[Postfix] tausende bounce,smtpd,error etc. Prozesse

MDX

New Member
Hallo ich hab das Problem dass auf meinem Server viel zu viele Prozesse laufen und E-Mails teilweise bis zu 70 Stunden dauern bis sie zugstellt werden.
Ein kleiner Auszug aus der mail.log: http://178.33.33.90/mail.log.txt

Ich hab so das Gefühl das mein Server irgendwie als Spam-Mailer missbraucht wird, ich hab nur keine Ahnung wieso...
Im folgenden auch die postfix config und die postfix master.cf:

main.cf:
# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = /usr/share/doc/postfix

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = ks2xxxx.kimsufi.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = ks2xxxx.kimsufi.com, localhost, localhost.localdomain
relayhost =
mynetworks = 0.0.0.0/0
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
html_directory = /usr/share/doc/postfix/html
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /home/vmail
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_rhsbl_client rhsbl.sorbs.net, reject_rhsbl_sender rhsbl.sorbs.net, reject_rbl_client relays.ordb.org, reject_rbl_client list.dsbl.org, reject_rbl_client sbl.spamhaus.org, reject_rbl_client unconfirmed.dsbl.org, reject_rbl_client list.dsbl.org, reject_rbl_client dynablock.njabl.org, reject_rbl_client dialup.blacklist.jippg.org, reject_rbl_client multihop.dsbl.org, reject_rbl_client dialup.rbl.kropka.net, reject_rbl_client opm.blitzed.org, reject_rbl_client cbl.abuseat.org, reject_unauth_destination, reject_invalid_hostname, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_non_fqdn_recipient, reject_unknown_recipient_domain, check_sender_access pcre:/etc/postfix/sender_check
transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
virtual_create_maildirsize = yes
virtual_mailbox_extended = yes
virtual_mailbox_limit_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailbox_limit_maps.cf
virtual_mailbox_limit_override = yes
virtual_maildir_limit_message = "The user you are trying to reach is over quota."
virtual_overquota_bounce = yes
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps

master.cf:
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - - - 10 smtpd -v
#submission inet n - - - - smtpd
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#smtps inet n - - - - smtpd
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - - - - qmqpd
pickup fifo n - - 60 1 pickup
cleanup unix n - - 100 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - - 300 1 oqmgr
tlsmgr unix - - - 1000? 1 tlsmgr
rewrite unix - - - - - trivial-rewrite
#bounce unix - - - 100 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - - - 10 smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix - - - - - smtp
-o smtp_fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - - - - showq
error unix - - - - 10 error
retry unix - - - - - error
discard unix - - - - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - - - - lmtp
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}

amavis unix - - - - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes

127.0.0.1:10025 inet n - - - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_bind_address=127.0.0.1

ich hoffe jmd kann mir helfen...
 
Mh, zumindest yahoo.com blockiert Dich schonmal (schlecht!). :(
Lass bitte mal einen Open Relay-Test laufen!
Und prüfe gleich mal, auf welchen Blacklists Du gelandet bist.

Das Wichtigste: Solltest Du wirklich ein Open Relay haben, schalte sofort Postfix ab und mach Dich auf die Fehlersuche.
 
Last edited by a moderator:
Brachte leider auch keine besserung... Das mit dem Log funktioniert auch nicht und eigentlich kann es kein Script sein, da auf dem alten Server alles normal war und das erst mit dem neuen Server so Probleme gibt...
 
Das mit dem Log funktioniert auch nicht und eigentlich kann es kein Script sein, da auf dem alten Server alles normal war und das erst mit dem neuen Server so Probleme gibt...

