Komische unbekannte Mail-Benutzer im Plesk

tobi4

Member
Hallo,

habe gerade durch Zufall in meinem Plesk 10.2.0-Account festgestellt, dass 2 mir unbekannte Mailbenutzer vorhanden sind.

Diese sind beide unter einer .lu-Domain festgelegt - es sind keine Kontakteigenschaften definiert. Die Kontakte verwenden angeblich eine Mailadresse mpipu2003@domain.lu sowie nuiym@domain.lu.

Ich kann mir weder erklären, wer diese Accounts erstellt haben soll noch ob sich jemand Zugriff zum Plesk verschafft hat. Ich jedenfalls habe diese Mailadresse nicht gespeichert, zumal ich unter dieser Domain schon lange nichts mehr im Plesk gemacht habe.

Wenn ich im Abonnement der Domain die E-Mail Adressen einsehe, sehe ich, dass zu diesen beiden unbekannten Mailadressdefinitionen keine Mailbox existiert, was mich schonmal beruhigt. Gibt es bezügl. Erstellung der Mailadressen irgendwelche Logs bzw. Logeinträge? Falls ja, wo finde ich die und wie komme ich da dran? Oder generell für Plesk-Zugriffe?

Und das beste ist ja, diese komischen Namen mpipu2003 und nuiym kommen mir irgendwie "bekannt" vor, sind mir direkt ins Auge gestochen, als hätte ich sie evtl. schonmal als Absenderkennung einer Spammail oder sowas gesehen. Konnte aber durch die Nachrichtensuche im Thunderbird nichts entsprechendes finden. Kann sie auch nirgendwo zuordnen. Komische Sache.
 
Habe das Plesk Log gefunden. Allerdings hat das nur alle Aktionen ab 18.04. geloggt, da es scheinbar erst mit dem dortigen Update auf 10.2 mitinstalliert wurde.

Somit existieren die Benutzer schon seit vor dem 18. April - ganz toll. Gibt es irgend eine Möglichkeit, wenigstens das vergebene Passwort herauszufinden, sofern überhaupt eines eingegeben wurde?

Gruß
 
Hallo wstuermer, danke für Deinen Link.

Ich nehme an, ich muss diesen Befehl über SSH ausführen. Dabei kommt folgendes zurück:

