Server kann keine mails mehr empfangen...

R

RedLeffer

New Member
Hallo,

mein vServer empfängt irgendwie nach ein paar Tagen keine mails mehr.
Woran es liegt kann ich leider als newbie nicht sagen...
Jedenfalls sind meine mailVerzeichnise in /var/mail log leer...
Irgendwie kommt es mir auch so vor, dass die Mails teileise verzögert ankommen....


Und wenn ich in die mail.log schaue, habe ich das Gefühl das evtl. Spams über meinen Server versendet werden....


Hier mail ein kleiner Auszug

Aug 25 16:38:25 vs249173 postfix/smtp[3395]: 45302B1AE0AA: to=<[email protected]>, relay=none, delay=185806,
status=deferred (Host or domain name not found. Name service error for name=evangelworshipcenter.com type=MX: Host not foun
d, try again)
Aug 25 16:38:25 vs249173 postfix/smtp[3490]: 45302B1AE0AA: to=<[email protected]>, relay=none, delay=185806, status=deferr
ed (Host or domain name not found. Name service error for name=hopecma.com type=MX: Host not found, try again)
Aug 25 16:38:25 vs249173 postfix/smtp[3450]: 45302B1AE0AA: to=<[email protected]>, relay=none, delay=185806, status=deferred
(Host or domain name not found. Name service error for name=fuse.net type=MX: Host not found, try again)
Aug 25 16:38:26 vs249173 postfix/smtp[3476]: 45302B1AE0AA: to=<[email protected]>, relay=none, delay=185807, status=deferre
d (Host or domain name not found. Name service error for name=hhills.org type=MX: Host not found, try again)
Aug 25 16:38:29 vs249173 postfix/smtpd[4029]: connect from unknown[85.101.62.40]
Aug 25 16:38:29 vs249173 postfix/smtpd[4029]: lost connection after CONNECT from unknown[85.101.62.40]
Aug 25 16:38:29 vs249173 postfix/smtpd[4029]: disconnect from unknown[85.101.62.40]
Aug 25 16:38:39 vs249173 freshclam[1577]: Can't lock database directory: /var/lib/clamav
Aug 25 16:38:39 vs249173 freshclam[1577]: --------------------------------------
Aug 25 16:38:48 vs249173 postfix/smtpd[3647]: connect from unknown[85.179.244.224]
Aug 25 16:38:48 vs249173 postfix/smtpd[3647]: lost connection after CONNECT from unknown[85.179.244.224]
Aug 25 16:38:48 vs249173 postfix/smtpd[3647]: disconnect from unknown[85.179.244.224]
Aug 25 16:39:56 vs249173 clamd[32436]: Loaded 162255 signatures.
Aug 25 16:39:56 vs249173 clamd[32436]: Bound to address 127.0.0.1 on tcp port 3310
Aug 25 16:39:56 vs249173 clamd[32436]: Setting connection queue length to 15
Aug 25 16:39:56 vs249173 clamd[32436]: Unix socket file /var/lib/clamav/clamd-socket
Aug 25 16:39:56 vs249173 clamd[32436]: Setting connection queue length to 15
Aug 25 16:39:56 vs249173 clamd[32436]: Archive: Archived file size limit set to 10485760 bytes.
Aug 25 16:39:56 vs249173 clamd[32436]: Archive: Recursion level limit set to 8.
Aug 25 16:39:56 vs249173 clamd[32436]: Archive: Files limit set to 1000.
Aug 25 16:39:56 vs249173 clamd[32436]: Archive: Compression ratio limit set to 250.
Aug 25 16:39:56 vs249173 clamd[32436]: Archive support enabled.
Aug 25 16:39:56 vs249173 clamd[32436]: Algorithmic detection enabled.
Aug 25 16:39:56 vs249173 clamd[32436]: Portable Executable support enabled.
Aug 25 16:39:56 vs249173 clamd[32436]: ELF support enabled.
Aug 25 16:39:56 vs249173 clamd[32436]: Mail files support enabled.
Aug 25 16:39:56 vs249173 clamd[32436]: Mail: Recursion level limit set to 64.
Aug 25 16:39:56 vs249173 clamd[32436]: OLE2 support enabled.
Aug 25 16:39:56 vs249173 clamd[32436]: PDF support disabled.
Aug 25 16:39:56 vs249173 clamd[32436]: HTML support enabled.
Aug 25 16:39:56 vs249173 clamd[32436]: Self checking every 1800 seconds.
Aug 25 16:40:11 vs249173 postfix/smtpd[4029]: connect from unknown[201.1.164.230]
Aug 25 16:40:11 vs249173 postfix/smtpd[4029]: lost connection after CONNECT from unknown[201.1.164.230]
Aug 25 16:40:11 vs249173 postfix/smtpd[4029]: disconnect from unknown[201.1.164.230]
Aug 25 16:40:43 vs249173 postfix/smtpd[3647]: connect from unknown[84.139.194.117]
Click to expand...


