請問關於LINUX寄信問題!!急...

Question

公司的mail server主機是linux的系統....用的應該是linux的sendmail...

而公司接獲中華電信通知我方被當成廣告信跳板,我查過client端..每台都沒有中毒..也沒有spy程式...而mail server確不斷再發送廣告信...

我方的mail server是架構在防火牆之後...有受防火牆保護.....

以下是他的紀錄訊息:Feb 24 10:44:52 netrunnet sendmail[28135]: k1M0iiK06560: to=[e-mail], delay=2+02:00:08, xdelay=00:00:02, mailer=esmtp, pri=2375084, relay=mail.corrcomm.net. [208.61.210.7], dsn=4.0.0, stat=Deferred: Connection reset by mail.corrcomm.net.

Feb 24 10:44:54 netrunnet sendmail[14255]: k1M8VD129776: to=[e-mail], delay=1+18:13:41, xdelay=00:01:00, mailer=esmtp, pri=2555081, relay=ccnmail.com. [66.116.109.62], dsn=4.0.0, stat=Deferred: Connection timed out with ccnmail.com.

Feb 24 10:44:54 netrunnet sendmail[1538]: k1O2ioW01536: to=<[e-mail]>, delay=00:00:03, xdelay=00:00:00, mailer=local, pri=44902, dsn=2.0.0, stat=Sent

Feb 24 10:44:55 netrunnet sendmail[1540]: k1O2isW01540: <[e-mail]>... User unknown

它不斷的說發件者是mailer=esmtp但公司帳號內並沒有esmtp這個人(帳號)

而他發送的mail也是都沒見過的....

Feb 24 10:44:55 netrunnet sendmail[3096]: k1M5DoJ20759: to=[e-mail], delay=1+21:31:05, xdelay=00:01:00, mailer=esmtp, pri=2105083, relay=mail.palacios.k12.tx.us. [65.68.242.232], dsn=4.0.0, stat=Deferred: Connection timed out with mail.palacios.k12.tx.us

請問誰能告訴我它的意思和解決之道........20點相贈!!

Update:

因為我們的server也有開web server,被植入木馬程式做成假銀行網站在網路釣魚...關掉web暫時解決了問題...

Answer 1

Favorite Answer

不知道你的Mail Server是不是有做Anti Relay？

TANET網址http://140.111.1.22/tanet/spam.html

最下方輸入你Mail Server主機IP測試看看！

Answer 2

被駭客入侵後，駭客在系統中建立新帳號，以此帳號發信。先看砍掉此帳號，更改系統管理者密碼，更新linux系統。