:
8BIT
X-Priority:
3
X-MSMail-priority:
Normal

89 04:01:00

> > ПОСТPОЕНИE ЭФФЕКTИВНOЙ KOMАНДЫ:
> > ПОДБОР, ДИАГНОСTИKА, MОТИBАЦИЯ
> > И УПРAВЛЕНИE ПЕРCОНАЛOМ

> > 15-16 мая, г. Kиев

> > (044) 233-46-69 , 237-9O-O5

En el return-path viene la dirección que está recibiendo los correos masivos, sin embargo ni el from ni la ip de origen ni nada, pertenecen a mi servidor. ¿Es esta una nueva técnica de spam, hacer que los correos parezcan devoluciones mediante return-path?¿que manería habría de evitarlo?¿O realmente están enviando spam usando mi server?

Gracias.

tania · #4 (**permalink**) 11/05/2007, 06:41

hola

no estoy muy adentrada con servidores de correo, leyendo un poco en tu primer post en el log se muestra

Cita:

X-Spam-Level:

segun el manual que vi aqui se deberian mostar asteriscos dependiendo el nivel que has configurado.

por otra parte veo

Cita:

X-Spam-Status: No, score=-4.399 tagged_above=-9999 required=4

segun el manual el nivel estandard es 7 y algunas configuraciones se debe hacer solo si tienes configurado a 7

http://www.albany.edu/its/accounts_e...ng_filter.html

http://www.csupomona.edu/~ehelp/spam/spam_assassin.html

saludos

Jose_minglein2 · #5 (**permalink**) 23/05/2007, 04:10

El nivel 4, lo tengo puesto para aumentar el filtrado, de todas maneras como veas el score de dicho correo es -4.3.

El problema, creo que es este:

-SPAMER->Envia Spam a x servidores con Return-path:[email protected]
-El servidor con filtro antispam,lo rechaza y envia "devolución" o aviso al return-path.
A mi me llega la devolución de dicho correo (es más me llegan un montón de golpe).

Mi pregunta es, ¿hay alguna forma de evitar ésto?