（放弃解决）REDHAT 9.0+sendmail8.12.8出现垃圾邮件的问题

abcd99

最近服务器可能是被攻击了，现在同事每天都会收到很多垃圾邮件，大部分都是以公司邮箱后缀名发的，但是实际上这些邮箱的用户名都是不存在的，服务器操作系统用的是linux9.0，邮件系统是用sendmail8.12.8

登录到服务器上，用ps aux可以看到类似下面的很多进程
USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root      2285  0.0  0.3  4016 1984 ?        S    12:36   0:00 sendmail: ./l9BJaRln030725 mail.gotogame.com.cn.: user open

kill掉后，又会自动生成很多类似的

请教高手一下是什么原因，我该如何处理。

谢谢了！！！

感谢WongMokin 老大的提醒。因为这两天事情多，没有及时看到老大的回复，所以反馈的慢了。

因为我也是初学者，看书上是只能修改mc文件，所以我在后面回复中把mc文件的内容贴出来了，不知高手们可否根据这个mc的内容看出点问题来

回复一下7楼大哥：smtp认证没有开启，relay没有取消，原因是开启认证和取消relay后，会出现部分人员收不到邮件的故障，原因同样不明，因为收不到是很随机出现的，但是我用了dracd，要先收才能再发的，应该可以挡住部分垃圾邮件的

不过算了，我找了很久也没找到办法，还是抽时间重新装一下系统吧，干净干脆

偷懒了，让高手们见笑了

[ 本帖最后由 abcd99 于 2007-10-25 11:14 编辑 ]

abcd99

：-（
难道没人看到这个问题吗？

abcd99

继续等待中。。。。。

WongMokin

你的 sendmail.cf  和 maillog 呢？

abcd99

[root@host mail]# grep -v '^dnl' /etc/mail/sendmail.mc
divert(-1)dnl
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl
VERSIONID(`setup for Red Hat Linux')dnl
OSTYPE(`linux')dnl
define(`confDEF_USER_ID',``8:12'')dnl
define(`confTRUSTED_USER', `smmsp')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST',true)dnl
define(`confDONT_PROBE_INTERFACES',true)dnl
define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A')dnl
define(`confTO_IDENT', `0')dnl
FEATURE(`no_default_msa',`dnl')dnl
FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
FEATURE(`access_db',`hash -T<TMPF> -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root')dnl
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
DAEMON_OPTIONS(`Port=smtp,Addr=192.168.0.1, Name=MTA')dnl
FEATURE(`accept_unresolvable_domains')dnl
LOCAL_DOMAIN(`localhost.localdomain')dnl
MAILER(smtp)dnl
MAILER(procmail)dnl

abcd99

我看了一下，
Oct 19 16:12:20 host sendmail[18067]: l9J8AYoo018067: from=<jpsxh@sohu.com>, size=1079456, class=0, nrcpts=1, msgid=<001a01c81229$6ab2c900$91adfea9@pc003>, proto=SMTP, daemon=MTA, relay=ms003.new-core.com [202.191.118.236]
Oct 19 16:12:21 host sendmail[18102]: l9J8AYoo018067: to=<jerry@host.com>, delay=00:01:46, xdelay=00:00:01, mailer=local, pri=1109656, dsn=2.0.0, stat=Sent
类似这两条是正常的，其他的就搞不清楚了

