Postfix - interpretacja logów

LordRuthwen - 07-02-2010 20:57
Witam.
Odkąd uruchomiłem postfixa na 587 porcie zaczęły mi się w logach pojawiać dziwne rzeczy, prosiłbym o pomoc w interpretacji logów, jeszcze jak to: Feb 7 19:45:50 host postfix/smtpd[11606]: connect from unknown[58.140.75.79]
Feb 7 19:45:51 host postfix/smtpd[11606]: NOQUEUE: reject: RCPT from unknown[58.140.75.79]: 554 5.7.1 Service unavailable; Client host [58.140.75.79] blocked using dul.dnsbl.sorbs.net; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?58.140.75.79; from=<patnafrkq8@heavenlycreationsboutique.com> to=<emik@sfora.tarnow.pl> proto=ESMTP helo=<UJTLHZWQU>
Feb 7 19:45:51 host postfix/smtpd[11606]: lost connection after DATA (0 bytes) from unknown[58.140.75.79]
Feb 7 19:45:51 host postfix/smtpd[11606]: disconnect from unknown[58.140.75.79]
Feb 7 19:49:11 host postfix/anvil[11608]: statistics: max connection rate 1/60s for (smtp:58.140.75.79) at Feb 7 19:45:50
Feb 7 19:49:11 host postfix/anvil[11608]: statistics: max connection count 1 for (smtp:58.140.75.79) at Feb 7 19:45:50
Feb 7 19:49:11 host postfix/anvil[11608]: statistics: max cache size 1 at Feb 7 19:45:50 Rozumiem, że zostało odrzucone, tak te poniżej mnie delikatnie przestraszyły, bo to wygląda tak, jakby ktoś wysyłał wiadomości z użytkownika www-data, co jest o tle ciekawe, że uwierzytelnienie kont jest poprzez hasło w bazie danych, i użytkownika www-data tam nie ma.
Feb 7 20:02:39 host postfix/cleanup[12034]: 07E7923A3: message-id=<824c6cf4654d34e9cfda6da1f9405d34@www.bosasg.org.pl>
Feb 7 20:02:39 host postfix/qmgr[846]: 07E7923A3: from=<www-data@bosasg.org.pl>, size=1139, nrcpt=1 (queue active)
Feb 7 20:02:39 host postfix/smtp[12041]: 07E7923A3: host gmail-smtp-in.l.google.com[209.85.220.57] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450 4.2.1 visit http://mail.google.com/support/bin/a...py?answer=6592 25si9201356fxm.11 (in reply to RCPT TO command)
Feb 7 20:02:40 host postfix/smtp[12041]: 07E7923A3: to=<kelseylangley47@gmail.com>, relay=alt1.gmail-smtp-in.l.google.com[209.85.135.114]:25, delay=1.1, delays=0.15/0.04/0.83/0.06, dsn=4.2.1, status=deferred (host alt1.gmail-smtp-in.l.google.com[209.85.135.114] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450 4.2.1 visit http://mail.google.com/support/bin/a...py?answer=6592 23si17500632mun.38 (in reply to RCPT TO command))
Feb 7 20:11:02 host postfix/qmgr[846]: 07E7923A3: from=<www-data@bosasg.org.pl>, size=1139, nrcpt=1 (queue active)
Feb 7 20:11:03 host postfix/smtp[12287]: 07E7923A3: host alt1.gmail-smtp-in.l.google.com[209.85.135.27] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450 4.2.1 visit http://mail.google.com/support/bin/a...py?answer=6592 t10si17457951muh.11 (in reply to RCPT TO command)
Feb 7 20:11:04 host postfix/smtp[12287]: 07E7923A3: to=<kelseylangley47@gmail.com>, relay=alt2.gmail-smtp-in.l.google.com[209.85.222.24]:25, delay=505, delays=504/0.09/1.5/0.21, dsn=4.2.1, status=deferred (host alt2.gmail-smtp-in.l.google.com[209.85.222.24] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450 4.2.1 visit http://mail.google.com/support/bin/a...py?answer=6592 32si8583526pzk.96 (in reply to RCPT TO command))
Feb 7 20:21:02 host postfix/qmgr[846]: 07E7923A3: from=<www-data@bosasg.org.pl>, size=1139, nrcpt=1 (queue active)
Feb 7 20:21:03 host postfix/smtp[12529]: 07E7923A3: to=<kelseylangley47@gmail.com>, relay=gmail-smtp-in.l.google.com[209.85.220.33]:25, delay=1104, delays=1103/0.09/0.15/0.78, dsn=2.0.0, status=sent (250 2.0.0 OK 1265570537 21si4581990fxm.27)
Feb 7 20:21:03 host postfix/qmgr[846]: 07E7923A3: removed

pegazior - 08-02-2010 06:33
A skąd to http://www.bosasg.org.pl/ - Brygada Operacyjno Szturmowa ASG?
SpamAssassin zainstalowany?
Sprawdzałeć to http://www.sorbs.net/lookup.shtml?58.140.75.79?

LordRuthwen - 08-02-2010 07:11
Bo na tej maszynie zainstalowane jest kilka for z tematyki ASG, stąd.
Spamassassin instalowany był, greylisting też. Sprawdziłem, ale dalej nie wiem w jaki sposób on to wysyła.

pegazior - 08-02-2010 20:47
Sprawdź konfigrację postfixa - może tu coś znajdziesz?
http://www.lemat.priv.pl/index.php?l...page&pg_id=136

LordRuthwen - 10-02-2010 09:09
No właśnie problem w tym, że jak ustawiłem jak jest w tym howto to mi się nie chciał uruchomić proces:
fatal: /etc/postfix/master.cf: line 13: bad transport type: smtpd_sasl_auth_enable=yes I tak każda linia z -o ...
Problem z tamtymi rozwiązałem poprzez iptables, wiem, że to nie jest rozwiązanie docelowe, dlatego ma ktoś jakieś sugestie co z tym zrobić?

//edit:
już znalazłem - spacje i znaki końca linii, ale dalej mam tego typu logi jak w pierwszym moim poście