Naja, sag niemals nie!
"Das ... funktioniert auch nicht" ist übrigens keine anständige Fehlerbeschreibung: Was genau funktioniert nicht und was genau hast Du getan?
Ich hatte mal testweise auf meinem Server das Logging wie auf der Seite beschrieben verwirklicht- und es ging einwandfrei.
Zur Postfix-Konfiguration kann ich nichts weiter sagen, lese mich gerade erst ein.
Schau doch mal auf irgendwelche "komischen" Anfragen im Logfile Deines Webservers bzw. auffällige Häufungen an Zugriffen.
Ein anderer Ansatz wäre, wenn Du mal versuchst, eine komplette SMTP-Session mitzusniffen.

Hast Du schon den anstehenden Spam aus der Mailqueue gelöscht?
 
Naja also ich hab das mit dem sendmail gemacht aber da wird nichts geloggt und der sendmail pfad in der php.ini ist leer :) und besondere Auffälligkeiten in den Accesslogs gibts auch nich :D

Und die Queue lass ich gerade mit
Code:
postsuper -d ALL
löschen...

Außerdem ist auffällig dass postfix ewig zum starten benötigt wenn man das stoppt und es beim reboot schneller geht....

Ich hab es eben nochmal getestet aber es kommt
connection timed out
...
 
Verstehe ich dich richtig, dass Dein Postfix noch läuft? :eek:

Als allererstes stoppst Du den nun und versicherst dich, dass dieser nicht mehr läuft! (und nicht via Cron, Watchdog, Plesk, whatever wieder gestartet wird).
Dann schaust Du mal, wie viele Mails noch in der Queue liegen. Und _nein_, du löschst die Queue nicht.
Analysiere die Mails in der Queue, wie diese auf deinen Server eingespeist wurden. Und bitte nicht nur eine Mail. Anhand dieser Ergebnisse kannst Du dann die weitere Analyse planen.

Logfiles und Mailqueue lässt du bis zum Ende auf dem Server. Erst wenn Du deine Analysen abgeschlossen und die vermeintliche Infiltrationsstelle geschlossen hast, kannst Du die Queue löschen und Postfix wieder starten.

Jedes andere Verhalten ist grob fahrlässig!
 
