Nie jesteś zalogowany.
Jeśli nie posiadasz konta, zarejestruj je już teraz! Pozwoli Ci ono w pełni korzystać z naszego serwisu. Spamerom dziękujemy!
Prosimy o pomoc dla małej Julki — przekaż 1% podatku na Fundacji Dzieciom zdazyć z Pomocą.
Więcej informacji na dug.net.pl/pomagamy/.
Ciągle otrzymuję maile typu:
Undelivered Mail Returned to Sender This is the mail system at host mail.autisticstory.net. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <root@localhost.autisticstory.net> (expanded from <root@localhost>): mail for localhost.autisticstory.net loops back to myself Reporting-MTA: dns; mail.autisticstory.net X-Postfix-Queue-ID: 788B0454E1 X-Postfix-Sender: rfc822; root@autisticstory.net Arrival-Date: Sat, 6 Jan 2018 10:45:35 +0100 (CET) Final-Recipient: rfc822; root@localhost.autisticstory.net Original-Recipient: rfc822;root@localhost.autisticstory.net Action: failed Status: 5.4.6 Diagnostic-Code: X-Postfix; mail for localhost.autisticstory.net loops back to myself [psad-alert] DL3 src: yesyes.skidfi.com dst: cloud-vps.eml Subject: [psad-alert] DL3 src: yesyes.skidfi.com dst: cloud-vps From: root@autisticstory.net (root) Date: 06/01/18 10:45 To: root@localhost.autisticstory.net =-=-=-=-=-=-=-=-=-=-=-= Sat Jan 6 10:45:35 2018 =-=-=-=-=-=-=-=-=-=-=-= Danger level: [3] (out of 5) Scanned TCP ports: [3334: 1 packets] TCP flags: [CWR ECE SYN: 1 packets] iptables chain: INPUT, 1 packets Source: 185.92.73.31 DNS: yesyes.skidfi.com Destination: 81.2.239.90 DNS: cloud-vps Overall scan start: Wed Jan 3 13:01:59 2018 Total email alerts: 415 Complete TCP range: [666-63389] Syslog hostname: cloud-vps Global stats: chain: interface: protocol: packets: INPUT eth0 tcp 489 [+] Whois Information (source IP): % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '185.92.73.0 - 185.92.73.63' % Abuse contact for '185.92.73.0 - 185.92.73.63' is 'abuse@foxcloud.net' inetnum: 185.92.73.0 - 185.92.73.63 netname: FOXCLOUD-DC2 descr: Foxcloud.net Services Subnet country: NL admin-c: AB31967-RIPE tech-c: AB31967-RIPE status: ASSIGNED PA mnt-by: FOXCLOUD-MNT mnt-lower: FOXCLOUD-MNT mnt-routes: FOXCLOUD-MNT created: 2015-07-17T19:45:35Z last-modified: 2015-07-17T19:45:35Z source: RIPE person: Alexander Basunov address: Office 11, 43 Bedford street, London, GB phone: +44 (845) 1541419 nic-hdl: AB31967-RIPE mnt-by: FOXCLOUD-MNT created: 2015-03-14T08:24:57Z last-modified: 2015-03-14T08:24:57Z source: RIPE # Filtered % Information related to '185.92.73.0/24AS200904' route: 185.92.73.0/24 descr: Foxcloud.net route origin: AS200904 mnt-by: FOXCLOUD-MNT created: 2015-03-26T12:40:22Z last-modified: 2015-03-26T12:40:22Z source: RIPE % This query was served by the RIPE Database Query Service version 1.90 (ANGUS) =-=-=-=-=-=-=-=-=-=-=-= Sat Jan 6 10:45:35 2018 =-=-=-=-=-=-=-=-=-=-=-=
pomimo że psad jest odinstalowany. Nie ma działającego demona psad. Co zrobić, aby przestać otrzymywać te maile?
Offline
Nie, w życiu nie brałbym takiej xD
Offline
[quote=urbinek]To nie zrobisz absolutnie nic aby takie maile przestały przychodzić.[/quote]
https://ubuntuforums.org/showthread.php?t=1702330
Offline
[quote=hubot][quote=urbinek]To nie zrobisz absolutnie nic aby takie maile przestały przychodzić.[/quote]
https://ubuntuforums.org/showthread.php?t=1702330[/quote]
Z załączonego kawałka maila nie wynika nawet, co go wysłało, i czy to coś pracuje na Twoim serwerze czy na jakimś innym.
PSAD nie zastąpi konfiguracji systemu, jeśli np puściłeś obecnie albo kiedyś Postfixa jako OPEN-RELAY, to niejeden taki cyrk zobaczysz.
Pozdro
Offline
[quote=hubot][quote=urbinek]To nie zrobisz absolutnie nic aby takie maile przestały przychodzić.[/quote]
https://ubuntuforums.org/showthread.php?t=1702330[/quote]
Jak się to ma do twojego maila?
Zastosowałeś rozwiązanie? Pomogło?
Tak jak ja to widzę *coś* wysłało ci maila a właściwie zwrotkę o nie dostarczonej wiadomości, której tak na dobrą sprawę mogłeś nie wysyłać - witamy w świecie SMTP spoofingu ;)
Nawet jak wyłączysz lokalny serwer poczty to bramki w necie będą ci wysyłać pakiety.
Offline
Time (s) | Query |
---|---|
0.00008 | SET CHARSET latin2 |
0.00006 | SET NAMES latin2 |
0.00111 | SELECT u.*, g.*, o.logged FROM punbb_users AS u INNER JOIN punbb_groups AS g ON u.group_id=g.g_id LEFT JOIN punbb_online AS o ON o.ident='18.119.163.95' WHERE u.id=1 |
0.00069 | REPLACE INTO punbb_online (user_id, ident, logged) VALUES(1, '18.119.163.95', 1733303184) |
0.00044 | SELECT * FROM punbb_online WHERE logged<1733302884 |
0.00050 | SELECT t.subject, t.closed, t.num_replies, t.sticky, f.id AS forum_id, f.forum_name, f.moderators, fp.post_replies, 0 FROM punbb_topics AS t INNER JOIN punbb_forums AS f ON f.id=t.forum_id LEFT JOIN punbb_forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id=3) WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id=30174 AND t.moved_to IS NULL |
0.00006 | SELECT search_for, replace_with FROM punbb_censoring |
0.00078 | SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM punbb_posts AS p INNER JOIN punbb_users AS u ON u.id=p.poster_id INNER JOIN punbb_groups AS g ON g.g_id=u.group_id LEFT JOIN punbb_online AS o ON (o.user_id=u.id AND o.user_id!=1 AND o.idle=0) WHERE p.topic_id=30174 ORDER BY p.id LIMIT 0,25 |
0.00088 | UPDATE punbb_topics SET num_views=num_views+1 WHERE id=30174 |
Total query time: 0.0046 s |