Sunucuya exim üzerinden saldırı geliyor:(

ENVER · #1 (**permalink**) 2008-01-05, 22:24

Merhabalar sunucu loadı aşağıdaki gibidir.

Kod:

top - 22:21:16 up 35 days, 19:51,  1 user,  load average: 202.29, 178.24, 150.30
Tasks: 661 total,  24 running, 633 sleeping,   3 stopped,   1 zombie
Cpu(s): 66.0% us, 15.8% sy,  0.0% ni,  6.2% id, 11.8% wa,  0.1% hi,  0.0% si
Mem:   4148496k total,  3899392k used,   249104k free,    39364k buffers
Swap:  2040244k total,   122476k used,  1917768k free,  1359236k cached

nedeni ise

Alıntı:

10173 forumn 18 0 0 0:01.08 0.0 10520 1688 452 D /usr/sbin/exim -Mc 1JBFNV-0002bT-O7
10193 forumn 18 0 0 0:01.13 0.0 10188 1696 452 D /usr/sbin/exim -Mc 1JBFNZ-0002d6-10
10266 forumn 18 0 0 0:01.05 0.0 10092 1696 452 D /usr/sbin/exim -Mc 1JBFNb-0002dT-Vd
10280 forumn 18 0 0 0:01.07 0.0 9556 1692 452 D /usr/sbin/exim -Mc 1JBFNd-0002dh-2B
10346 forumn 18 0 0 0:01.11 0.0 10192 1688 452 D /usr/sbin/exim -Mc 1JBFNg-0002e7-1N
10367 forumn 18 0 0 0:01.06 0.0 9116 1692 452 D /usr/sbin/exim -Mc 1JBFNg-0002br-Go
10389 forumn 18 0 0 0:01.15 0.0 10204 1696 452 D /usr/sbin/exim -Mc 1JBFNi-0002f1-1W
10412 forumn 18 0 0 0:01.08 0.0 9572 1692 452 D /usr/sbin/exim -Mc 1JBFNj-0002gR-7O
10472 forumn 18 0 0 0:01.04 0.0 9604 1688 452 D /usr/sbin/exim -Mc 1JBFNm-0002he-EP
10564 forumn 18 0 0 0:01.05 0.0 9316 1692 452 D /usr/sbin/exim -Mc 1JBFNr-0002jL-VL
10594 forumn 18 0 0 0:01.05 0.0 9056 1688 452 D /usr/sbin/exim -Mc 1JBFNt-0002iW-EG
10773 forumn 18 0 0 0:01.08 0.0 8728 1688 452 D /usr/sbin/exim -Mc 1JBFO7-0002md-UM
11007 forumn 18 0 0 0:01.06 0.0 9992 1684 452 D /usr/sbin/exim -Mc 1JBFOL-0002p7-Cl
11015 forumn 18 0 0 0:01.04 0.0 9164 1688 452 D /usr/sbin/exim -Mc 1JBFOL-0002oy-KE
11105 forumn 18 0 0 0:01.13 0.0 9576 1688 452 D /usr/sbin/exim -Mc 1JBFOQ-0002qn-VR
11126 forumn 18 0 0 0:01.10 0.0 9620 1692 452 D /usr/sbin/exim -Mc 1JBFOR-0002ro-UO
11320 forumn 18 0 0 0:00.93 0.0 9488 1688 452 D /usr/sbin/exim -Mc 1JBFOg-0002vG-PH
12629 forumn 18 0 0 0:00.54 0.0 9064 1688 452 D /usr/sbin/exim -Mc 1JBFQ4-0003Ek-Qz
12842 forumn 18 0 0 0:00.52 0.0 9032 1688 452 D /usr/sbin/exim -Mc 1JBFQG-0003Jr-Ps
13069 forumn 18 0 0 0:00.55 0.0 9160 1688 452 D /usr/sbin/exim -Mc 1JBFQX-0003N0-SE
13376 forumn 18 0 0 0:00.35 0.0 9120 1688 452 D /usr/sbin/exim -Mc 1JBFQp-0003RC-MN
13390 forumn 18 0 0 0:00.49 0.0 9068 1688 452 D /usr/sbin/exim -Mc 1JBFQp-0003RN-3v
13449 forumn 18 0 0 0:00.50 0.0 9132 1688 452 D /usr/sbin/exim -Mc 1JBFQu-0003Sy-Kk

