Re: [CentOS-es] Ataque a una cuenta de emal

2019-01-31 Por tema Mauricio Tapia
Hola los correos te van a seguir llegando, El servidor respondera que es a
cuenta no existe etc... deberas esperar un tiempo ... si tienes iptables
puedes ir creando reglas de bloqueo a la S ip origen del correo antes que
lleguen a sendmail ... otra opcion es instalar fail2ban nunca esta demas ...

Saludos y suerte

On Wed, Jan 30, 2019, 8:45 PM VICTOR MANUEL VARGAS GONZALEZ <
victor...@hotmail.com wrote:

> Buenas Tardes
> un favor tengo un problema un equipo tenia virus el cual ya lo elimine de
> hecho di de baja del servidor la cuenta del emial pero me siguen llegando
> pura basura de esta cuenta y elimine las carpetas del usuarios , tuve que
> poner la cuenta para que se rechace loe mail que están llegando en
> etc/mail/Access ya no se que hacer
>
> mi servidor es centos 6 y lo tengo con sendmail y MailScanner
>
> Jan 30 17:47:06 mail sendmail[24060]: x0UNl2l5024060: from=<
> jpcab...@grecargo.com.mx>, size=0, class=0, nrcpts=0, proto=ESMTP,
> daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12]
> (may be forged)
> Jan 30 17:47:06 mail sendmail[24060]: x0UNl2l6024060: ruleset=check_mail,
> arg1=, relay=
> reverso-45-233-245-12.sounetmais.net.br [45.233.245.12] (may be forged),
> reject=550 5.7.1 ... Access denied
> Jan 30 17:47:07 mail sendmail[24060]: x0UNl2l6024060: from=<
> jpcab...@grecargo.com.mx>, size=0, class=0, nrcpts=0, proto=ESMTP,
> daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12]
> (may be forged)
> Jan 30 17:47:08 mail sendmail[24060]: x0UNl2l7024060: ruleset=check_mail,
> arg1=, relay=
> reverso-45-233-245-12.sounetmais.net.br [45.233.245.12] (may be forged),
> reject=550 5.7.1 ... Access denied
> Jan 30 17:47:08 mail sendmail[24060]: x0UNl2l7024060: from=<
> jpcab...@grecargo.com.mx>, size=0, class=0, nrcpts=0, proto=ESMTP,
> daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12]
> (may be forged)
> Jan 30 17:47:09 mail sendmail[24060]: x0UNl2l8024060: ruleset=check_mail,
> arg1=, relay=
> reverso-45-233-245-12.sounetmais.net.br [45.233.245.12] (may be forged),
> reject=550 5.7.1 ... Access denied
> Jan 30 17:47:09 mail sendmail[24060]: x0UNl2l8024060: from=<
> jpcab...@grecargo.com.mx>, size=0, class=0, nrcpts=0, proto=ESMTP,
> daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12]
> (may be forged)
> Jan 30 17:47:10 mail sendmail[24067]: STARTTLS=server, relay=
> indri.birch.relay.mailchannels.net [23.83.209.92], version=TLSv1/SSLv3,
> verify=NO, cipher=DHE-RSA-AES256-GCM-SHA384, bits=256/256
> Jan 30 17:47:10 mail sendmail[24060]: x0UNl2l9024060: ruleset=check_mail,
> arg1=, relay=
> reverso-45-233-245-12.sounetmais.net.br [45.233.245.12] (may be forged),
> reject=550 5.7.1 ... Access denied
> Jan 30 17:47:11 mail sendmail[24067]: x0UNl9lw024067: from=<
> mariel...@corporativogab.com.mx>, size=15901, class=0, nrcpts=3,
> msgid=<015801d4b8f5$a8051270$f80f3750$@corporativogab.com.mx>,
> proto=ESMTP, daemon=MTA, relay=indri.birch.relay.mailchannels.net
> [23.83.209.92]
> Jan 30 17:47:12 mail sendmail[24060]: x0UNl2l9024060: from=<
> jpcab...@grecargo.com.mx>, size=0, class=0, nrcpts=0, proto=ESMTP,
> daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12]
> (may be forged)
> Jan 30 17:47:13 mail MailScanner[19246]: New Batch: Scanning 1 messages,
> 16719 bytes
> Jan 30 17:47:13 mail MailScanner[19246]: Virus and Content Scanning:
> Starting
> Jan 30 17:47:13 mail sendmail[24070]: AUTH=server, relay=
> 31.25.140.220.tarinnet.info [31.25.140.220] (may be forged),
> authid=jpcabeza, mech=CRAM-MD5, bits=0
> Jan 30 17:47:13 mail MailScanner[19246]: Uninfected: Delivered 1 messages
>
>
>
>
> ___
> CentOS-es mailing list
> CentOS-es@centos.org
> https://lists.centos.org/mailman/listinfo/centos-es
>
___
CentOS-es mailing list
CentOS-es@centos.org
https://lists.centos.org/mailman/listinfo/centos-es