Wie sollte ich weiter vorgehen? Danke!
 
RedLeffer said:
Wie sollte ich weiter vorgehen?
Click to expand...

ganz normal. Also so ungefähr wie die anderen 5 (oder so, ich habe sie nicht gezählt...) Leute, die in den letzten zwei Wochen hier im Forum das gleiche Problem hatten.

  1. mailq (was ist alles in der queue, gehört es dahin?)
  2. open-relay-Test durchführen
  3. MTA abschalten
  4. log-Files durchforsten, insbesondere auch die vom Apache
Kurz-um: Rausfinden, wie es dazu kommen konnte, dass die SPAMs versendet werden und sämtliche gefundenen Schwachstellen ausmerzen.
Wenn sich dabei rausstellt, dass die SPAMs nicht über ein defektes (php-, o.ä)Script versendet wurden und auch der Postfix-MTA richtig konfiguriert war, wurde wahrscheinlich eine andere Sicherheitslücke verwendet. In diesem Fall ist eine komplette Neuinstallation des Servers angebracht, da man nicht wissen kann, was sonst noch alles kompromittiert wurde. Im Rahmen der Neuinstallation sollten auch sofort alle verfügbaren Patches eingespielt werden (sollten sie auch in jedem anderen Fall...).

Oder einfach weiter warten, bis der Provider Dir den Saft abstellt, ordentlich einen über die Rübe zieht und Dir dann nochmal seine AGBs vorliest.

Auf geht's!
LinuxAdmin
 
Danke für deine Antwort,

also ich den Open Relay Test habe ich gemacht... da ist alles zu.
In der mailq habe ich ein paar komische Einträge, allerdings hab ich keinen Plan, was da jetzt hingehört und was nicht...


-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
4A7C8B1ADB80 5071 Sat Aug 25 16:57:16 MAILER-DAEMON
(connect to nowhere.nomorespam.com[82.98.86.165]: Connection refused)
[email protected]

4E4A2B1ADAB4 15021 Fri Aug 24 13:34:41 MAILER-DAEMON
(connect to mail.charter.com[209.225.8.224]: server refused to talk to me: 421 charter.net connection refused from [62.75.249.173])
[email protected]

421CBB1AD9E8 29042 Wed Aug 22 22:05:25 MAILER-DAEMON
(connect to mail.charter.com[209.225.8.224]: server refused to talk to me: 421 charter.net connection refused from [62.75.249.173])
[email protected]

4A0A7B1ADE02 3249 Thu Aug 23 13:00:13 [email protected]
(connect to mail.access995.com[66.187.162.108]: Connection timed out)
[email protected]

43B13B1AD9CC 3813 Wed Aug 22 12:18:38 MAILER-DAEMON
(connect to mail.osgoodmonument.com[72.232.95.70]: Connection timed out)
[email protected]