So also ich hab die Mailqueue mal analysiert, aber irgendwelche neuen Details stehen da auch nicht drinne...
[...]
EDC27D893A3* 3474 Fri Jul 16 14:12:14 nofrom@email
(delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
paradiso0809@yahoo.com.tw
pc131155@yahoo.com.tw
piyu8887@yahoo.com.tw
plo0031gwd7436931@yahoo.com.tw
(delivery temporarily suspended: connect to ms28a.hinet.net[168.95.5.28]:25: Connection timed out)
pc044774@ms28.hinet.net
(delivery temporarily suspended: host msa-mx3.hinet.net[168.95.6.116] refused to talk to me: 421 Too many SMTP sessions for this host)
paul.a1@msa.hinet.net
(delivery temporarily suspended: host mx2.mail.tw.yahoo.com[203.188.197.10] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
power_lemmings@yahoo.com.tw
paul1003beyond@yahoo.com.tw
(delivery temporarily suspended: Host or domain name not found. Name service error for name=horizon-design-tw.com type=MX: Host not found, try again)
pig@horizon-design-tw.com
(delivery temporarily suspended: host mx2.mail.tw.yahoo.com[203.188.197.10] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
peyn@yahoo.com.tw
(delivery temporarily suspended: connect to ms33a.hinet.net[168.95.5.33]:25: Connection timed out)
passer@ms33.hinet.net
(delivery temporarily suspended: lost connection with mx3.hotmail.com[65.54.188.126] while sending RCPT TO)
pnycji@hotmail.com
(delivery temporarily suspended: host umaila.hinet.net[168.95.5.198] refused to talk to me: 421 Too many SMTP sessions for this host)
peggy-c1353@umail.hinet.net
(delivery temporarily suspended: connect to ms22a.hinet.net[168.95.5.22]:25: Connection timed out)
ppk12165@ms22.hinet.net
(delivery temporarily suspended: host msa-mx2.hinet.net[168.95.6.114] refused to talk to me: 421 Too many SMTP sessions for this host)
ps.j812@msa.hinet.net
(delivery temporarily suspended: host mx2.mail.tw.yahoo.com[203.188.197.10] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
pokamy168@yahoo.com.tw
poijkl0213@yahoo.com.tw
(delivery temporarily suspended: host ms45a.hinet.net[168.95.5.45] refused to talk to me: 421 Too many SMTP sessions for this host)
ptn53@ms45.hinet.net
(delivery temporarily suspended: host d.mx.mail.yahoo.com[209.191.88.254] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/421-ts03.html)
privatesale2001@yahoo.com
(delivery temporarily suspended: host mx2.mail.tw.yahoo.com[203.188.197.10] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
pipi220517@yahoo.com.tw
poayoyo@yahoo.com.tw
pt2035p@yahoo.com.tw
paolien91@yahoo.com.tw
pio45628@yahoo.com.tw
plan841214@yahoo.com.tw
plshung@yahoo.com.tw
pokcx@yahoo.com.tw
psdc168@yahoo.com.tw
petslove@yahoo.com.tw
promise6819@yahoo.com.tw
(delivery temporarily suspended: host msa-mx1.hinet.net[168.95.6.184] refused to talk to me: 421 Too many SMTP sessions for this host)
pin22.puli@msa.hinet.net
pgo.pgo@msa.hinet.net
phil.chyuan@msa.hinet.net
pisces.lynn@msa.hinet.net
point.viva@msa.hinet.net
pb6.csw0626@msa.hinet.net
personnel.sophie@msa.hinet.net
(delivery temporarily suspended: connect to umaila.hinet.net[168.95.5.198]:25: Connection timed out)
pan-ming@umail.hinet.net
peter-yu16@umail.hinet.net
pecos-chang@umail.hinet.net
(delivery temporarily suspended: connect to cm1a.hinet.net[168.95.5.44]:25: Connection timed out)
ppk11254@cm1.hinet.net
ponti@cm1.hinet.net
(delivery temporarily suspended: host ms16a.hinet.net[168.95.5.16] refused to talk to me: 421 Too many SMTP sessions for this host)
ppt13755@ms16.hinet.net
(delivery temporarily suspended: host ms32a.hinet.net[168.95.5.32] refused to talk to me: 421 Too many SMTP sessions for this host)
pmb@ms32.hinet.net
(delivery temporarily suspended: host ms6a.hinet.net[168.95.5.6] refused to talk to me: 421 Too many SMTP sessions for this host)
pdavkeibmrvo@ms6.hinet.net
(delivery temporarily suspended: connect to 0.0.0.0[0.0.0.0]:25: Connection timed out)
power322@tcts.seed.net
(delivery temporarily suspended: host ms25a.hinet.net[168.95.5.25] refused to talk to me: 421 Too many SMTP sessions for this host)
pc6693@ms25.hinet.net
(bounce or trace service failure)
pigwood@ms26.seed.net.tw
persuaded@cupsaet.de
pattylockhart@alod.net
people@ms1.libra.com.tw
paul@netman.idv.tw
president@340freactionsf.com
pdssg@gn.tpemail.net.tw
ppk11240@pavo.seed.net.tw
pop@pompu.com
paul@timetravel.franz.com
pizanara@piza.podzone.org
piasfar@get2net.dk
(connect to cluster12.us.messagelabs.com[216.82.250.67]:25: Connection refused)
pdorf503ma@citicorp.com
(bounce or trace service failure)
pisiz@xuite.net
phcedu@xuite.net
penddu85@gmail.com
premtek@giga.net.tw

