<![CDATA[iRedMail 开源邮件服务解决方案 - 设定无误，但却一直被寄发广告信件！]]> https://bbs.iredmail.org/topic2892-view.html Mon, 12 Jan 2015 11:49:29 +0000 PunBB <![CDATA[回复: 设定无误，但却一直被寄发广告信件！]]> https://bbs.iredmail.org/post13111.html#p13111 怀疑是这样的情况：某个用户的账号密码被破解了，然后 spammer 用这个账号发邮件，正常使用这个账号做 smtp 验证，但邮件的发件人却指定为 <>（null sender）。这个问题在 iRedMail-0.9.0 之前的所有版本都存在。

在最新的 iRedAPD-1.4.4 （在 iRedMail-0.9.0 里带了）里，增加了一个插件叫 reject_null_sender，就是为了解决这个问题。

解决你的这个问题的建议：

1：检查 Postfix 日志文件，看看发送垃圾邮件的是哪个账号，以及它是否正常做 smtp 验证。
2：检查发送的 spam 是否指定了 <> 为发件人（from=<>）。

如果是以上的情况，建议你升级到 iRedAPD-1.4.4 并启用 reject_null_sender 插件试试。

注：null sender 是一个合法的邮件地址，通常是 MTA（Postfix，等）程序用来发送内部通知邮件用的。例如 bounce 等。

]]> Mon, 12 Jan 2015 11:49:29 +0000 https://bbs.iredmail.org/post13111.html#p13111 <![CDATA[回复: 设定无误，但却一直被寄发广告信件！]]> https://bbs.iredmail.org/post13108.html#p13108 我有透过http://www.mailradar.com/openrelay/进行测试，却是没问题的...
我撷取其中一段我的邮件服务器的日志...我服务器的ip我换成xxx.xxx.xxx.xxx显示...
=======================================================================
Jan 12 13:37:18 mail postfix/smtpd[30561]: connect from unknown[193.230.245.6]
Jan 12 13:37:19 mail postfix/smtpd[30561]: NOQUEUE: reject: RCPT from unknown[193.230.245.6]: 454 4.7.1 <relaytest@mailradar.com@[xxx.xxx.xxx.xxx]>: Relay access denied; from=<antispam@[xxx.xxx.xxx.xxx]> to=<relaytest@mailradar.com@[xxx.xxx.xxx.xxx]> proto=SMTP helo=<mailradar.com>
Jan 12 13:37:20 mail postfix/smtpd[30561]: disconnect from unknown[193.230.245.6]
=======================================================================

完整的测是讯息：
[Method 0 @ 1421040962]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@mailradar.com>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com>
<<< 454 4.7.1 <relaytest@mailradar.com>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 1 @ 1421040971]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@mailradar.com>
<<< 250 2.1.0 Ok
>>> RCPT TO: relaytest@mailradar.com
<<< 454 4.7.1 <relaytest@mailradar.com>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 2 @ 1421040976]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com>
<<< 550 5.1.0 <antispam>: Sender address rejected: User unknown in local recipient table
>>> QUIT
<<< 221 2.0.0 Bye
[TEST PASSED]
[Method 3 @ 1421040979]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com>
<<< 454 4.7.1 <relaytest@mailradar.com>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 4 @ 1421040983]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com>
<<< 454 4.7.1 <relaytest@mailradar.com>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 5 @ 1421040986]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest%mailradar.com@[xxx.xxx.xxx.xxx]>
<<< 454 4.7.1 <relaytest%mailradar.com@[xxx.xxx.xxx.xxx]>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 6 @ 1421040990]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest%mailradar.com.com@[xxx.xxx.xxx.xxx]>
<<< 501 5.1.3 Bad recipient address syntax
>>> QUIT
<<< 221 2.0.0 Bye
[TEST PASSED]
[Method 7 @ 1421040994]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <"relaytest@mailradar.com">
<<< 454 4.7.1 <relaytest@mailradar.com>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 8 @ 1421040997]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <"relaytest%mailradar.com">
<<< 454 4.7.1 <relaytest%mailradar.com>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 10 @ 1421041025]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <"relaytest@mailradar.com"@[xxx.xxx.xxx.xxx]>
<<< 454 4.7.1 <relaytest@mailradar.com@[xxx.xxx.xxx.xxx]>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 12 @ 1421041044]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <@[xxx.xxx.xxx.xxx]:relaytest@mailradar.com>
<<< 454 4.7.1 <relaytest@mailradar.com>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 13 @ 1421041048]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <@[xxx.xxx.xxx.xxx]:relaytest@mailradar.com>
<<< 454 4.7.1 <relaytest@mailradar.com>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 14 @ 1421041052]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <mailradar.com!relaytest>
<<< 454 4.7.1 <mailradar.com!relaytest>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 15 @ 1421041056]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <mailradar.com!relaytest@[xxx.xxx.xxx.xxx]>
<<< 454 4.7.1 <mailradar.com!relaytest@[xxx.xxx.xxx.xxx]>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 16 @ 1421041060]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <mailradar.com!relaytest@[xxx.xxx.xxx.xxx]>
<<< 501 5.1.3 Bad recipient address syntax
>>> QUIT
<<< 221 2.0.0 Bye
[TEST PASSED]
[Method 17 @ 1421041063]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest%mailradar.com@>
<<< 454 4.7.1 <relaytest%mailradar.com@>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 18 @ 1421041067]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <antispam@[xxx.xxx.xxx.xxx]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com@>
<<< 454 4.7.1 <relaytest@mailradar.com@>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye
[Method 19 @ 1421041070]
<<< 220 ESMTP iRedMail
>>> HELO mailradar.com
<<< 250 domail.com
>>> MAIL FROM: <postmaster@mailradar.com>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com>
<<< 454 4.7.1 <relaytest@mailradar.com>: Relay access denied
>>> QUIT
<<< 221 2.0.0 Bye

