Bu SSH loglarından ne anlıyorsunuz?

Merhaba,


tail -f /var/log/maillog ile canlı izleme yaptığımda aşağıdaki gibi loglar geliyor.

Bir sıkıntı mı var? Yoksa birileri bizim site üzerinden mail göndermeye çalışıyor red mi yiyor anlamadım tam. Loglar konusunda bilgili biri açıklayabilirse sevinirim..

Jun 27 08:01:52 mailserver postfix/smtpd[2978]: lost connection after DATA from unknown[102.32.67.81]
Jun 27 08:01:52 mailserver postfix/smtpd[2978]: disconnect from unknown[102.32.67.81] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4
Jun 27 08:01:53 mailserver clamd[1139]: SelfCheck: Database status OK.
Jun 27 08:02:35 mailserver postfix/smtpd[9867]: connect from unknown[140.213.218.156]
Jun 27 08:02:36 mailserver postfix/smtpd[9867]: NOQUEUE: reject: RCPT from unknown[140.213.218.156]: 450 4.7.25 Client host rejected: cannot find your hostname, [140.213.218.156]; from=<satis@sitem.com> to=<satis@sitem.com> proto=ESMTP helo=<[140.213.218.156]>
Jun 27 08:02:37 mailserver postfix/smtpd[9867]: lost connection after DATA from unknown[140.213.218.156]
Jun 27 08:02:37 mailserver postfix/smtpd[9867]: disconnect from unknown[140.213.218.156] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4
Jun 27 08:02:50 mailserver postfix/smtpd[2978]: warning: hostname icne-punitive.themedestiny.com does not resolve to address 141.98.11.84: Name or service not known
Jun 27 08:02:50 mailserver postfix/smtpd[2978]: connect from unknown[141.98.11.84]
Jun 27 08:02:53 mailserver postfix/smtpd[2978]: warning: unknown[141.98.11.84]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 27 08:02:53 mailserver postfix/smtpd[2978]: disconnect from unknown[141.98.11.84] ehlo=1 auth=0/1 quit=1 commands=2/3
Jun 27 08:03:00 mailserver postfix/smtpd[9867]: warning: hostname choice-178.themedestiny.com does not resolve to address 141.98.11.55: Name or service not known
Jun 27 08:03:00 mailserver postfix/smtpd[9867]: connect from unknown[141.98.11.55]
Jun 27 08:03:03 mailserver postfix/smtpd[9867]: warning: unknown[141.98.11.55]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 27 08:03:03 mailserver postfix/smtpd[9867]: disconnect from unknown[141.98.11.55] ehlo=1 auth=0/1 quit=1 commands=2/3
Jun 27 08:03:14 mailserver postfix/smtpd[2978]: connect from unknown[182.188.160.251]
Jun 27 08:03:14 mailserver postfix/smtpd[2978]: NOQUEUE: reject: RCPT from unknown[182.188.160.251]: 450 4.7.25 Client host rejected: cannot find your hostname, [182.188.160.251]; from=<hukuk@sitem.com> to=<hukuk@sitem.com> proto=ESMTP helo=<[182.188.160.251]>
Jun 27 08:03:15 mailserver postfix/smtpd[2978]: lost connection after DATA from unknown[182.188.160.251]
Jun 27 08:03:15 mailserver postfix/smtpd[2978]: disconnect from unknown[182.188.160.251] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4
Jun 27 08:03:15 mailserver postfix/smtpd[9867]: connect from unknown[196.188.73.2]
Jun 27 08:03:16 mailserver postfix/smtpd[9867]: NOQUEUE: reject: RCPT from unknown[196.188.73.2]: 450 4.7.25 Client host rejected: cannot find your hostname, [196.188.73.2]; from=<yaziisl@sitem.com> to=<yaziisl@sitem.com> proto=ESMTP helo=<[196.188.73.2]>
Jun 27 08:03:17 mailserver postfix/smtpd[9867]: lost connection after DATA from unknown[196.188.73.2]
Jun 27 08:03:17 mailserver postfix/smtpd[9867]: disconnect from unknown[196.188.73.2] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4
Jun 27 08:03:39 mailserver postfix/smtpd[2978]: connect from unknown[39.46.242.10]
Jun 27 08:03:39 mailserver postfix/smtpd[2978]: NOQUEUE: reject: RCPT from unknown[39.46.242.10]: 450 4.7.25 Client host rejected: cannot find your hostname, [39.46.242.10]; from=<lq@sitem.com> to=<lq@sitem.com> proto=ESMTP helo=<[39.46.242.10]>
Jun 27 08:03:40 mailserver postfix/smtpd[2978]: lost connection after DATA from unknown[39.46.242.10]
Jun 27 08:03:40 mailserver postfix/smtpd[2978]: disconnect from unknown[39.46.242.10] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4
Jun 27 08:03:45 mailserver postfix/smtpd[9867]: warning: hostname surfacebetter.com does not resolve to address 185.36.81.58
Jun 27 08:03:45 mailserver postfix/smtpd[9867]: connect from unknown[185.36.81.58]
Jun 27 08:03:48 mailserver postfix/smtpd[9867]: warning: unknown[185.36.81.58]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 27 08:03:48 mailserver postfix/smtpd[9867]: disconnect from unknown[185.36.81.58] ehlo=1 auth=0/1 quit=1 commands=2/3
Jun 27 08:03:49 mailserver postfix/smtpd[2978]: connect from unknown[181.64.202.88]
Jun 27 08:03:50 mailserver postfix/smtpd[2978]: NOQUEUE: reject: RCPT from unknown[181.64.202.88]: 450 4.7.25 Client host rejected: cannot find your hostname, [181.64.202.88]; from=<cee72a58@sitem.com> to=<cee72a58@sitem.com> proto=ESMTP helo=<[200.4.244.19]>
Jun 27 08:03:51 mailserver postfix/smtpd[2978]: lost connection after DATA from unknown[181.64.202.88]
Jun 27 08:03:51 mailserver postfix/smtpd[2978]: disconnect from unknown[181.64.202.88] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4
Jun 27 08:04:35 mailserver postfix/smtpd[9867]: warning: hostname c9116d93.virtua.com.br does not resolve to address 201.17.109.147: Name or service not known
Jun 27 08:04:35 mailserver postfix/smtpd[9867]: connect from unknown[201.17.109.147]
Jun 27 08:04:36 mailserver postfix/smtpd[9867]: NOQUEUE: reject: RCPT from unknown[201.17.109.147]: 450 4.7.25 Client host rejected: cannot find your hostname, [201.17.109.147]; from=<info@sitem.com> to=<info@sitem.com> proto=ESMTP helo=<c9116d93.virtua.com.br>
Jun 27 08:04:37 mailserver postfix/smtpd[9867]: lost connection after DATA from unknown[201.17.109.147]
Jun 27 08:04:37 mailserver postfix/smtpd[9867]: disconnect from unknown[201.17.109.147] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4
Jun 27 08:04:41 mailserver postfix/smtpd[2978]: connect from unknown[103.163.49.211]
Jun 27 08:04:42 mailserver postfix/smtpd[2978]: NOQUEUE: reject: RCPT from unknown[103.163.49.211]: 450 4.7.25 Client host rejected: cannot find your hostname, [103.163.49.211]; from=<zoologistbicentennials@sitem.com> to=<zoologistbicentennials@sitem.com> proto=ESMTP helo=<[103.163.49.211]>

