iRedMail 技术交流 QQ 群：296792359。

a0800426 · 2016-06-08 15:20:52

a0800426
会员
离线

注册日期: 2015-10-04
文章数: 18

主题: 關於偽造帳號寄信給本網域使用者

==== ==== 必填信息。没有填写将不予回复 ====
- iRedMail 版本号：0.95-1
- 使用哪个数据库存储用户帐号（OpenLDAP，MySQL，PostgreSQL）：MySQL
- 使用的 Linux/BSD 发行版名称及版本号：CentOS 6.7
- 与您的问题相关的日志信息：
====
Dear 張老師詢問關於偽造帳號寄信給本網域使用者
maillog 紀錄

Jun  8 08:49:07 mail postfix/smtpd[28709]: warning: 113.160.183.103: address not listed for hostname static.vdc.vn
Jun  8 08:49:07 mail postfix/smtpd[28709]: connect from unknown[113.160.183.103]
Jun  8 08:49:07 mail postfix/smtpd[28709]: D23F52BC006C: client=unknown[113.160.183.103]
Jun  8 08:49:08 mail postfix/cleanup[28712]: D23F52BC006C: message-id=<>
Jun  8 08:49:09 mail postfix/qmgr[13228]: D23F52BC006C: from=<noreply@domain.com>, size=84021, nrcpt=2 (queue active)
Jun  8 08:49:09 mail postfix/smtpd[28709]: disconnect from unknown[113.160.183.103]
Jun  8 08:49:09 mail amavis[22923]: (22923-12)    Blocked   INFECTED ()   {DiscardedInbound,Quarantined}   , [113.160.183.103]:60964 [113.160.183.103]  ->    , quarantine: TRClBh0A6ikG            , mail_id: TRClBh0A6ikG   , Hits: -   , size: 84021                  , 610 ms
Jun  8 08:49:10 mail amavis[27271]: (27271-03)    Blocked   INFECTED ()   {DiscardedInbound,Quarantined}   , [113.160.183.103]:60964 [113.160.183.103]  ->    , quarantine: j5jHZYqQAuEZ            , mail_id: j5jHZYqQAuEZ   , Hits: -   , size: 84021                  , 742 ms
Jun  8 08:49:10 mail postfix/smtp[28716]: D23F52BC006C: to=<chiu@domain.cm>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.4, delays=1.5/0.03/0/0.9, dsn=2.7.0, status=sent (250 2.7.0 Ok, discarded, id=22923-12 - INFECTED: )
Jun  8 08:49:10 mail postfix/smtp[28717]: D23F52BC006C: to=<mschang@domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.6, delays=1.5/0.06/0/1, dsn=2.7.0, status=sent (250 2.7.0 Ok, discarded, id=27271-03 - INFECTED: )
Jun  8 08:49:10 mail postfix/qmgr[13228]: D23F52BC006C: removed

noreply@domain.com是偽造帳號寄信給chiu@domain.com & mschang@domain.com

postfix 設定檔

alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
allow_min_user = no
allow_percent_hack = no
biff = no
body_checks = pcre:/etc/postfix/body_checks.pcre
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
disable_vrfy_command = yes
enable_original_recipient = no
header_checks = pcre:/etc/postfix/header_checks
home_mailbox = Maildir/
inet_interfaces = all
inet_protocols = all
lmtp_tls_mandatory_protocols = !SSLv2 !SSLv3
lmtp_tls_protocols = !SSLv2 !SSLv3
mail_owner = postfix
mailbox_command = /usr/libexec/dovecot/deliver
mailq_path = /usr/bin/mailq.postfix
message_size_limit = 15728640
mydestination = $myhostname, localhost, localhost.localdomain
mydomain = mail.mingching.com.tw
myhostname = mail.mingching.com.tw
mynetworks = 127.0.0.1
myorigin = mail
newaliases_path = /usr/bin/newaliases.postfix
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions
queue_directory = /var/spool/postfix
recipient_bcc_maps = proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_user.cf    proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_domain.cf
recipient_delimiter = +
relay_domains = $mydestination    proxy:mysql:/etc/postfix/mysql/relay_domains.cf
sender_bcc_maps = proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_user.cf    proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_domain.cf
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_tls_CAfile = $smtpd_tls_CAfile
smtp_tls_loglevel = 0
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_note_starttls_offer = yes
smtp_tls_protocols = !SSLv2 !SSLv3
smtp_tls_security_level = may
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:7777
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks    permit_sasl_authenticated    reject_invalid_helo_hostname    check_helo_access pcre:/etc/postfix/helo_access.pcre
smtpd_recipient_restrictions = reject_unknown_recipient_domain    reject_non_fqdn_recipient    permit_sasl_authenticated    reject_unlisted_recipient    check_policy_service inet:127.0.0.1:7777    permit_mynetworks    reject_unauth_destination
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql/sender_login_maps.cf
smtpd_sender_restrictions = reject_unknown_sender_domain    reject_non_fqdn_sender    reject_unlisted_sender    permit_mynetworks    permit_sasl_authenticated    check_sender_access pcre:/etc/postfix/sender_access.pcre
smtpd_tls_CAfile = /etc/pki/tls/certs/iRedMail.crt
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/pki/tls/certs/iRedMail.crt
smtpd_tls_dh1024_param_file = /etc/pki/tls/dhparams.pem
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
smtpd_tls_key_file = /etc/pki/tls/private/iRedMail.key
smtpd_tls_loglevel = 0
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtpd_tls_protocols = !SSLv2 !SSLv3
smtpd_tls_security_level = may
swap_bangpath = no
tls_random_source = dev:/dev/urandom
transport_maps = proxy:mysql:/etc/postfix/mysql/transport_maps_user.cf    proxy:mysql:/etc/postfix/mysql/transport_maps_domain.cf
unknown_local_recipient_reject_code = 550
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql/virtual_alias_maps.cf    proxy:mysql:/etc/postfix/mysql/domain_alias_maps.cf    proxy:mysql:/etc/postfix/mysql/catchall_maps.cf    proxy:mysql:/etc/postfix/mysql/domain_alias_catchall_maps.cf
virtual_gid_maps = static:2000
virtual_mailbox_base = /var/vmail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf
virtual_minimum_uid = 2000
virtual_transport = dovecot
virtual_uid_maps = static:2000