All tested completed! No relays accepted by remote host!

====================================================
实在搞不懂，还是会发生上述的问题..
莫非主机被黑了..

]]> Mon, 12 Jan 2015 05:51:38 +0000 https://bbs.iredmail.org/post13108.html#p13108 <![CDATA[设定无误，但却一直被寄发广告信件！]]> https://bbs.iredmail.org/post13102.html#p13102 ==== 必填信息。没有填写将不予回复 ====
- iRedMail 版本号：
- 使用哪个数据库存储用户帐号（OpenLDAP，MySQL，PostgreSQL）：
- 使用的 Linux/BSD 发行版名称及版本号：
- 与您的问题相关的日志信息：
==== ==== 必填信息。没有填写将不予回复 ====
- iRedMail 版本号：0.7.3
- 使用哪个数据库存储用户帐号（OpenLDAP，MySQL，PostgreSQL）：MySQL
- 使用的 Linux/BSD 发行版名称及版本号：CentOS 6.6
- 与您的问题相关的日志信息：

主要配置：
mynetworks = 127.0.0.0/8
mynetworks_style = subnet

smtpd_sender_restrictions = permit_sasl_authenticated, reject_sender_login_mismatch, reject_authenticated_sender_login_mismatch, reject_unauthenticated_sender_login_mismatch, reject_unknown_sender_domain, permit_mynetworks

smtpd_client_restrictions = permit_sasl_authenticated, check_client_access hash:/etc/postfix/client_whitelist, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit_mynetworks

smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, check_policy_service inet:127.0.0.1:10031, permit_sasl_authenticated, reject_unauth_destination, check_client_access hash:/etc/postfix/client_whitelist, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit_mynetworks

以下这封相似讯息，这几日大量产生.
我实在搞不懂了！怎还会发生底下这种状况的信件呢？
求救于大神.