E3DFBBDDAB8* 3222 Wed Jul 14 15:13:58 ivan-daisy@hotmail.com
(delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
nfbl@yahoo.com.tw
niwangbi@yahoo.com.tw
(delivery temporarily suspended: host mx1.mail.hk2.yahoo.com[124.108.110.21] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
onhk99chan2005@yahoo.com.hk
(delivery temporarily suspended: connect to yahool.com.tw[208.72.2.186]:25: Connection refused)
nolittleblue@yahool.com.tw
(delivery temporarily suspended: host mx2.mail.tw.yahoo.com[203.188.197.10] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
onstance0716@yahoo.com.tw
nvyt@yahoo.com.tw
(delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.0 [TS02] Messages from 9xxxxxxxxxx6 temporarily deferred - 4.16.56.1; see http://postmaster.yahoo.com/errors/421-ts02.html)
n690807@yahoo.com.tw
nwnhb@yahoo.com.tw
(delivery temporarily suspended: connect to hyperlink.com.tw[208.73.210.28]:25: Connection timed out)
olf@hyperlink.com.tw
(delivery temporarily suspended: connect to sinamail.com[69.43.160.178]:25: Connection refused)
nww@sinamail.com
(bounce or trace service failure)
nfge@cpcb.com.tw
nlkkajrqoq@gmail.com
nissan@honda-hit.com.tw
oldgrain@sina.com
no@pchome.com.tw
niky@walkgame.com.tw
oessekaj@venus.seed.net.tw
ntp@hongjue.com.tw
nicole@honbo.com.tw
oliver.k@medizin.uni-halle.de
olf@willgold.com.tw