[CentOS-es] Ataque a una cuenta de emal

2019-01-30 Por tema VICTOR MANUEL VARGAS GONZALEZ
Buenas Tardes
un favor tengo un problema un equipo tenia virus el cual ya lo elimine de hecho 
di de baja del servidor la cuenta del emial pero me siguen llegando  pura 
basura de esta cuenta y elimine las carpetas del usuarios , tuve que poner la 
cuenta para que se rechace loe mail que están llegando en etc/mail/Access   
  ya no se que hacer

mi servidor es centos 6 y lo tengo con sendmail y MailScanner

Jan 30 17:47:06 mail sendmail[24060]: x0UNl2l5024060: 
from=, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12] (may 
be forged)
Jan 30 17:47:06 mail sendmail[24060]: x0UNl2l6024060: ruleset=check_mail, 
arg1=, relay=reverso-45-233-245-12.sounetmais.net.br 
[45.233.245.12] (may be forged), reject=550 5.7.1 ... 
Access denied
Jan 30 17:47:07 mail sendmail[24060]: x0UNl2l6024060: 
from=, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12] (may 
be forged)
Jan 30 17:47:08 mail sendmail[24060]: x0UNl2l7024060: ruleset=check_mail, 
arg1=, relay=reverso-45-233-245-12.sounetmais.net.br 
[45.233.245.12] (may be forged), reject=550 5.7.1 ... 
Access denied
Jan 30 17:47:08 mail sendmail[24060]: x0UNl2l7024060: 
from=, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12] (may 
be forged)
Jan 30 17:47:09 mail sendmail[24060]: x0UNl2l8024060: ruleset=check_mail, 
arg1=, relay=reverso-45-233-245-12.sounetmais.net.br 
[45.233.245.12] (may be forged), reject=550 5.7.1 ... 
Access denied
Jan 30 17:47:09 mail sendmail[24060]: x0UNl2l8024060: 
from=, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12] (may 
be forged)
Jan 30 17:47:10 mail sendmail[24067]: STARTTLS=server, 
relay=indri.birch.relay.mailchannels.net [23.83.209.92], version=TLSv1/SSLv3, 
verify=NO, cipher=DHE-RSA-AES256-GCM-SHA384, bits=256/256
Jan 30 17:47:10 mail sendmail[24060]: x0UNl2l9024060: ruleset=check_mail, 
arg1=, relay=reverso-45-233-245-12.sounetmais.net.br 
[45.233.245.12] (may be forged), reject=550 5.7.1 ... 
Access denied
Jan 30 17:47:11 mail sendmail[24067]: x0UNl9lw024067: 
from=, size=15901, class=0, nrcpts=3, 
msgid=<015801d4b8f5$a8051270$f80f3750$@corporativogab.com.mx>, proto=ESMTP, 
daemon=MTA, relay=indri.birch.relay.mailchannels.net [23.83.209.92]
Jan 30 17:47:12 mail sendmail[24060]: x0UNl2l9024060: 
from=, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA, relay=reverso-45-233-245-12.sounetmais.net.br [45.233.245.12] (may 
be forged)
Jan 30 17:47:13 mail MailScanner[19246]: New Batch: Scanning 1 messages, 16719 
bytes
Jan 30 17:47:13 mail MailScanner[19246]: Virus and Content Scanning: Starting
Jan 30 17:47:13 mail sendmail[24070]: AUTH=server, 
relay=31.25.140.220.tarinnet.info [31.25.140.220] (may be forged), 
authid=jpcabeza, mech=CRAM-MD5, bits=0
Jan 30 17:47:13 mail MailScanner[19246]: Uninfected: Delivered 1 messages




___
CentOS-es mailing list
CentOS-es@centos.org
https://lists.centos.org/mailman/listinfo/centos-es