45302B1AE0AA 3249 Thu Aug 23 13:01:39 [email protected]
(Host or domain name not found. Name service error for name=crestlinenaz.com type=MX: Host not found, try again)
[email protected]
(host smtp3v.tela.com[206.98.7.69] said: 450 4.1.7 <[email protected]>: Sender address rejected: undeliverable address: host mail.ccfcu.com[72.18.132.204] said: 550 <[email protected]> No such user here (in reply to RCPT TO command) (in reply to RCPT TO command))
[email protected]
(host insolent.xo.com[207.155.248.245] said: 452 <[email protected]>: Recipient address rejected: Domain not active (in reply to RCPT TO command))
[email protected]
(connect to bnsconstruction.com[8.15.231.8]: Connection timed out)
[email protected]
(connect to laptoplist.com[65.23.157.190]: Connection timed out)
[email protected]

4F1FFB1AD98A 5932 Sat Aug 25 18:20:59 MAILER-DAEMON
(connect to mx1.huanyuequipment.com[168.61.70.16]: Connection timed out)
[email protected]

307E8B1ADBD8 5760 Sat Aug 25 16:55:11 MAILER-DAEMON
(connect to goldpost.ca[82.98.86.169]: Connection refused)
[email protected]

3108CB1ADB3C 22104 Fri Aug 24 17:37:17 MAILER-DAEMON
(connect to yheweathernetwork.com[72.5.175.97]: Connection timed out)
[email protected]

3DE3FB1ADA3A 3249 Thu Aug 23 13:25:57 [email protected]
(connect to thecoo.edu[192.206.50.1]: Connection refused)
[email protected]
(host suscom.net.mail6.psmtp.com[64.18.5.11] said: 451 Can't connect to suscom.net - psmtp (in reply to RCPT TO command))
[email protected]
(connect to mail.oda.org[65.43.28.98]: Connection timed out)
[email protected]

38CA8B1ADBAA 23822 Sat Aug 25 16:55:09 MAILER-DAEMON
(connect to lycosmail.co.uk[213.193.14.149]: Connection timed out)
[email protected]

0AAF5B1ADD90 5207 Wed Aug 22 20:40:53 MAILER-DAEMON
(connect to uhaultrailer.com[208.73.212.12]: Connection refused)
[email protected]

06BAEB1ADAE4 4802 Fri Aug 24 13:35:59 MAILER-DAEMON
(connect to stevepower.co.uk[212.53.71.146]: Connection timed out)
[email protected]

0022CB1ADFB6 3920 Tue Aug 21 12:46:28 MAILER-DAEMON
(connect to mail.yiwushawl.com[72.232.95.66]: Connection timed out)
[email protected]

1F41DB1ADBCE 21617 Sat Aug 25 16:44:26 MAILER-DAEMON
(connect to viaggistefani.com[85.46.122.242]: Connection timed out)
[email protected]

D1006B1ADFEE 8867 Tue Aug 21 20:03:42 MAILER-DAEMON
(connect to smtp.gigalink.net.br[189.1.48.2]: Connection timed out)
[email protected]

D23C0B1AD94C 22125 Tue Aug 21 14:53:21 MAILER-DAEMON
(connect to lycosmail.co.uk[213.193.14.149]: Connection timed out)
[email protected]

D4550B1AD950 18048 Sat Aug 25 20:34:59 MAILER-DAEMON
(connect to lycosmail.co.uk[213.193.14.149]: Connection timed out)
[email protected]

DF752B1ADA4A 3249 Thu Aug 23 13:27:39 [email protected]
(connect to mail.oda.org[65.43.28.98]: Connection timed out)
[email protected]
(Host or domain name not found. Name service error for name=integrityonline.com type=MX: Host not found, try again)
[email protected]

5413AB1AE090 22460 Thu Aug 23 00:15:23 MAILER-DAEMON
(connect to smtp.virtua.com.br[201.6.0.214]: Connection refused)
[email protected]

5BF29B1ADB0E 5670 Fri Aug 24 13:36:14 MAILER-DAEMON
(connect to clmail.afo.net[66.210.32.143]: Connection refused)
[email protected]