E24E5D8D1AA* 1884 Sat Jul 17 11:48:28 senelson@ms61.hinet.net
(delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
urimo@yahoo.com.tw
uyobohuo@yahoo.com.tw
vivianwang928@yahoo.com.tw
vul3196wj4@yahoo.com.tw
wassabiq@yahoo.com.tw
wiuq@yahoo.com.tw
(delivery temporarily suspended: connect to ms52a.hinet.net[168.95.5.52]:25: Connection timed out)
whatsusee@ms52.hinet.net
(delivery temporarily suspended: connect to ms23a.hinet.net[168.95.5.23]:25: Connection timed out)
vanessaterry@ms23.hinet.net
(delivery temporarily suspended: host ms3a.hinet.net[168.95.5.3] refused to talk to me: 421 Too many SMTP sessions for this host)
victorfish@ms3.hinet.net
(delivery temporarily suspended: host ms21a.hinet.net[168.95.5.21] refused to talk to me: 421 Too many SMTP sessions for this host)
winers123@ms21.hinet.net
unyt@ms21.hinet.net
(delivery temporarily suspended: host ms43a.hinet.net[168.95.5.43] refused to talk to me: 421 Too many SMTP sessions for this host)
wildorchid7@ms43.hinet.net
(delivery temporarily suspended: host ms58a.hinet.net[168.95.5.58] refused to talk to me: 421 Too many SMTP sessions for this host)
vohq@ms58.hinet.net
(delivery temporarily suspended: connect to ms13a.hinet.net[168.95.5.13]:25: Connection timed out)
wangdean@ms13.hinet.net
(delivery temporarily suspended: connect to ms55a.hinet.net[168.95.5.55]:25: Connection timed out)
wendy1012@ms55.hinet.net
(delivery temporarily suspended: host mx2.mail.tw.yahoo.com[203.188.197.10] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
uolingli@yahoo.com.tw
uoyuai@yahoo.com.tw
webmiss@yahoo.com.tw
virusspy@yahoo.com.tw
ufjl0710@yahoo.com.tw
vivihelen@yahoo.com.tw
wsg12@yahoo.com.tw
u12017@yahoo.com.tw
ufor1619@yahoo.com.tw
(delivery temporarily suspended: lost connection with mx3.hotmail.com[65.54.188.126] while sending RCPT TO)
wsp516@hotmail.com
(delivery temporarily suspended: host ms10a.hinet.net[168.95.5.10] refused to talk to me: 421 Too many SMTP sessions for this host)
usnw@ms10.hinet.net
(delivery temporarily suspended: host ms52a.hinet.net[168.95.5.52] refused to talk to me: 421 Too many SMTP sessions for this host)
vziz@ms52.hinet.net
(delivery temporarily suspended: host mx2.mail.tw.yahoo.com[203.188.197.10] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html)
wmcheng@yahoo.com.tw
(delivery temporarily suspended: host ms67a.hinet.net[168.95.5.67] refused to talk to me: 421 Too many SMTP sessions for this host)
u712016@ms67.hinet.net
(delivery temporarily suspended: host ms63a.hinet.net[168.95.5.63] refused to talk to me: 421 Too many SMTP sessions for this host)
willeken@ms63.hinet.net
(delivery temporarily suspended: connect to mx2.mail.tw.yahoo.com[203.188.197.10]:25: Connection timed out)
usracts@yahoo.com.tw
ufo190@yahoo.com.tw
ui1534@yahoo.com.tw
uib01597@yahoo.com.tw
umur13@yahoo.com.tw
vian221029@yahoo.com.tw
vicky5415@yahoo.com.tw
waa666101@yahoo.com.tw
wail274@yahoo.com.tw
whale_cetus@yahoo.com.tw
wudangle@yahoo.com.tw
wumesheng@yahoo.com.tw
(delivery temporarily suspended: host ms63a.hinet.net[168.95.5.63] refused to talk to me: 421 Too many SMTP sessions for this host)
u5203055@ms63.hinet.net
(delivery temporarily suspended: host ms54a.hinet.net[168.95.5.54] refused to talk to me: 421 Too many SMTP sessions for this host)
webg@ms54.hinet.net
(delivery temporarily suspended: connect to ms9a.hinet.net[168.95.5.9]:25: Connection refused)
whjy@ms9.hinet.net
(delivery temporarily suspended: connect to ms64a.hinet.net[168.95.5.64]:25: Connection timed out)
uib02249@ms64.hinet.net
(delivery temporarily suspended: lost connection with ms6a.hinet.net[168.95.5.6] while receiving the initial server greeting)
vanillaf@ms6.hinet.net
(delivery temporarily suspended: host ms1a.hinet.net[168.95.5.1] refused to talk to me: 421 Too many SMTP sessions for this host)
wvcwflep@ms1.hinet.net
(delivery temporarily suspended: host ms77a.hinet.net[168.95.5.77] refused to talk to me: 421 Too many SMTP sessions for this host)
verve@ms77.hinet.net
v0310@ms77.hinet.net
(delivery temporarily suspended: host ms69a.hinet.net[168.95.5.69] refused to talk to me: 421 Too many SMTP sessions for this host)
wacoal@ms69.hinet.net
uotp@ms69.hinet.net
(delivery temporarily suspended: connect to ms11a.hinet.net[168.95.5.11]:25: Connection timed out)
u8517042@ms11.hinet.net
(delivery temporarily suspended: connect to ms55a.hinet.net[168.95.5.55]:25: Connection timed out)
ultraman@ms55.hinet.net
(delivery temporarily suspended: host ms58a.hinet.net[168.95.5.58] refused to talk to me: 421 Too many SMTP sessions for this host)
vsvs@ms58.hinet.net
(delivery temporarily suspended: connect to ms49a.hinet.net[168.95.5.49]:25: Connection timed out)
vk98@ms49.hinet.net
weiwei0412@ms49.hinet.net
(delivery temporarily suspended: host ms43a.hinet.net[168.95.5.43] refused to talk to me: 421 Too many SMTP sessions for this host)
vtctor@ms43.hinet.net
(delivery temporarily suspended: host ms42a.hinet.net[168.95.5.42] refused to talk to me: 421 Too many SMTP sessions for this host)
wcchang0@ms42.hinet.net
(delivery temporarily suspended: connect to ms57a.hinet.net[168.95.5.57]:25: Connection timed out)
wevents@ms57.hinet.net
(delivery temporarily suspended: host ms53a.hinet.net[168.95.5.53] refused to talk to me: 421 Too many SMTP sessions for this host)
v111@ms53.hinet.net
(delivery temporarily suspended: host ms47a.hinet.net[168.95.5.47] refused to talk to me: 421 Too many SMTP sessions for this host)
wei322@ms47.hinet.net
(delivery temporarily suspended: host ms59a.hinet.net[168.95.5.59] refused to talk to me: 421 Too many SMTP sessions for this host)
wuig@ms59.hinet.net
webmaster@epic.org

[...]