*** ENVELOPE RECORDS ./00E461662E58 ***
message_size:            3628             589               1               0            3628
message_arrival_time: Fri Jan  9 19:05:24 2015
create_time: Fri Jan  9 19:05:24 2015
named_attribute: log_ident=00E461662E58
named_attribute: rewrite_context=local
sender: bruce@domail.com
named_attribute: encoding=7bit
named_attribute: log_client_name=unknown
named_attribute: log_client_address=127.0.0.1
named_attribute: log_client_port=44947
named_attribute: log_message_origin=unknown[127.0.0.1]
named_attribute: log_helo_name=localhost
named_attribute: log_protocol_name=ESMTP
named_attribute: client_name=unknown
named_attribute: reverse_client_name=unknown
named_attribute: client_address=127.0.0.1
named_attribute: client_port=44947
named_attribute: helo_name=localhost
named_attribute: protocol_name=ESMTP
named_attribute: client_address_type=2
named_attribute: dsn_orig_rcpt=rfc822;cfvbc@email.com
original_recipient:
recipient: cfvbc@email.com
*** MESSAGE CONTENTS ./00E461662E58 ***
Received: from localhost (unknown [127.0.0.1])
    by mail.domail.com (iRedmail) with ESMTP id 00E461662E58
    for <cfvbc@email.com>; Fri,  9 Jan 2015 11:05:24 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=domail.com; h=
    mime-version:content-transfer-encoding:to:date:date:message-id
    :x-mailer:content-type:content-type:from:from:subject:subject;
     s=dkim; t=1420801519; x=1421665520; bh=OZDwFi25dUgKQB436cfE6eJ9
    9LeqXIDW4zx/Dz1PfXo=; b=ONnunk5UJt4MpSDghcQY2LAeVszj+b0IePft8Pjg
    pgby6CS2O4aeQp64/J/NQl38d4Dx4FDckgt0a8GudgC0dczHFNiE6m7xGLWZ9+kY
    UWtjvvKo14Snh74H64VUAmSZF2f2dludSqMz478qADWZPSVvqSdRFzxbrZ6gJJCa
    i4Y=
X-Virus-Scanned: amavisd-new at mail.domail.com
Received: from mail.domail.com ([127.0.0.1])
    by localhost (mail.domail.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id WGjrv65f31xg for <cfvbc@email.com>;
    Fri,  9 Jan 2015 19:05:19 +0800 (CST)
Received: from domail.com (unknown [59.99.56.113])
    by mail.domail.com (iRedmail) with ESMTPA id A82CC1662E46;
    Fri,  9 Jan 2015 11:04:24 +0000 (UTC)
Subject:  from:  Kara Sarcinella
From: kara sarcinella <bruce@domail.com>
Content-Type: multipart/alternative;
    boundary=Apple-Mail-3B568077-D5AC-5101-C8DA-7562CD50DD90
X-Mailer: iPhone Mail (11D257)
Message-Id: <68ffd4c32340$6fe8e395$66579197$@domail.com>
Date: Mon, 9 Dec 2014 12:04:13 +0000
To: "karsarc" <karsarc@gmail.com>, "christine clarkin" <christine_clarkin@hotmail.com>, "Alexandra Vaicaitis" <avaicaitis@chisox.com>, "Allan Santizo" <hckey1976@yahoo.com>, "alyssa evers" <alyssae86@yahoo.com>, "amanda distasio" <guessgirl94@hotmail.com>, "amy hannon" <aclarkin90@yahoo.com>, "ann marie buczek" <ambuczek@hotmail.com>, "ashlie rapp" <ashlierapp@gmail.com>, "audria green" <nfashn2@aol.com>, "aunt kara sarcinella" <kara.sarc@sbcglobal.net>, "barb edwards" <barbara.edwards@advocatehealth.com>, "becky carroll" <irishbecky17@aol.com>, "beth decklemann" <mylittlestang@aol.com>, "bob carroll" <cfd11236@aol.com>, "Brent Paulsen" <brentpaulsen@sbcglobal.net>, "brita gaffney" <gaffs317@aol.com>, "brittney barbee" <brittney.barbee@loop.colum.edu>, "Camille Paulsen" <bcpaulsen@sbcglobal.net>, "chicago s finest" <cfvbc@email.com>
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (1.0)


--Apple-Mail-3B568077-D5AC-5101-C8DA-7562CD50DD90
Content-Type: text/plain;
    charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi!
How are you?
I saw it on TV! http://acalltoheal.com/name/room.php CNN said it really works!


Kara Sarcinella
--Apple-Mail-3B568077-D5AC-5101-C8DA-7562CD50DD90
Content-Type: text/html;
    charset=utf-8
Content-Transfer-Encoding: 7bit

<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">Hi!<br>How are you?&nbsp;</span><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">I saw it on TV!&nbsp;<a href="http://acalltoheal.com/name/room.php" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="0">http://acalltoheal.com/name/room.php</a>&nbsp;CNN said it really works!</span><br></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">Kara Sarcinella</span></div></body></html>
--Apple-Mail-3B568077-D5AC-5101-C8DA-7562CD50DD90--
*** HEADER EXTRACTED ./00E461662E58 ***
named_attribute: encoding=7bit
*** MESSAGE FILE END ./00E461662E58 ***
====

]]> Fri, 09 Jan 2015 15:08:08 +0000 https://bbs.iredmail.org/post13102.html#p13102