关于SMTP-OUT日志分析

mark_cn

账号为：xxx@abc.com自己本人没有在日志显示时间段内给xierd@yuchengtech.com发送日志，可为何在SMTP-OUT中确又可以出现：望指教，特别是发送出去的都是垃圾邮件。

Sun 2011-07-17 03:31:48: ----------
Sun 2011-07-17 05:19:28: Parsing message <e:\umail\queues\remote\pd35000062741.msg>
Sun 2011-07-17 05:19:28: *  From: xxx@abc.com
Sun 2011-07-17 05:19:28: *  To: xierd@yuchengtech.com
Sun 2011-07-17 05:19:28: *  Subject: =?utf-8?B?eGllcmQs5ri45rOz5pe277yM5L2g5LiN5oCV5Zu06KeC77yf?=
Sun 2011-07-17 05:19:28: *  Size (bytes): 1336
Sun 2011-07-17 05:19:28: *  Message-ID:
Sun 2011-07-17 05:19:28: Attempting SMTP connection to [yuchengtech.com]
Sun 2011-07-17 05:19:28: Resolving MX records for [yuchengtech.com] (DNS Server: 192.168.1.125)...
Sun 2011-07-17 05:19:28: *  P=050 S=000 D=yuchengtech.com TTL=(578) MX=[mail.yuchengtech.com] {219.143.38.239}
Sun 2011-07-17 05:19:28: Attempting SMTP connection to [219.143.38.239:25]
Sun 2011-07-17 05:19:28: Waiting for socket connection...
Sun 2011-07-17 05:19:28: *  Connection established (192.168.1.125:4242 -> 219.143.38.239:25)
Sun 2011-07-17 05:19:28: Waiting for protocol to start...
Sun 2011-07-17 05:19:32: <-- 220 mail.yuchengtech.com ESMTP Postfix
Sun 2011-07-17 05:19:32: --> EHLO abc.com
Sun 2011-07-17 05:19:32: <-- 250-mail.yuchengtech.com
Sun 2011-07-17 05:19:32: <-- 250-PIPELINING
Sun 2011-07-17 05:19:32: <-- 250-SIZE 102400000
Sun 2011-07-17 05:19:32: <-- 250-VRFY
Sun 2011-07-17 05:19:32: <-- 250-ETRN
Sun 2011-07-17 05:19:32: <-- 250-AUTH PLAIN LOGIN
Sun 2011-07-17 05:19:32: <-- 250-AUTH=PLAIN LOGIN
Sun 2011-07-17 05:19:32: <-- 250-ENHANCEDSTATUSCODES
Sun 2011-07-17 05:19:32: <-- 250-8BITMIME
Sun 2011-07-17 05:19:32: <-- 250 DSN
Sun 2011-07-17 05:19:32: --> MAIL From:<xxx@abc.com> SIZE=1336
Sun 2011-07-17 05:19:32: <-- 250 2.1.0 Ok
Sun 2011-07-17 05:19:32: --> RCPT To:<xierd@yuchengtech.com>
Sun 2011-07-17 05:19:32: <-- 250 2.1.5 Ok
Sun 2011-07-17 05:19:32: --> DATA
Sun 2011-07-17 05:19:32: <-- 354 End data with <CR><LF>.<CR><LF>
Sun 2011-07-17 05:19:32: Sending <e:\umail\queues\remote\pd35000062741.msg> to [219.143.38.239]
Sun 2011-07-17 05:19:32: Transfer Complete
Sun 2011-07-17 05:19:33: <-- 250 2.0.0 Ok: queued as E3E0822A352
Sun 2011-07-17 05:19:33: --> QUIT
Sun 2011-07-17 05:19:33: <-- 221 2.0.0 Bye
Sun 2011-07-17 05:19:33: SMTP session successful (Bytes in/out: 331/1443)
Sun 2011-07-17 05:19:33: ----------

wxhsh

很早以前就有专门讨论，弱口令用户漏洞，升级MD，启用动态屏蔽，修改弱口令用户密码，没有别的捷径。