Auch eine neuinstallation brachte kein Neuerung...
 
Last edited by a moderator:
Auch eine neuinstallation brachte kein Neuerung.
Soviel zu wstuermer's Rat die Mails nicht an zu fassen bis die Analyse fertig ist.

Was sagen die Header der Emails in der Mailqueue?
Bitte 1:1 posten, nicht interpretieren; meist sind alle "gut aussehenden" Zeilen faked.

und der sendmail pfad in der php.ini
Dann nimmt er den Default-Wert "sendmail -t -i" welcher unter allen System ausser Debian anstandslos funktioniert. (Debian mag "-i" nicht)

Was sagt "lsof -i :25" (lsof ggf nachinstallieren)
Ich hoffe ja mal dass postfix _down_ ist und der Port in Iptables blockiert.
 
ich hab den Sendmail Pfad der php.ini jetzt mal geändert...

und der Befehl lsof -i :25 macht gar nichts... wahrscheinlich weil auch Postfix nicht läuft..

Und hier mal die Header von 3 Mails aus er Queue:

CO 1475 1089 6 0 1475T^Q1279062569 439395A^Vcreate_time=1279062569A^Vrewrite_context=remoteS^Uioedxv799271@yahoo.ieA^Wlog_client_name=unknownA log_client_address=58.22.101.239A^Tlog_client_port=2547A)log_message_origin=unknown[58.22.101.239]A!log_helo_name=ks26455.kimsufi.comA^Vlog_protocol_name=SMTPA^Sclient_name=unknownA^[reverse_client_name=unknownA^\client_address=58.22.101.239A^Pclient_port=2547A^]helo_name=ks26455.kimsufi.comA^Rprotocol_name=SMTPA^Uclient_address_type=2A,dsn_orig_rcpt=rfc822;levislo.tw@yahoo.com.twO^Wlevislo.tw@yahoo.com.twR^Wlevislo.tw@yahoo.com.twA)dsn_orig_rcpt=rfc822;svdi162@yahoo.com.twO^Tsvdi162@yahoo.com.twR^Tsvdi162@yahoo.com.twA+dsn_orig_rcpt=rfc822;cool16825@yahoo.com.twO^Vcool16825@yahoo.com.twR^Vcool16825@yahoo.com.twA+dsn_orig_rcpt=rfc822;voon_1410@yahoo.com.twO^Vvoon_1410@yahoo.com.twR^Vvoon_1410@yahoo.com.twA+dsn_orig_rcpt=rfc822;ninny1973@yahoo.com.twO^Vninny1973@yahoo.com.twR^Vninny1973@yahoo.com.twA-dsn_orig_rcpt=rfc822;0.555222000@yahoo.com.twO^X0.555222000@yahoo.com.twR^X0.555222000@yahoo.com.twM^@N<Received: from ks2xxx.kimsufi.com (unknown [58.22.101.239])N; by ks2xxxx.kimsufi.com (Postfix) with SMTP id E01A5D58249;N' Wed, 14 Jul 2010 01:09:29 +0200 (CEST)N4Message-ID: <UARCAPIWNQRXZKFCGDHAXAI@ms21.hinet.net>NCFrom: "+ ¢Ý¢Ù¶U180´Á0§Q²v¢f ¢f DallasTracy" <ioedxv799271@yahoo.ie>NGReply-To: "+ ¢Ý¢Ù¶U180´Á0§Q²v¢f ¢f DallasTracy" <ioedxv799271@yahoo.ie>N~S^ATo: levislo.tw@yahoo.com.tw, svdi162@yahoo.com.tw, cool16825@yahoo.com.tw, voon_1410@yahoo.com.tw, ninny1973@yahoo.com.tw, 