<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">hallo,<div><br></div><div>wir haben auf einem unserer Mailserver seit heute ("Immer wieder Sonntags", ein Schelm, wer Böses und/oder Spammer" dabei denkt ... ?!) massenweise Anfragen auf unbekannte Adressen. Dummerweise lassen die die verify_cache.db vollaufe, und das innerhalb kürzester Zeit.</div><div><br></div><div><div><div>Die Maillogs (und entsprechend /var/) sind vollgelaufen mit Meldungen solcher Art:</div><div><br></div><div>Sep 12 18:43:25 webmail postfix/verify[19531]: warning: database /var/lib/postfix/verify_cache.db: could not delete entry for <a href="mailto:valija.erohina@unser-server.de">valija.erohina@unser-server.de</a></div><div>Sep 12 18:43:25 webmail postfix/verify[19531]: warning: database /var/lib/postfix/verify_cache.db: could not delete entry for <a href="mailto:valija.gavrilova@unser-server.de">valija.gavrilova@unser-server.de</a></div><div><br></div><div>... und zwar mit einer ganzen Menge:</div><div><br></div><div>root@webmail.unser-server.de:/var/log# grep "verify_cache" messages | wc -l</div><div>15560520</div><div><br></div><div>Im syslog steht:</div><div><br></div><div>Sep 12 08:43:42 webmail postfix/verify[13659]: fatal: error reading /var/lib/postfix/verify_cache.db: Unknown error 4294936309</div><div>Sep 12 08:43:43 webmail postfix/smtpd[10826]: warning: problem talking to service verify: Success</div><div>Sep 12 08:43:43 webmail postfix/local[13048]: warning: problem talking to service verify: Connection reset by peer</div><div>Sep 12 08:43:43 webmail postfix/master[1781]: warning: process /usr/lib/postfix/verify pid 13659 exit status 1</div><div><br></div><div>Das syslog ist ebenso voll wie mail.log und messages! Logs verschoben, Neustart durchgeführt. Knapp eine Minute (!) nach dem Neustart sieht es bereits wieder so aus:</div><div><br></div><div>root@webmail.unser-server.de:/# grep verify_cache /var/log/mail.log | wc -l</div><div>71754</div></div></div><div><br></div><div>Wietse empfiehlt zwar im Adress-verify-Howto (<a href="http://www.postfix.org/ADDRESS_VERIFICATION_README.html">http://www.postfix.org/ADDRESS_VERIFICATION_README.html</a>): "Do not put this file in a file system that may run out
of space", aber ein solches ist mir in den letzten Jahren noch nicht begegnet ... ;-)</div><div><br></div><div>Scherz beiseite - der hauptgrund scheint mir darin zu liegen, dass dieser Server mit Mailanfragen bombardiert wird - sehe ich das richtig? Es sind ständig haufenweise Ports 25 offen nach diesem Muster:</div><div><br></div><div>smtpd 2389 postfix 16u IPv4 7274 TCP 192.168.1.1:smtp->mail.investcapitalbank.ru:47235 (ESTABLISHED)</div><div>smtpd 2393 postfix 16u IPv4 7352 TCP 192.168.1.1:smtp->super.muctr.net:64897 (ESTABLISHED)</div><div>smtpd 2394 postfix 16u IPv4 7370 TCP 192.168.1.1:smtp->foodgrad.ru:51131 (ESTABLISHED)</div><div>smtpd 2395 postfix 16u IPv4 8264 TCP 192.168.1.1:smtp->proxy.lenreg.ru:51208 (ESTABLISHED)</div><div>smtpd 2396 postfix 16u IPv4 7398 TCP 192.168.1.1:smtp->postman.rtfx.com:57694 (ESTABLISHED)</div><div>smtpd 2397 postfix 16u IPv4 7418 TCP 192.168.1.1:smtp->postman.rtfx.com:57683 (ESTABLISHED)</div><div>smtpd 2399 postfix 16u IPv4 8394 TCP 192.168.1.1:smtp->ns1.hot-factory.jp:57830 (ESTABLISHED)</div><div>smtpd 2403 postfix 16u IPv4 8416 TCP 192.168.1.1:smtp->sdsu.edu:49726 (ESTABLISHED)</div><div>smtpd 2405 postfix 9u IPv4 8459 TCP 192.168.1.1:smtp->193.138.158.66.ip-space-by.digitalus.nl:48360 (ESTABLISHED)</div><div>smtpd 2409 postfix 16u IPv4 7725 TCP 192.168.1.1:smtp->bilalov.com:55637 (ESTABLISHED)</div><div>smtpd 2410 postfix 16u IPv4 8446 TCP 192.168.1.1:smtp->antispam-5.montevideo.com.uy:48811 (ESTABLISHED)</div><div>smtpd 2413 postfix 16u IPv4 7842 TCP 192.168.1.1:smtp->mout3.asco.de:39854 (ESTABLISHED)</div><div><br></div><div><div>Ein Relaytest von aussen schlägt aber fehl, wenn ich es richtig sehe:</div><div><br></div><div>Sep 12 20:23:58 webmail postfix/smtpd[3307]: connect from dyndsl-095-033-107-206.ewe-ip-backbone.de[95.33.107.206]</div><div>Sep 12 20:24:20 webmail postfix/smtpd[3307]: NOQUEUE: reject: RCPT from dyndsl-095-033-107-206.ewe-ip-backbone.de[95.33.107.206]: 554 5.7.1 <<a href="mailto:lars@dyn-ip-von-aussen.de">lars@dyn-ip-von-aussen.de</a>>: Relay access denied; from=<<a href="mailto:spammer@spam.jp">spammer@spam.jp</a>> to=<<a