verdächtige Einträge in mail.log



R

rolapp

Fan vom SSF
Beim durchsehen der mail.log ist mir aufgefallen, das immer wieder der selbe Eintrag aber mit unterschiedlichen IPs auftaucht. Das waren gestern 46 Einträge.

Code: 
Aug  1 00:09:25 color postfix/smtpd[20416]: NOQUEUE: reject: RCPT from 12.19.14.37.dynamic.jazztel.es[37.14.19.12]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 00:27:39 color postfix/smtpd[20824]: NOQUEUE: reject: RCPT from host218-63-static.40-85-b.business.telecomitalia.it[85.40.63.218]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 00:46:01 color postfix/smtpd[21359]: NOQUEUE: reject: RCPT from 12.19.14.37.dynamic.jazztel.es[37.14.19.12]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 01:41:48 color postfix/smtpd[22663]: NOQUEUE: reject: RCPT from h114.63.135.216.ip.windstream.net[216.135.63.114]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 02:57:09 color postfix/smtpd[24471]: NOQUEUE: reject: RCPT from unknown[190.187.22.140]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 04:13:07 color postfix/smtpd[26198]: NOQUEUE: reject: RCPT from unknown[212.75.134.12]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 04:51:13 color postfix/smtpd[27029]: NOQUEUE: reject: RCPT from 105-236-98-19.access.mtnbusiness.co.za[105.236.98.19]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 05:29:25 color postfix/smtpd[27876]: NOQUEUE: reject: RCPT from unknown[212.75.134.12]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 06:07:04 color postfix/smtpd[28798]: NOQUEUE: reject: RCPT from unknown[50.244.253.9]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 07:00:28 color postfix/smtpd[30168]: NOQUEUE: reject: RCPT from unknown[79.136.209.154]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 07:36:06 color postfix/smtpd[30996]: NOQUEUE: reject: RCPT from unknown[92.87.210.196]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 08:10:04 color postfix/smtpd[31823]: NOQUEUE: reject: RCPT from unknown[14.169.109.250]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 08:27:04 color postfix/smtpd[32241]: NOQUEUE: reject: RCPT from unknown[92.87.210.196]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 08:43:37 color postfix/smtpd[537]: NOQUEUE: reject: RCPT from unknown[50.244.253.9]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 09:00:33 color postfix/smtpd[983]: NOQUEUE: reject: RCPT from unknown[118.97.191.155]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 09:33:45 color postfix/smtpd[1921]: NOQUEUE: reject: RCPT from unknown[210.177.87.105]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 10:06:26 color postfix/smtpd[2834]: NOQUEUE: reject: RCPT from unknown[180.166.96.38]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 10:23:16 color postfix/smtpd[3399]: NOQUEUE: reject: RCPT from host34-208-static.98-5-b.business.telecomitalia.it[5.98.208.34]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 10:55:34 color postfix/smtpd[4187]: NOQUEUE: reject: RCPT from unknown[196.41.205.29]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 11:44:25 color postfix/smtpd[7672]: NOQUEUE: reject: RCPT from unknown[190.187.22.140]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 11:59:41 color postfix/smtpd[7938]: NOQUEUE: reject: RCPT from dug42.internetdsl.tpnet.pl[83.19.218.42]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 12:15:40 color postfix/smtpd[8792]: NOQUEUE: reject: RCPT from unknown[180.166.96.38]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 12:30:58 color postfix/smtpd[9140]: NOQUEUE: reject: RCPT from cm-85-152-57-61.telecable.es[85.152.57.61]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 12:47:00 color postfix/smtpd[9636]: NOQUEUE: reject: RCPT from pfn94.internetdsl.tpnet.pl[46.171.143.94]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 13:03:04 color postfix/smtpd[10027]: NOQUEUE: reject: RCPT from pfn94.internetdsl.tpnet.pl[46.171.143.94]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 14:07:10 color postfix/smtpd[11238]: NOQUEUE: reject: RCPT from unknown[223.30.78.91]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 14:23:06 color postfix/smtpd[12033]: NOQUEUE: reject: RCPT from unknown[210.177.87.105]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 15:59:50 color postfix/smtpd[14448]: NOQUEUE: reject: RCPT from adsl-074-165-019-209.sip.asm.bellsouth.net[74.165.19.209]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 16:16:46 color postfix/smtpd[14923]: NOQUEUE: reject: RCPT from unknown[200.80.106.38]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 16:33:52 color postfix/smtpd[15297]: NOQUEUE: reject: RCPT from unknown[190.187.22.140]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 16:50:34 color postfix/smtpd[15671]: NOQUEUE: reject: RCPT from 80.224.50.223.static.user.ono.com[80.224.50.223]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 17:22:53 color postfix/smtpd[16476]: NOQUEUE: reject: RCPT from ll62-2-210-251-62.ll62.iam.net.ma[62.251.210.2]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 17:38:33 color postfix/smtpd[16819]: NOQUEUE: reject: RCPT from cable-89-216-21-136.static.sbb.rs[89.216.21.136]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 18:09:47 color postfix/smtpd[17649]: NOQUEUE: reject: RCPT from unknown[200.80.106.38]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 18:25:30 color postfix/smtpd[18013]: NOQUEUE: reject: RCPT from unknown[213.55.73.129]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 19:13:32 color postfix/smtpd[19079]: NOQUEUE: reject: RCPT from unknown[14.169.109.250]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 19:29:36 color postfix/smtpd[19424]: NOQUEUE: reject: RCPT from 12.19.14.37.dynamic.jazztel.es[37.14.19.12]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 19:46:05 color postfix/smtpd[19843]: NOQUEUE: reject: RCPT from 105-236-255-125.access.mtnbusiness.co.za[105.236.255.125]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 20:02:13 color postfix/smtpd[20253]: NOQUEUE: reject: RCPT from 12.19.14.37.dynamic.jazztel.es[37.14.19.12]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 20:34:42 color postfix/smtpd[21035]: NOQUEUE: reject: RCPT from unknown[186.215.174.252]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 21:07:02 color postfix/smtpd[21792]: NOQUEUE: reject: RCPT from unknown[194.75.77.138]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 21:39:47 color postfix/smtpd[22527]: NOQUEUE: reject: RCPT from unknown[186.215.174.252]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 22:28:44 color postfix/smtpd[23836]: NOQUEUE: reject: RCPT from 12.19.14.37.dynamic.jazztel.es[37.14.19.12]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 23:01:55 color postfix/smtpd[13063]: NOQUEUE: reject: RCPT from ll62-2-210-251-62.ll62.iam.net.ma[62.251.210.2]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 23:18:04 color postfix/smtpd[13459]: NOQUEUE: reject: RCPT from h114.63.135.216.ip.windstream.net[216.135.63.114]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>
Aug  1 23:34:30 color postfix/smtpd[13828]: NOQUEUE: reject: RCPT from rexhel.lnk.telstra.net[203.45.163.105]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.2.33]>