0.555222000@yahoo.com.twN/Subject: ¦~Ãö±Nªñ¡A·Ç³Æ²{ª÷*n¶X¦*!!VernonBartonN%Date: Thu, 15 Jul 2010 02:05:08 +0300N2X-Mailer: Microsoft Outlook Express 6.00.2600.0000N^QMIME-Version: 1.0N$Content-Type: multipart/alternative;N^] boundary="--454502765336235"N^MX-Priority: 3N^YX-MSMail-Priority: NormalN^@N^S----454502765336235N^XContent-Type: text/html;N!Content-Transfer-Encoding: base64N^@NHDQo8cD48Yj48Zm9udCBzaXplPSI2IiBjb2xvcj0iI0ZGMDAwMCI+pKO2VaVpsaQhISE8L2ZvNHbnQ+PC9iPjwvcD4NCjxwPjxiPjxmb250IHNpemU9IjYiIGNvbG9yPSIjMDAwMEZGIj4xMjC4NHVTE4MLTBMKdRsnY8L2ZvbnQ+PC9iPjwvcD4NCjxwPjxiPjxmb250IHNpemU9IjYiIGNvbG9yNHPSIjMDAwMEZGIj6k66VJpKOo7DE2MzAwPC9mb250PjwvYj48L3A+DQo8cD48Yj48Zm9udCBzNHaXplPSI2IiBjb2xvcj0iIzAwMDBGRiI+wlyy5rbFsMizzKZuvve3fKFBp0HB2bdRtaWmaKRbNHoUihSDwvZm9udD48L2I+PC9wPg0KPHA+PGI+PGZvbnQgc2l6ZT0iNiIgY29sb3I9IiMwMDAwNHRkYiPjxhIGhyZWY9Imh0dHA6Ly9mbHkyLndzLzFFa2FxNDciPr11pFenS7ZPv9S437jVuuI8N>L2E+PC9mb250PjwvYj48L3A+DQoNCjwvYm9keT4NCg0KPC9odG1sPg0KOQ==^@^@N^@N^U----454502765336235--N^@X^@E^@
und
CO 298 717 1 0 298T^Q1279141254 615771A^Vcreate_time=1279141254A^Vrewrite_context=remoteS^Xyvvzrrzhmzajis@yahoo.comA1log_client_name=118-167-131-252.dynamic.hinet.netA"log_client_address=118.167.131.252A^Tlog_client_port=4545AElog_message_origin=118-167-131-252.dynamic.hinet.net[118.167.131.252]A^Zlog_helo_name=91.121.78.16A^Vlog_protocol_name=SMTPA-client_name=118-167-131-252.dynamic.hinet.netA5reverse_client_name=118-167-131-252.dynamic.hinet.netA^^client_address=118.167.131.252A^Pclient_port=4545A^Vhelo_name=9xxxxxxxxx6A^Rprotocol_name=SMTPA^Uclient_address_type=2A*dsn_orig_rcpt=rfc822;pooh9304@yahoo.com.twO^Upooh9304@yahoo.com.twR^Upooh9304@yahoo.com.twM^@NQReceived: from 9xxxxxxx6 (118-167-131-252.dynamic.hinet.net [118.167.131.252])N: by ks2xxxxx.kimsufi.com (Postfix) with SMTP id E206CD69E94ND for <pooh9304@yahoo.com.tw>; Wed, 14 Jul 2010 23:00:54 +0200 (CEST)N@Received: from 16.62.227.80 by ; Thu, 15 Jul 2010 00:56:54 +0400N^QMessage-ID: <M[20X^@E^@
und so eine Mail war auch dabei...:
<kirin.ey@msa.hinet.net>: delivery temporarily suspended: connect to msa-mx11.hinet.net[168.95.6.176]:25: Connection timed out
recipient=kirin.ey@msa.hinet.net
offset=1064
dsn_orig_rcpt=rfc822;kirin.ey@msa.hinet.net
status=4.4.1
action=delayed
reason=delivery temporarily suspended: connect to msa-mx11.hinet.net[168.95.6.176]:25: Connection timed out