B9149B1ADD86 6838 Wed Aug 22 19:30:36 MAILER-DAEMON
(host inbound.localnet.com[207.251.194.26] said: 451 blocked, See: SpamCannibal (in reply to RCPT TO command))
[email protected]

BDC71B1AD900 18120 Sat Aug 25 19:28:09 MAILER-DAEMON
(host mx1.ru.nl[131.174.93.136] said: 450 4.1.1 <[email protected]>: Recipient address rejected: undeliverable address: host smtp-in.uci.ru.nl[131.174.66.177] said: 550 5.1.1 unknown or illegal alias: [email protected] (in reply to RCPT TO command) (in reply to RCPT TO command))
[email protected]

BA065B1AC770 3923 Sat Aug 25 18:18:39 MAILER-DAEMON
(connect to mail.ghettocluez.com[72.232.95.70]: Connection timed out)
[email protected]

B9483B1AD99A 3747 Wed Aug 22 00:11:41 MAILER-DAEMON
(connect to mail.trabajaradomicilio.com[72.232.95.66]: Connection timed out)
[email protected]

B14C9B1ADE14 3885 Thu Aug 23 14:22:47 MAILER-DAEMON
(connect to mail.drkenalibek.com[72.232.95.70]: Connection timed out)
[email protected]

BE9BBB1ADA3E 3249 Thu Aug 23 13:08:50 [email protected]
(connect to williams.net[66.116.125.142]: Connection refused)
[email protected]
(connect to rigsbycuisine.com[66.45.252.236]: Connection timed out)
[email protected]

E4D56B1AE06E 8242 Wed Aug 22 18:01:46 MAILER-DAEMON
(connect to smtp.virtua.com.br[201.6.0.214]: Connection refused)
[email protected]

E3607B1AC008 35845 Sat Aug 25 21:20:57 MAILER-DAEMON
(connect to mail.charter.com[209.225.8.224]: server refused to talk to me: 421 charter.net connection refused from [62.75.249.173])
[email protected]

E100AB1ADA00 5565 Sat Aug 25 18:21:04 MAILER-DAEMON
(connect to pacpipe.com[4.18.42.162]: Connection timed out)
[email protected]

71A19B1AD95E 3935 Sat Aug 25 19:28:09 MAILER-DAEMON
(connect to mail.cedrichorblin.com[72.232.95.70]: Connection timed out)
[email protected]

73F0DB1ADA6C 9273 Thu Aug 23 18:08:28 MAILER-DAEMON
(connect to security.tdatabrasil.net.br[200.153.1.105]: Connection timed out)
[email protected]

743DAB1ADD22 3819 Wed Aug 22 04:44:11 MAILER-DAEMON
(connect to mail.storymerical.com[72.232.95.70]: Connection timed out)
[email protected]

6967BB1AE0B0 3249 Thu Aug 23 14:06:07 [email protected]
(connect to home.com[206.207.85.33]: Connection refused)
[email protected]
(connect to mahoningcounty.org[70.60.37.39]: Connection refused)
[email protected]

68862B1AE034 8881 Wed Aug 22 11:29:48 MAILER-DAEMON
(connect to lycosmail.co.uk[213.193.14.149]: Connection timed out)
[email protected]

66A7DB1AD928 4000 Sat Aug 25 18:18:39 MAILER-DAEMON
(connect to mail.ware-nutrition.com[72.232.95.68]: Connection timed out)
[email protected]

6A3C6B1AE09A 3605 Thu Aug 23 01:53:51 MAILER-DAEMON
(connect to mail.reganbuilding.com[72.232.95.70]: Connection timed out)
[email protected]

6C6BBB1ADDCE 5539 Thu Aug 23 04:52:20 MAILER-DAEMON
(connect to Mail3.poboxes.com[69.56.175.206]: Connection timed out)
[email protected]