下面是摘录的部门日志
Oct 19 16:11:25 host sendmail[18079]: l9J8BBR5018074: to=root , delay=00:00:08, xdelay=00:00:03, mailer=local, pri=34292, dsn=2.0.0, stat=Sent
Oct 19 16:11:49 host sendmail[18091]: l9J8Bkna018091: from=<crug@multexinvestornetwork.com>, size=1474, class=0, nrcpts=1, msgid=<000801c81229$015601f6$2707c191@seacmddg>, proto=ESMTP, daemon=MTA, relay=[58.141.36.69]
Oct 19 16:11:49 host spamc[18097]: connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#1 of 3): Connection refused
Oct 19 16:11:50 host spamc[18097]: connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#2 of 3): Connection refused
Oct 19 16:11:51 host spamc[18097]: connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#3 of 3): Connection refused
Oct 19 16:11:52 host spamc[18097]: connection attempt to spamd aborted after 3 retries
Oct 19 16:11:52 host sendmail[18094]: l9J8Bkna018091: to=\\alex, delay=00:00:03, xdelay=00:00:03, mailer=local, pri=61651, dsn=2.0.0, stat=Sent
Oct 19 16:11:52 host sendmail[18094]: l9J8Bkna018091: to=alex@126.com, delay=00:00:03, xdelay=00:00:00, mailer=esmtp, pri=61651, relay=mx.126.split.netease.com. [220.181.15.131], dsn=5.0.0, stat=Service unavailable
Oct 19 16:11:53 host sendmail[18094]: l9J8Bkna018091: l9J8Brna018094: DSN: Service unavailable
Oct 19 16:11:54 host sendmail[18094]: l9J8Brna018094: to=<crug@multexinvestornetwork.com>, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, pri=32675, relay=minlist4.multexinvestornetwork.com. [204.255.44.42], dsn=4.0.0, stat=Deferred: Connection refused by minlist4.multexinvestornetwork.com.
Oct 19 16:12:20 host sendmail[18067]: l9J8AYoo018067: from=<jpsxh@sohu.com>, size=1079456, class=0, nrcpts=1, msgid=<001a01c81229$6ab2c900$91adfea9@pc003>, proto=SMTP, daemon=MTA, relay=ms003.new-core.com [202.191.118.236]
Oct 19 16:12:21 host sendmail[18102]: l9J8AYoo018067: to=<jerry@host.com>, delay=00:01:46, xdelay=00:00:01, mailer=local, pri=1109656, dsn=2.0.0, stat=Sent
Oct 19 16:12:34 host sendmail[18068]: l9J8AYoq018068: from=<jpsxh@sohu.com>, size=1079456, class=0, nrcpts=1, msgid=<001a01c81229$6ab2c900$91adfea9@pc003>, proto=SMTP, daemon=MTA, relay=ms003.new-core.com [202.191.118.236]
Oct 19 16:12:34 host sendmail[18105]: l9J8AYoq018068: to=wujw , delay=00:01:59, xdelay=00:00:00, mailer=local, pri=1109657, dsn=2.0.0, stat=Sent
Oct 19 16:12:43 host sendmail[18066]: l9J8AYYx018066: from=<jpsxh@sohu.com>, size=1079456, class=0, nrcpts=1, msgid=<001a01c81229$6ab2c900$91adfea9@pc003>, proto=SMTP, daemon=MTA, relay=ms003.new-core.com [202.191.118.236]
Oct 19 16:12:43 host sendmail[18107]: l9J8AYYx018066: to=sam , delay=00:02:08, xdelay=00:00:00, mailer=local, pri=1109657, dsn=2.0.0, stat=Sent
Oct 19 16:14:45 host sendmail[18119]: l9J8EhHq018119: static-dsl-28.87-197-98.telecom.sk [87.197.98.28] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Oct 19 16:14:45 host sendmail[18120]: l9J8EhJL018120: static-dsl-28.87-197-98.telecom.sk [87.197.98.28] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Oct 19 16:14:50 host sendmail[18121]: l9J8EhZA018121: static-dsl-28.87-197-98.telecom.sk [87.197.98.28] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Oct 19 16:15:00 host sendmail[18123]: l9J8Eshj018123: from=<regina@telia.com>, size=1416, class=0, nrcpts=1, msgid=<000601c8122a$05db78b9$0acb3fa3@lqlxhai>, proto=ESMTP, daemon=MTA, relay=[218.209.18.179]
Oct 19 16:15:00 host spamc[18127]: connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#1 of 3): Connection refused
Oct 19 16:15:01 host spamc[18127]: connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#2 of 3): Connection refused
Oct 19 16:15:02 host spamc[18127]: connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#3 of 3): Connection refused
Oct 19 16:15:03 host spamc[18127]: connection attempt to spamd aborted after 3 retries
Oct 19 16:15:03 host sendmail[18124]: l9J8Eshj018123: to=koudong , delay=00:00:04, xdelay=00:00:03, mailer=local, pri=31599, dsn=2.0.0, stat=Sent

abcd99

发现点新问题

用ps aux看了一下进程，除了以前看到了那些类似的进程
root     32506  0.0  0.3  3984 1624 ?        S    16:31   0:00 sendmail: server [195.140.129.212] cm
root     32522  0.1  0.3  3984 1624 ?        S    16:31   0:00 sendmail: server [195.140.129.212] cm
root     32523  0.0  0.3  3984 1624 ?        S    16:31   0:00 sendmail: server [195.140.129.212] cm

又发现一些新的异常进程
root     32595  0.0  0.3  5016 1572 ?        S    16:31   0:00 sshd: [accepted]
sshd     32596  0.0  0.3  5020 1600 ?        S    16:31   0:00 sshd: [net]


kill的话，永远都说没有哪个进程
[root@host root]# kill -9 32577
-bash: kill: (32595)  - 没有那个进程
[root@host root]# kill -9 32576
-bash: kill: (32596)  - 没有那个进程

但是再次 ps的话，类似进程还是会出现，就是进程号不同了


root     32617 20.0  0.3  5032 1596 ?        S    16:32   0:00 sshd: [accepted]
sshd     32618  5.0  0.3  5024 1648 ?        S    16:32   0:00 sshd: [net]

shi7473

开启smtp认证了没
去掉Relay功能了没