<kist248922001@yahoo.com.tw>: delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html
recipient=kist248922001@yahoo.com.tw
offset=694
dsn_orig_rcpt=rfc822;kist248922001@yahoo.com.tw
status=4.7.1
action=delayed
reason=delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html


<kksteed@yahoo.com.tw>: delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html
recipient=kksteed@yahoo.com.tw
offset=787
dsn_orig_rcpt=rfc822;kksteed@yahoo.com.tw
status=4.7.1
action=delayed
reason=delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html


<kukusun628@yahoo.com.tw>: delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html
recipient=kukusun628@yahoo.com.tw
offset=592
dsn_orig_rcpt=rfc822;kukusun628@yahoo.com.tw
status=4.7.1
action=delayed
reason=delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.9] refused to talk to me: 421 4.7.1 [TS03] All messages from 9xxxxxxx6 will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/errors/421-ts03.html


<ki-candy@umail.hinet.net>: delivery temporarily suspended: connect to umaila.hinet.net[168.95.5.98]:25: Connection timed out
recipient=ki-candy@umail.hinet.net
offset=1530
dsn_orig_rcpt=rfc822;ki-candy@umail.hinet.net
status=4.4.1
action=delayed
reason=delivery temporarily suspended: connect to umaila.hinet.net[168.95.5.98]:25: Connection timed out
 
Bitte den Datenmuell in lesbarer Form hochladen.. danke
Ich habe nachdem ich ^ durch \n ersetzt habe einen halbwegs lesbaren Inhalt wiederhergestellt, ist copy-pasting so schwer? oO

Soweit ich sehen kann ist dein Server "naiv"; er glaubt es mit localhost zu tun zu haben sobald der sendende Server als Hostname deine IP angibt.
Konfigurier mal den Mailserver anstaendig/ueberhaupt dann sollte der Open-Relay auch gefixt sein...

und der Befehl lsof -i :25 macht gar nichts... wahrscheinlich weil auch Postfix nicht läuft..
Ok gut. Das bedeutet dass aktuell keine Verbindungen auf dem Port sind und somit kein Spam versendet wird.


Deine Letzte Email bedeutet schlicht dass du auf der Blacklist bist (und da wahrscheinlich dank mehreren Tagen spamming nicht so schnell runter kommst).
 
Bitte den Datenmuell in lesbarer Form hochladen.. danke
Ich habe nachdem ich ^ durch \n ersetzt habe einen halbwegs lesbaren Inhalt wiederhergestellt, ist copy-pasting so schwer? oO
Nein ist nicht schwer aber war aus Putty durch vi ich wollte es ersetzten aber du meintest ja 1:1 ;)

Soweit ich sehen kann ist dein Server "naiv"; er glaubt es mit localhost zu tun zu haben sobald der sendende Server als Hostname deine IP angibt.
Konfigurier mal den Mailserver anstaendig/ueberhaupt dann sollte der Open-Relay auch gefixt sein...
Okay... ich hab nicht so viel Erfahrung mit Postfix, wie kann ich das Einstellen? (die main.cf steht oben...)

Deine Letzte Email bedeutet schlicht dass du auf der Blacklist bist (und da wahrscheinlich dank mehreren Tagen spamming nicht so schnell runter kommst).
Das hab ich auch schon gesehen... Ich hoffe ich komm da irgendwann wieder runter...
 
Back
Top