Postfix가 해킹되었습니다. 도와주세요. [닫기]

postfix와 dovecot을 설치하고 SPF DKIM과 DMARC를 설정했는데, Linode 계정의 사용량이 높다고 보고되고 계정에서 스팸이 ​​많이 발견될 때까지 모든 것이 원활하게 실행되었습니다. 접미사를 닫았습니다.

지침:

1. 메시지는 내 도메인에서 전송되지만 noidadeafsociety사용자는 내가 만든 것이 아니며 스패머가 만든 가상의 사용자입니다.

   sender_fullname: www-data
   sender: [email protected]
   

   위 사용자는 내 mysql 가상 사용자 데이터베이스에 존재하지 않습니다.

2. PHP 스크립트를 가리키는 헤더의 다음 줄을 참고하세요.

   X-PHP-Originating-Script: 33:isyfoyvr.php(1189) : runtime-created function(1) : eval()'d code(1) : eval()'d code
   

3. 포트 25를 통해 서버에서 원격으로 또는 로컬로 내 IP에 텔넷 연결할 수 없습니다.

postfix main.cf아래는 내 파일의 관련 부분입니다

smtp_tls_security_level = may
smtpd_tls_security_level = may

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = brahmaforces.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
#mydestination = $myhostname, brahmaforces.com, brahmaforces, localhost.localdomain, localhost, noidadeafsociety.org
mydestination = localhost

relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
message_size_limit = 31457280
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
#virtual_alias_maps = hash:/etc/postfix/virtual

#Append the following line for local mail delivery to all virtual domains listed inside the MySQL table.

virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf

policyd-spf_time_limit = 3600

다음은 대기열의 메시지 헤더입니다.

$ sudo postcat -q A1E705E545
*** ENVELOPE RECORDS deferred/A/A1E705E545 ***
message_size:            2198             223               1               0            2198               0
message_arrival_time: Tue Oct 24 06:47:29 2017
create_time: Tue Oct 24 13:39:04 2017
named_attribute: rewrite_context=local
sender_fullname: www-data
sender: [email protected]
*** MESSAGE CONTENTS deferred/A/A1E705E545 ***
Received: by brahmaforces.com (Postfix, from userid 33)
    id A1E705E545; Tue, 24 Oct 2017 06:47:29 +0530 (IST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=noidadeafsociety.org;
    s=201710; t=1508832544;
    bh=6CNiZnlc0CH/LHm0VunVcXnxzPy9g3UAgtmu7mN62Yw=;
    h=To:Subject:Date:From:From;
    b=IO42NgZb1I7qjGaAQJL/Y0Dc4Q6Mv9WOCTPjGcCpFOtw/hPB4cf+PJXoAYmUCoyFG
     DSgVv1SqBx/W35pLLIedqciQhEnTlxbJCxKox2d7mIlZz6Vg5ywYlMbgJ/fBsZB+hD
     kJThn9Hex9a9OEL1ERZW5v8bxFpg3QY+A9jeizmX7FhQ1nLYwv5iLDP4FT+Qn6Zu3i
     9aRWSraMF+YplLwpUqzLWecZqB+9tUZHNZpC6eMg+UHFwrSSXbdDMtcmRFDDmmKnmG
     H5pHBqz86blZ6Ohf/ndca3KUqN+mo249lbo/5rq5pYyOESDwxiYNQy8MvZa8WYqIA6
     tsh23D6Ei1eWw==
To: [email protected]
Subject: You're sleeping, and this program earns money!
X-PHP-Originating-Script: 33:isyfoyvr.php(1189) : runtime-created function(1) : eval()'d code(1) : eval()'d code
Date: Tue, 24 Oct 2017 06:47:29 +0530
From: "Justin F." <[email protected]>
Message-ID: <[email protected]>
X-Mailer: PHPMailer 5.2.23 (https://github.com/PHPMailer/PHPMailer)
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="b1_79a51f9aa51cafb7505a4c92abc93109"
Content-Transfer-Encoding: 8bit

This is a multi-part message in MIME format.

--b1_79a51f9aa51cafb7505a4c92abc93109
Content-Type: text/plain; charset=us-ascii

There's nothing wrong to dream about the money that would appear out of nowhere. No one would refuse such happiness. But a dream like this, anybody especially was not true... until recently.

A group of German scientists are able to invent a program that makes money and allows you to forget about work and enjoy life.

It can bring you riches in a few weeks! { http://www.sriplasticenterprises.com/reduce.php?utm_source=67ksjr2535&utm_medium=ygapipe66p&utm_campaign=9h2vb6lp17&utm_term=5t9tgb2h6h&utm_content=s4mdh3336q } Come on click on the link and learn more...


--b1_79a51f9aa51cafb7505a4c92abc93109
Content-Type: text/html; charset=us-ascii

<html>
<body>
There's nothing wrong to dream about the money that would appear out of nowhere. No one would refuse such happiness. But a dream like this, anybody especially was not true... until recently.<br>
<br>
A group of German scientists are able to invent a program that makes money and allows you to forget about work and enjoy life.<br>
<br>
It can bring you riches in a few weeks! <a href="http://www.sriplasticenterprises.com/reduce.php?utm_source=67ksjr2535&utm_medium=ygapipe66p&utm_campaign=9h2vb6lp17&utm_term=5t9tgb2h6h&utm_content=s4mdh3336q">Come on click on the link and learn more...</a><br>
</body>
</html>