Weiß jemand von Euch was das zu bedeuten hat, merkt hier jemand nicht das mein Server kein Open-Relay ist. Das sieht ja schon nach einem Bot-Netz aus, welches da sucht.
 
rolapp said:
Weiß jemand von Euch was das zu bedeuten hat, merkt hier jemand nicht das mein Server kein Open-Relay ist. Das sieht ja schon nach einem Bot-Netz aus, welches da sucht.
Click to expand...

Die versuchen es halt einfach. ;)
Abhilfe schafft hier Fail2Ban.
 
Das mit fail2ban ist eine Möglichkeit, da ist mir jetzt aber der Aufriss zu groß.
Außer das die Idioten mir meine log Datei zu müllen passiert ja nichts.
 
rolapp said:
Das mit fail2ban ist eine Möglichkeit, da ist mir jetzt aber der Aufriss zu groß.
Click to expand...

fail2ban ist in 2 Minuten installiert und konfiguriert - und bei mir Standard. Aufriss?
 
Code: 
^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 454 4\.7\.1 .*$

Ich habe das jetzt mal in der /filter.d/postfix.conf ergänzt. mal schauen wann da was gebannt wird bei den vielen unterschiedlichen Ip's.
die jail.conf sieht so aus
Code: 
[postfix]

enabled  = true
port     = smtp,ssmtp,submission
filter   = postfix
logpath  = /var/log/mail.log
bantime  = 604800  
findtime = 86400   
maxretry = 2

Aufriss war das natürlich nicht, der Postfix muß sich jetzt nicht mehr mit den blockierten IP's befassen. (ich hatte heute Vormittag keinen Bock )

Danke für den Tritt in den Ar...
 
You must log in or register to reply here.
Back
Top