mysql Ver 14.12 Distrib 5.0.77, for redhat-linux-gnu (x86_64) using readline 5. 1
Copyright (C) 2000-2008 MySQL AB
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license
Usage: mysql [OPTIONS] [database]
-?, --help Display this help and exit.
-I, --help Synonym for -?
--auto-rehash Enable automatic rehashing. One doesn't need to use
'rehash' to get table and field completion, but startup
and reconnecting may take a longer time. Disable with
--disable-auto-rehash.
-A, --no-auto-rehash
No automatic rehashing. One has to use 'rehash' to get
table and field completion. This gives a quicker start of
mysql and disables rehashing on reconnect. WARNING:
options deprecated; use --disable-auto-rehash instead.
-B, --batch Don't use history file. Disable interactive behavior.
(Enables --silent)
--character-sets-dir=name
Directory where character sets are.
--default-character-set=name
Set the default character set.
-c, --comments Preserve comments. Send comments to the server. The
default is --skip-comments (discard comments), enable
with --comments
-C, --compress Use compression in server/client protocol.
-#, --debug[=#] This is a non-debug version. Catch this and exit
-D, --database=name Database to use.
--delimiter=name Delimiter to be used.
-e, --execute=name Execute command and quit. (Disables --force and history
file)
-E, --vertical Print the output of a query (rows) vertically.
-f, --force Continue even if we get an sql error.
-G, --named-commands
Enable named commands. Named commands mean this program's
internal commands; see mysql> help . When enabled, the
named commands can be used from any line of the query,
otherwise only from the first line, before an enter.
Disable with --disable-named-commands. This option is
disabled by default.
-g, --no-named-commands
Named commands are disabled. Use \* form only, or use
named commands only in the beginning of a line ending
with a semicolon (;) Since version 10.9 the client now
starts with this option ENABLED by default! Disable with
'-G'. Long format commands still work from the first
line. WARNING: option deprecated; use
--disable-named-commands instead.
-i, --ignore-spaces Ignore space after function names.
--local-infile Enable/disable LOAD DATA LOCAL INFILE.
-b, --no-beep Turn off beep on error.
-h, --host=name Connect to host.
-H, --html Produce HTML output.
-X, --xml Produce XML output
--line-numbers Write line numbers for errors.
-L, --skip-line-numbers
Don't write line number for errors. WARNING: -L is
deprecated, use long version of this option instead.
-n, --unbuffered Flush buffer after each query.
--column-names Write column names in results.
-N, --skip-column-names
Don't write column names in results. WARNING: -N is
deprecated, use long version of this options instead.
-O, --set-variable=name
Change the value of a variable. Please note that this
option is deprecated; you can set variables directly with
--variable-name=value.
--sigint-ignore Ignore SIGINT (CTRL-C)
-o, --one-database Only update the default database. This is useful for
skipping updates to other database in the update log.
--pager[=name] Pager to use to display results. If you don't supply an
option the default pager is taken from your ENV variable
PAGER. Valid pagers are less, more, cat [> filename],
etc. See interactive help (\h) also. This option does not
work in batch mode. Disable with --disable-pager. This
option is disabled by default.
--no-pager Disable pager and print to stdout. See interactive help
(\h) also. WARNING: option deprecated; use
--disable-pager instead.
-p, --password[=name]
Password to use when connecting to server. If password is
not given it's asked from the tty.
-P, --port=# Port number to use for connection or 0 for default to, in
order of preference, my.cnf, $MYSQL_TCP_PORT,
/etc/services, built-in default (3306).
--prompt=name Set the mysql prompt to this value.
--protocol=name The protocol of connection (tcp,socket,pipe,memory).
-q, --quick Don't cache result, print it row by row. This may slow
down the server if the output is suspended. Doesn't use
history file.
-r, --raw Write fields without conversion. Used with --batch.
--reconnect Reconnect if the connection is lost. Disable with
--disable-reconnect. This option is enabled by default.
-s, --silent Be more silent. Print results with a tab as separator,
each row on new line.
-S, --socket=name Socket file to use for connection.
--ssl Enable SSL for connection (automatically enabled with
other flags). Disable with --skip-ssl.
--ssl-ca=name CA file in PEM format (check OpenSSL docs, implies
--ssl).
--ssl-capath=name CA directory (check OpenSSL docs, implies --ssl).
--ssl-cert=name X509 cert in PEM format (implies --ssl).
--ssl-cipher=name SSL cipher to use (implies --ssl).
--ssl-key=name X509 key in PEM format (implies --ssl).
--ssl-verify-server-cert
Verify server's "Common Name" in its cert against
hostname used when connecting. This option is disabled by
default.
-t, --table Output in table format.
-T, --debug-info Print some debug info at exit.
--tee=name Append everything into outfile. See interactive help (\h)
also. Does not work in batch mode. Disable with
--disable-tee. This option is disabled by default.
--no-tee Disable outfile. See interactive help (\h) also. WARNING:
option deprecated; use --disable-tee instead
-u, --user=name User for login if not current user.
-U, --safe-updates Only allow UPDATE and DELETE that uses keys.
-U, --i-am-a-dummy Synonym for option --safe-updates, -U.
-v, --verbose Write more. (-v -v -v gives the table output format).
-V, --version Output version information and exit.
-w, --wait Wait and retry if connection is down.
--connect_timeout=# Number of seconds before connection timeout.
--max_allowed_packet=#
Max packet length to send to, or receive from server
--net_buffer_length=#
Buffer for TCP/IP and socket communication
--select_limit=# Automatic limit for SELECT when using --safe-updates
--max_join_size=# Automatic limit for rows in a join when using
--safe-updates
--secure-auth Refuse client connecting to server if it uses old
(pre-4.1.1) protocol
--show-warnings Show warnings after every statement.

Default options are read from the following files in the given order:
/etc/my.cnf ~/.my.cnf
The following groups are read: mysql client
The following options may be given as the first argument:
--print-defaults Print the program argument list and exit
--no-defaults Don't read default options from any options file
--defaults-file=# Only read default options from the given file #
--defaults-extra-file=# Read this file after the global files are read

Variables (--variable-name=value)
and boolean options {FALSE|TRUE} Value (after reading options)
--------------------------------- -----------------------------
auto-rehash TRUE
character-sets-dir (No default value)
default-character-set latin1
comments FALSE
compress FALSE
database (No default value)
delimiter ;
vertical FALSE
force FALSE
named-commands FALSE
local-infile FALSE
no-beep FALSE
host (No default value)
html FALSE
xml FALSE
line-numbers TRUE
unbuffered FALSE
column-names TRUE
sigint-ignore FALSE
port 0
prompt mysql>
quick FALSE
raw FALSE
reconnect FALSE
socket (No default value)
ssl FALSE
ssl-ca (No default value)
ssl-capath (No default value)
ssl-cert (No default value)
ssl-cipher (No default value)
ssl-key (No default value)
ssl-verify-server-cert FALSE
table FALSE
debug-info FALSE
user admin
safe-updates FALSE
i-am-a-dummy FALSE
connect_timeout 0
max_allowed_packet 16777216
net_buffer_length 16384
select_limit 1000
max_join_size 1000000
secure-auth FALSE
show-warnings FALSE
 
Back
Top