dovecot 設定檔

# 2.1.17: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-573.18.1.el6.x86_64 x86_64 CentOS release 6.7 (Final)
auth_default_realm = mingching.com.tw
auth_master_user_separator = *
auth_mechanisms = PLAIN LOGIN
dict {
  acl = mysql:/etc/dovecot/dovecot-share-folder.conf
  quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf
}
disable_plaintext_auth = no
first_valid_uid = 2000
last_valid_uid = 2000
listen = * [::]
log_path = /var/log/dovecot.log
mail_gid = 2000
mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/
mail_plugins = quota acl
mail_uid = 2000
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
namespace {
  inbox = yes
  location =
  prefix =
  separator = /
  type = private
}
namespace {
  list = children
  location = maildir:%%Lh/Maildir/:INDEX=%%Lh/Maildir/Shared/%%u
  prefix = Shared/%%u/
  separator = /
  subscriptions = yes
  type = shared
}
passdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
}
passdb {
  args = /etc/dovecot/dovecot-master-users
  driver = passwd-file
  master = yes
}
plugin {
  acl = vfile
  acl_shared_dict = proxy::acl
  auth_socket_path = /var/run/dovecot/auth-master
  autocreate = INBOX
  autocreate2 = Sent
  autocreate3 = Trash
  autocreate4 = Drafts
  autocreate5 = Junk
  autosubscribe = INBOX
  autosubscribe2 = Sent
  autosubscribe4 = Drafts
  autosubscribe5 = Junk
  expire = Trash 7 Trash/* 7 Junk 30
  expire_dict = proxy::expire
  quota = dict:user::proxy::quotadict
  quota_grace = 10%%
  quota_rule = *:storage=1G
  quota_warning = storage=100%% quota-warning 100 %u
  quota_warning2 = storage=95%% quota-warning 95 %u
  quota_warning3 = storage=90%% quota-warning 90 %u
  quota_warning4 = storage=85%% quota-warning 85 %u
  sieve = %Lh/sieve/dovecot.sieve
  sieve_before = /var/vmail/sieve/dovecot.sieve
  sieve_dir = %Lh/sieve
  sieve_global_dir = /var/vmail/sieve
}
protocols = pop3 imap sieve lmtp
service auth {
  unix_listener /var/spool/postfix/private/dovecot-auth {
    group = postfix
    mode = 0666
    user = postfix
  }
  unix_listener auth-master {
    group = vmail
    mode = 0666
    user = vmail
  }
  unix_listener auth-userdb {
    group = vmail
    mode = 0660
    user = vmail
  }
}
service dict {
  unix_listener dict {
    group = vmail
    mode = 0660
    user = vmail
  }
}
service imap-login {
  process_limit = 500
  service_count = 1
}
service lmtp {
  executable = lmtp -L
  inet_listener lmtp {
    address = 127.0.0.1
    port = 24
  }
  process_min_avail = 5
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
  user = vmail
}
service managesieve-login {
  inet_listener sieve {
    address = 127.0.0.1
    port = 4190
  }
}
service pop3-login {
  service_count = 1
}
service quota-warning {
  executable = script /usr/local/bin/dovecot-quota-warning.sh
  unix_listener quota-warning {
    group = vmail
    mode = 0660
    user = vmail
  }
}
ssl_cert = </etc/pki/tls/certs/iRedMail.crt
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
ssl_key = </etc/pki/tls/private/iRedMail.key
ssl_protocols = !SSLv2 !SSLv3
userdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
}
protocol lda {
  auth_socket_path = /var/run/dovecot/auth-master
  lda_mailbox_autocreate = yes
  lda_mailbox_autosubscribe = yes
  log_path = /var/log/dovecot-sieve.log
  mail_plugins = quota acl sieve autocreate
  postmaster_address = root
}
protocol lmtp {
  info_log_path = /var/log/dovecot-lmtp.log
  lmtp_save_to_detail_mailbox = yes
  mail_plugins = quota sieve
  postmaster_address = postmaster
  recipient_delimiter = +
}
protocol imap {
  imap_client_workarounds = tb-extra-mailbox-sep
  mail_max_userip_connections = 30
  mail_plugins = quota acl imap_quota autocreate imap_acl
}
protocol pop3 {
  mail_max_userip_connections = 30
  mail_plugins = quota acl
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
  pop3_uidl_format = %08Xu%08Xv
}

ZhangHuangbin · 2016-06-11 11:27:10

ZhangHuangbin
iRedMail 开发组
离线

注册日期: 2009-12-18
文章数: 2,864

回复: 關於偽造帳號寄信給本網域使用者

iRedMail-0.9.5-1 里启用了 iRedAPD 插件 'reject_sender_login_mismatch' 来解决这个问题。你的服务器是否启用了这个插件？

iRedMail 技术交流 QQ 群：296792359。

關於偽造帳號寄信給本網域使用者

文章数 [ 2 ]

1 a0800426发表 2016-06-08 15:20:52 最后由 a0800426 (2016-06-08 15:27:49) 编辑

主题: 關於偽造帳號寄信給本網域使用者

2 ZhangHuangbin回复 2016-06-11 11:27:10

回复: 關於偽造帳號寄信給本網域使用者

文章数 [ 2 ]