电子邮件过载ISPConfig 3服务器...被黑了？

Question

从昨天晚些时候开始，发送给特定用户的电子邮件队列已经上升到超过45000封。对于用户没有发送的消息，这些电子邮件都是无法投递的-至少是故意的。

以下是mail.log文件的一个片段。许多发件人地址是不存在的用户，域是正确的，但不是用户。

你知道这是怎么回事吗?我怎么才能阻止它？

附注：我用"mydomain.co.uk“替换了我的真实域名。此域中唯一的实时用户是名为"mike“的用户。

Jun 22 19:28:05消息后缀/smtpd5305: 6843DFB270: client=81.61.129.17.dyn.user.ono.com81.61.129.17，server1，sasl_username=mike@mydomain.co.uk Jun 22 19:28:05 server1后缀/清理5499: 3B2B5FB269: sasl_method=LOGIN-id= Jun 22 19:28:05 server1后缀/qmgr4391: 3B2B5FB269: from=，size=715，nrcpt=1 (活动队列) Jun 22 19:28:05 server1后缀/smtpd5159: ABF72FB271: client=unknown37.218.171.206，sasl_method=LOGIN，sasl_username=mike@mydomain.co.uk Jun 22 19:28:05 server1后缀/清理5594: B1DECFB26C: message-id= Jun 22 19:28:05 server1后缀/qmgr4391: B1DECFB26C: from=，size=680，nrcpt=1 (队列活动) Jun 22 19:28:05 server1后缀/smtpd5474: ED465FB272: client=unknown181.112.50.130，sasl_method=LOGIN，sasl_username=mike@mydomain.co.uk Jun 22 19:28:06 server1后缀/smtpd5057: 189E4FB273: client=unknown27.75.56.22，sasl_method=LOGIN，sasl_username=mike@mydomain.co.uk Jun 22 19:28:06消息后缀/ server1 5645: 0C65CFB267: message-id= Jun 22 19:28:06 server1后缀/qmgr4391: 0C65CFB267: from=，size=690，nrcpt=1 (队列活动) Jun 22 19:28:06 server1后缀/leanup5515: 127F5FB26E: message-id= Jun 22 19:28:06 server1后缀/qmgr4391: 127F5FB26E: from=，size=697，nrcpt=1 (队列活动) Jun 22 19:28:06 server1后缀/清理5644: 6843DFB270: message-id=8REPFY1T-UQLX-NXWH-JAL6-GBV9JM53NE4P@mydomain.co.uk Jun 22 19:28:06 server1后缀/qmgr4391: 6843DFB270: from=，size=703，QMgr4391nrcpt=1 (活跃队列) Jun 22 19:28:06 server1后缀/清理5598: E73C2FB25F: message-id= Jun 22 19:28:06 server1后缀/Cleanup5607: BEDB4FB26D: message-id= Jun 22 19:28:06 server1后缀/qmgr4391: BEDB4FB26D: from=，size=674，nrcpt=1 (活跃队列) Jun 22 19:28:06 server1后缀/qmgr4391: E73C2FB25F: from=，size=690，nrcpt=1 (活跃队列) Jun 22 19:28:06 server1后缀/smtpd5052: 95065FB274: client=unknown94.99.25.28，sasl_method=LOGIN，sasl_username=mike@mydomain.co.uk Jun 22 19:28:06消息后缀/ server1 5646: 9858BFB26B: message-id= Jun 22 19:28:06 server1后缀/Cleanup5643: 37753FB26F: message-id= Jun 22 19:28:06 server1后缀/qmgr4391: 37753FB26F: from=，size=827，nrcpt=1 (队列活动) Jun 22 19:28:06 server1后缀/qmgr4391: 9858BFB26B: from=，size=692，nrcpt=1 (队列活动) Jun 22 19:28:06 server1后缀/smtpd5357: A9E14FB275: client=unknown181.211.189.214，sasl_method=LOGIN，sasl_username=mike@mydomain.co.uk Jun 22 19:28:06 server1后缀/smtpd5305: C5767FB276: client=81.61.129.17.dyn.user.ono.com81.61.129.17，sasl_method=LOGIN，sasl_username=mike@mydomain.co.uk Jun 22 19:28:06 server1后缀/sasl_username=mike@mydomain.co.uk 5593: 69984FB26A: sasl_username=mike@mydomain.co.uk-id= Jun 22 19:28:06 server1后缀/qmgr4391: 69984FB26A: from=，size=715，nrcpt=1 (活动队列) Jun 22 19:28:07 server1后缀/smtpd5208: 17F14FB277: client=unknown190.233.125.58，sasl_method=LOGIN，sasl_username=mike@mydomain.co.uk Jun 22 19:28:07 server1后缀/清理5641: ED465FB272: message-id= Jun 22 19:28:07 server1后缀/qmgr4391: ED465FB272: from=，size=715，nrcpt=1 (活跃队列) Jun 22 19:28:07 server1后缀/清理5613: ABF72FB271: message-id= Jun 22 19:28:07 server1后缀/qmgr4391: ABF72FB271: from=，size=706，nrcpt=1 (活跃队列) Jun 22 19:28:07 server1后缀/smtpd5304: 85087FB278: client=unknown37.150.230.145，sasl_method=LOGIN，sasl_username=mike@mydomain.co.uk Jun 22 19:28:07消息后缀/ server1 5515: C5767FB276: message-id= Jun 22 19:28:07 server1后缀/qmgr4391: C5767FB276: from=，size=701，nrcpt=1 (活动队列) Jun 22 19:28:07 server1后缀/smtpd5494: 9DBA9FB279: client=unknown14.167.36.85，sasl_method=LOGIN，sasl_username=mike@mydomain.co.uk

Answer 1

您的电子邮件帐户的登录信息已被截获。当我查看IP地址(我查看了4个)时，它们来自秘鲁、厄瓜多尔、沙特阿拉伯和中国。

更改密码并重启sasl