href="mailto:lars@dyn-ip-von-aussen.de">lars@dyn-ip-von-aussen.de</a>> proto=ESMTP helo=<<a href="http://ich.ru">ich.ru</a>></div></div><div><br></div><div>Was passiert da? Bzw. wie stellen wir das ab? Abwarten? Im Moment haben wir erstmal für den betroffenen Server Port 25 an der externen iptables-Firewall geblockt, die master.lock gelöscht, die verify_cache.db gelöscht, System-Updates durchgeführt, schliesslich noch einmal einen Neustart. Die Firewall wieder aufgemacht, 30 sekunden später waren erneut über 70000 "warning: database /var/lib/postfix/verify_cache" im Log. </div><div><br></div><div><div>Das System: Debian 5.0.3</div><div><br></div><div>mail_version = 2.7.1</div><div><br></div><div>uname -mrs:</div><div><br></div><div>Linux 2.6.29-xs5.5.0.17 i686</div><div><br></div><div>Die Postfix-Konfig:</div><div><br></div><div># postconf -n</div><div><br></div><div>(...)</div><div>inet_interfaces = all</div><div>mailbox_size_limit = 0</div><div>mydestination = <a href="http://unser-server.de">unser-server.de</a>, <a href="http://mail.unser-server.de">mail.unser-server.de</a>, <a href="http://localhost.unser-server.de">localhost.unser-server.de</a>, localhost</div><div>myhostname = <a href="http://mail.unser-server.de">mail.unser-server.de</a></div><div>mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128</div><div>(...)</div><div>recipient_delimiter = +</div><div>relayhost = </div><div>(...)</div><div>smtpd_banner = $myhostname ESMTP $mail_name</div><div>smtpd_recipient_restrictions = </div><div>reject_non_fqdn_sender,</div><div>reject_non_fqdn_recipient,<span class="Apple-tab-span" style="white-space:pre"> </span></div><div>reject_unknown_sender_domain,<span class="Apple-tab-span" style="white-space:pre"> </span></div><div>reject_unknown_recipient_domain,<span class="Apple-tab-span" style="white-space:pre"> </span></div><div>permit_mynetworks,<span class="Apple-tab-span" style="white-space:pre"> </span></div><div>permit_sasl_authenticated,<span class="Apple-tab-span" style="white-space:pre"> </span></div><div>reject_unverified_recipient,<span class="Apple-tab-span" style="white-space:pre"> </span></div><div>reject_unauth_destination, </div><div>check_policy_service inet:127.0.0.1:12525 </div><div>check_policy_service inet:127.0.0.1:60000<span class="Apple-tab-span" style="white-space:pre"> </span></div><div>permit</div><div>(...)</div><div><br></div><div>Danke im Voraus für Hinweise und Tipps!</div></div><div><br></div><div><br></div><div>Beste Grüße</div><div><br></div><div><br></div><div>lars aus bremen</div><div><br></div><div><br></div><div><br></div><div><div><div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 53px; text-indent: -53px; color: rgb(9, 9, 9); font-size: 12px; "><font style="font: normal normal normal 12px/normal Verdana; "><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; ">“Mit dem Wissen wächst der Zweifel”</span></font></font></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 53px; text-indent: -53px; color: rgb(9, 9, 9); font-size: 12px; "><font style="font: normal normal normal 12px/normal Verdana; "><font class="Apple-style-span" color="#000000"><span class="Apple-style-span" style="color: rgb(9, 9, 9); "><span class="Apple-style-span" style="color: rgb(0, 0, 0); "><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; ">(J.W.v.Goethe)</span></font></span></span></font></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 53px; text-indent: -53px; color: rgb(9, 9, 9); font-size: 12px; "><font style="font: normal normal normal 12px/normal Verdana; "><font class="Apple-style-span" color="#000000"><span class="Apple-style-span" style="color: rgb(9, 9, 9); "><span class="Apple-style-span" style="color: rgb(0, 0, 0); "><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; "></span></font><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; "><a href="http://www.nachdenkseiten.de">http://ww.NachDenkSeiten.de</a></span></font></span></span></font></font></div></div><div><font style="font: normal normal normal 12px/normal Verdana; "><font class="Apple-style-span" color="#000000"><span class="Apple-style-span" style="color: rgb(9, 9, 9); "><span class="Apple-style-span" style="color: rgb(0, 0, 0); "><font class="Apple-style-span" size="3"><br></font></span></span></font></font></div><br class="Apple-interchange-newline">
</div>
<br></div></body></html>