Öncelikle 0.0.0.0 - 255.255.255.255 tüm dünyayı 25 portunu yada 587 scanladı açık olanları listeledi sonrasında listesindeki mail sunucularına bir bağlanmayı denedi olurda authentication kapalı ise belki mail çıkarım. Benim anladığım bu hocam

sitem.com var olmayan bir mail adresine sisteminiz sürekli mail göndermeyi deniyor

hepsi aynı domain altından itmeye çalışıyor sunucular haberleşemiyor hosting hesabınız da sitem.com diye bir site varsa mail yönlendirme ayarını remote seçiniz.

ama oradaki sunucu IP'leri bizim sunucu değilki hocam?

Fake mail deniyor olabilirler mi? Oda kendi sunucularından ama IP'ler vs uyuşmadığı için reject oluyor gibi?

temanızın demosunda site.com veya sunucunuzda site.com diye bir hesap var ona sürekli mail göndermeye çalışıyor söz konusu siteyi silin veya veritabanından kaldırıdın düzelecektir.

site wordpress ise demo sayfalarından kaynaklanır tema ayarlarınızı kontrol edin sitem.com diye aratın.

postfix loglarında geliyor hocam bu

Merhaba,

İlgili log çıktınızdakine benzer connection / brute login denemeleri her zaman olacaktır. DKIM check, SPF check, Hostname check aktif ise FQDN unknown olan, ESMTP failed dönen denemeler reject olur. Scriptiniz veya postfix sürümünüz kaynaklı kendi kendine bu tarz çıkışları önlemek için en başta script güvenliğini sağlamalı, malware den arındırmalı, mail fonksiyonunu kapatmalı, sendmail kısıtlamalısınız. Ayrıca relay bir sunucu da fena olmaz.

İyi çalışmalar.