AC8FCB1ADA52 3249 Thu Aug 23 13:08:49 [email protected]
(connect to oplin.lib.oh.us[66.213.0.122]: Connection timed out)
[email protected]

AAB7BB1ADA5E 23931 Thu Aug 23 16:20:23 MAILER-DAEMON
(connect to lycosmail.co.uk[213.193.14.149]: Connection timed out)
[email protected]

A10F0B1AD9A6 17804 Wed Aug 22 04:45:51 MAILER-DAEMON
(connect to lycosmail.co.uk[213.193.14.149]: Connection timed out)
[email protected]

A3409B1AD9CA 7358 Fri Aug 24 13:34:39 MAILER-DAEMON
(Host or domain name not found. Name service error for name=2doms.com type=MX: Host not found, try again)
[email protected]

CC941B1ADA7E 22179 Thu Aug 23 19:24:53 MAILER-DAEMON
(Host or domain name not found. Name service error for name=holiway.net type=MX: Host not found, try again)
[email protected]

C72C0B1ADA9C 5775 Thu Aug 23 23:12:58 MAILER-DAEMON
(connect to mx2.usfamily.net[64.131.63.4]: server dropped connection without sending the initial SMTP greeting)
[email protected]

C7C41B1ADB00 5407 Fri Aug 24 13:35:01 MAILER-DAEMON
(lost connection with kcmsd.net[169.142.1.207] while receiving the initial SMTP greeting)
[email protected]

CD546B1ADD48 8805 Wed Aug 22 11:29:19 MAILER-DAEMON
(connect to lycosmail.co.uk[213.193.14.149]: Connection timed out)
[email protected]

C0235B1AD9F4 23129 Thu Aug 23 02:49:18 MAILER-DAEMON
(connect to security.tdatabrasil.net.br[200.153.1.105]: Connection timed out)
[email protected]

208D7B1ADDD4 14610 Thu Aug 23 05:50:27 MAILER-DAEMON
(connect to mail.charter.com[209.225.8.224]: server refused to talk to me: 421 charter.net connection refused from [62.75.249.173])
[email protected]

24515B1AE086 10469 Wed Aug 22 21:47:06 MAILER-DAEMON
(connect to mail1.advancethermal.com[75.32.43.5]: Connection refused)
[email protected]
Click to expand...

Nur der Eintrag ist ja schon mal net so toll:

B9149B1ADD86 6838 Wed Aug 22 19:30:36 MAILER-DAEMON
(host inbound.localnet.com[207.251.194.26] said: 451 blocked, See: SpamCannibal (in reply to RCPT TO command))
Click to expand...

Was meinste du mit MTA abschalten??


Die Logfiles vom Apache werde ich mir jetzt mal anschauen...
 
Also so wie ich das sehe, wird über deinen Server Spam verschickt.
MTA abschalten heißt für Dich Postfix abschalten/stoppen und das am Besten sofort.
Was ich Dir auch noch empfehlen würde: Alle vorhandenen Logfiles sicher und durchsuchen, weil es auch sein kann, dass dein Server gehackt wurde. Fehlende Logfile sind meiner Meinung nach immer ein schlechtes Zeichen.

Bei - huschi.net gibt es immer ein paar gute Tipps.
 
Hallo!
Das Spam versandt wird, kann ich aus den vorhandenen Logs nicht erkennen. Kann es sein, dass das lediglich bounces sind? Was wir brauchen, sind Logfiles der kompletten SMTP Transaktion. Also vom mail from: (inkl. UID) bis zum disconnect.

mfG
Thorsten
 
Hallo,

also ich hab mal meine cron Einträge angeschaut, da ist nichts auffälliges dabei... auch im /tmp Verzeichnis und in den phptmp Verzeichnissen ist nichts installiert...

Ich hab mir auch mal alle Logfiles runtergladen... wie genau könnte ich da was auffälliges finden? Will ja auch net hier alle Logfiles posten, sind ja doch schon recht groß...

Danke!
 
You must log in or register to reply here.
Back
Top