【求助】mail server被入侵了

[ahdeng]

幫忙一下，星期日公司的MAIL QUEUE居然有十萬多筆的信件未寄出，看了一下大部份都是由這個網站寄出來的，http://chmailnet.com/，是公司的MAIL SERVER 被 RELAY了嗎?可是我也沒有開放讓這個位址可以寄信?可以幫忙一下如何解決呢!!
Dec 9 00:00:00 mail sendmail[22426]: gB8Fxtn22426: from=<[email protected]>, size=2114, class=0, nrcpts=5, msgid=<[email protected]>, proto=SMTP, relay=localhost.localdomain [127.0.0.1]
Dec 9 00:00:01 mail sendmail[22432]: gB8Fxrm22421: to=<[email protected]>, delay=00:00:07, xdelay=00:00:03, mailer=esmtp, pri=152120, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
Dec 9 00:00:01 mail sendmail[22430]: gB8FxqZ22410: to=<[email protected]>, delay=00:00:08, xdelay=00:00:03, mailer=esmtp, pri=152118, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
Dec 9 00:00:01 mail sendmail[22425]: gB8Fxwn22425: to=<[email protected]>, delay=00:00:02, xdelay=00:00:01, mailer=esmtp, pri=32220, relay=chmailnet.com. [210.82.176.96], dsn=4.0.0, stat=Deferred: Connection refused by chmailnet.com.
Dec 9 00:00:01 mail sendmail[22428]: gB8FxqN22417: to=<[email protected]>, delay=00:00:08, xdelay=00:00:03, mailer=esmtp, pri=152120, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
Dec 9 00:00:01 mail sendmail[21996]: gB8FvVR21960: to=<[email protected]>, delay=00:02:28, xdelay=00:02:00, mailer=esmtp, pri=153987, relay=onemain-mx.earthlink.net. [207.217.120.183], dsn=4.0.0, stat=Deferred: Connection timed out with onemain-mx.earthlink.net.
Dec 9 00:00:01 mail sendmail[22432]: gB8Fxrm22421: to=<[email protected]>, delay=00:00:07, xdelay=00:00:03, mailer=esmtp, pri=152120, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
Dec 9 00:00:01 mail sendmail[21996]: gB8FvVR21960: gB8G01R21996: DSN: User unknown

[dominic]

stat=User unknown
如果stat不是=sent就是沒寄出.....而且你貼的log太短了~~只看到尾巴.....不知道是本地使用者寄ㄉ還是外部server要relayㄉ

[ahdeng]

最初由 dominic 發表
stat=User unknown
如果stat不是=sent就是沒寄出.....而且你貼的log太短了~~只看到尾巴.....不知道是本地使用者寄ㄉ還是外部server要relayㄉ

在公司內部才可以relay，在外面就不行透過這台mail server relay，這是大部份都是這樣設定的吧!!
我很想全部貼出來，但是這些log檔光12/8日就80MB了，這不是我打錯，這是真的!!
主機是用RED HAT 7.2，每天都會寄LOG到root的信箱，光是看就受不了!!
是我主機被spam了嗎?
還需要提供什麼資料才可以解答?

[dominic]

你可以先搜索站上有關relay測試的文章為你的server做test
至於你的log檔像這個
Dec 9 00:00:01 mail sendmail[22432]: gB8Fxrm22421: to=<[email protected]>, delay=00:00:07, xdelay=00:00:03, mailer=esmtp, pri=152120, relay=smtp-gw-4.msn.com. [207.46.181.13], dsn=5.1.1, stat=User unknown
應該還有一段程序sendmail[22432]一樣的一行主要記載from的部份......