bu şekilde birçok mail gelmesi. mailler sürekli değişik adreslere geliyor. örneğin

gfdjh@www.sitem.com
kjkhjkbjb@www.sitem.com
mbhjjkb@www.sitem.com
123ahmad@www.sitem.com
gibi bu saldırıların önüne geçilebilir mi?

CyberTurk · #2 (**permalink**) 2008-01-05, 23:47

gelen mailler nedir? Senin sunucunu birisi rotlayıp spam atıyorda acaba o spamlerin ulaşmama mailleri mi geliyor?

ENVER · #3 (**permalink**) 2008-01-05, 23:59

Alıntı:

1JBB79-0006du-8A-D
------=_NextPart_000_0009_01C84F87.DAAC3FC0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Good night bilal
Get ready for cold days. Order that man medicine now
http://patpongchat.com

Lea Soon
------=_NextPart_000_0009_01C84F87.DAAC3FC0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.3059" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT Arial size=3D2>Good night bilal</FONT></DIV>
<DIV><FONT Arial size=3D2>Get ready for cold days. Order that man =
medicine=20
now</FONT></DIV>
<DIV><FONT Arial size=3D2><A=20
HREF=3D"http://patpongchat.com">http://patpongchat.com</A></FONT></DIV>
<DIV><FONT Arial size=3D2></FONT></DIV>
<DIV><FONT Arial size=3D2>Lea Soon</FONT></DIV></BODY></HTML>

------=_NextPart_000_0009_01C84F87.DAAC3FC0--

Alıntı:

1JBBGR-0000Au-DY-D
mcafee desktop firewall 8.0.493 - 39
zend studio - 49
adobe after effects cs3 - 69
2007microsoft office enterprise - 79
sonic scenarist 3.0 - 49
adobe photoshop cs2 v 9.0 - 69
adobe after effects cs3 - 69
microsoft frontpage 2003 - 29

type softwarefoundation . net in Internet browser

office professional xp - 49
microsoft vista business - 79
abbyy finereader 8.0 professional multilanguage - 49
steinberg nuendo 3.1 - 99
parallels desktop 3.0 for mac - 29
intuit quicken premier 2008 - 29
discreet combustion 4.0 for windows - 69
autodesk 3ds max 9.0 - 149
google sketchup pro 6 for mac - 59

Alıntı:

1JBBMV-0001Sp-6L-D
DickBroadChristina
http://brozeitsux.com

gibi maillerde değişiyor yani sunucuya direk geliyor sunucudan spam çıkan spam yok.

Seçenekler
Yazdırılabilir şekli göster Sayfayı E-Mail olarak gönder
Stil
Normal Hybrid-Şeklinde gösterime geç Ağaç şeklinde gösterime geç

Benzer Konular
Konu	Konuyu Başlatan	Forum	Cevaplar	Son Mesaj
Bilgisayarıma saldırı geliyor :)	Darkart	İşletim sistemi	5	2007-08-10 02:59
Saldırı Olan Sunucuya mail Gelirmi	umuture	Webmaster Genel Konular	5	2007-04-17 18:50
Sunucuya Koruma	hikmetbaysal	Güvenlik	10	2007-03-03 17:56
sunucuya hdd takviyesi	kaanmurat	Dedicated - Co Location	4	2006-08-13 02:25
exim mail server.	GNeRaL	İşletim sistemi	0	2005-05-28 21:21

Konuyu Toplam 1 Üye okuyor. (0 Kayıtlı üye ve 1 Misafir)