Sérgio Henriques

Na directoria /usr/lib/courier-imap/etc/ altera-se a entrada MAXPERIP nos ficheiros imapd e pop3d.

postqueue -p

Permite ver quais as mensagens que estão na queue do servidor

postcat -q XXXXXXXXXXXX

Permite ver o conteúdo de uma mensagem que esteja na queue

postqueue -p | tail -n +2 | awk 'BEGIN { RS = "" } / remover@ccems\.pt$/ { print $1 }' | tr -d '*!' | postsuper -d -

Apagar todos os emails de/para um determinado email

mailq | tail -n +2 | awk 'BEGIN { RS = "" } # $7=sender, $8=recipient1, $9=recipient2 { if ($7 == "[email protected]" && $9 == "") print $1 }' | tr -d '*!' | postsuper -d -

Gerar o ficheiro de base de dados para o postfix ler

postmap /etc/postfix/virtual.cf
/etc/init.d/postfix restart

If your server has very high load and you want to temporarily move all message from the incoming queue to the hold queue, use the command:

postsuper -h ALL

to move the messages back to the incoming queue, use the command:

postsuper -r ALL

Procura todas as mensagens com mais de 3k e apaga-as. Deve ser feito na(s) pasta(s) /var/spool/postfix/(hold|incoming|queue|active)

find . -type f -size -3k -exec ls -lh {} \; | awk '{ print "postsuper -r " $9 }'

Procura todas as mensagens com [email protected] e move para outra pasta

grep -l -Z -r '[email protected]' . | xargs -0 -I{} mv {} /var/spool/postfix/lixo_hold

Para apagar todas as mensagem com aquele login:

find /var/spool/postfix/active/ -type f \
        -exec grep -l '[email protected]' '{}' \; | \
    xargs -n1 basename | xargs -n1 postsuper -d

find /var/spool/postfix/deferred/ -type f \
        -exec grep -l 'Authenticated sender: [email protected]' '{}' \; | \
    xargs -n1 basename | xargs -n1 postsuper -d

O servidor estava a ser bombardeado com pedidos a tentar explorar uma falha existente no SSH. O log do SSH mostrava mensagens deste tipo:

Feb 28 21:53:55 ccems-web2 sshd[5488]: Bad protocol version identification 'GET http://cashinlink.com/6ydbw58 HTTP/1.1' from UNKNOWN
Feb 28 21:54:20 ccems-web2 sshd[5491]: Bad protocol version identification 'GET http://50a574f0.linkbucks.com/ HTTP/1.1' from UNKNOWN
Feb 28 21:54:27 ccems-web2 sshd[5494]: Connection closed by 127.0.0.1
Feb 28 21:54:29 ccems-web2 sshd[5496]: Bad protocol version identification 'GET http://e8de474e.linkbucks.com/ HTTP/1.1' from UNKNOWN
Feb 28 21:54:41 ccems-web2 sshd[5497]: Bad protocol version identification 'POST http://proxy.traficer.net/test.php HTTP/1.1' from UNKNOWN

Como o SSHD não é capaz de determinar a fonte do ataque é necessário utilizar o Strace para descobrir qual o IP.

Strace – Tracks and displays system calls associated with a running process

strace -f -e getpeername -p sshd-pid

Os resultados mostraram isto:

--- SIGCHLD (Child exited) @ 0 (0) ---
Process 5504 attached (waiting for parent)
Process 5504 resumed (parent 16532 ready)
[pid  5504] getpeername(3, {sa_family=AF_INET, sin_port=htons(3856), sin_addr=inet_addr("85.140.128.165")}, [1157143637847441424]) = 0
[pid  5504] getpeername(3, {sa_family=AF_INET, sin_port=htons(3856), sin_addr=inet_addr("85.140.128.165")}, [7217096605625745424]) = 0
[pid  5504] getpeername(3, {sa_family=AF_INET, sin_port=htons(3856), sin_addr=inet_addr("85.140.128.165")}, [16]) = 0
[pid  5504] getpeername(3, 0x7fff272839f0, [2821568938222026880]) = -1 EBADF (Bad file descriptor)
Process 5504 detached
--- SIGCHLD (Child exited) @ 0 (0) ---

--- SIGCHLD (Child exited) @ 0 (0) ---
Process 5630 attached (waiting for parent)
Process 5630 resumed (parent 16532 ready)
[pid  5630] getpeername(3, {sa_family=AF_INET, sin_port=htons(35372), sin_addr=inet_addr("218.6.19.3")}, [3209377693044834320]) = 0
[pid  5630] getpeername(3, {sa_family=AF_INET, sin_port=htons(35372), sin_addr=inet_addr("218.6.19.3")}, [7217878495832047632]) = 0
[pid  5630] getpeername(3, {sa_family=AF_INET, sin_port=htons(35372), sin_addr=inet_addr("218.6.19.3")}, [16]) = 0
[pid  5630] getpeername(3, 0x7fff9f2b0110, [11469262112979681408]) = -1 ENOTCONN (Transport endpoint is not connected)
Process 5630 detached
--- SIGCHLD (Child exited) @ 0 (0) ---

Basta bloquear na firewall os IPs e o problema fica resolvido.

iptables -A INPUT -s 85.140.128.165 -j DROP
iptables -A INPUT -s 218.6.19.3 -j DROP

Como eu utilizo o Fail2ban nos servidores para bloquear os vários tipos de ataques vou explicar as alterações na configuração que são necessários para se bloquear automaticamente este ataques.

Edita-se o ficheiro /etc/fail2ban/filter.d/sshd.conf e adiciona-se na directiva failregex estas linhas:

^%(__prefix_line)sBad protocol version identification '.*?' from <HOST>
^%(__prefix_line)sDid not receive identification string from <HOST>

null route block:

route add -host XXX.XXX.XXX.XXX reject

Mais informação: http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html

IPTables block:

iptables -I INPUT -s XXX.XXX.XXX.XXX -j DROP
iptables -I RH-Firewall-1-INPUT -s XXX.XXX.XXX.XXX -j DROP (CentOS)

(a opção -I adiciona a regra no topo da chain. a opção -A adiciona no final.)

Substituir todas as ocorrências de “CHARSET=latin1” por “CHARSET=utf8”:

:%s/CHARSET=latin1/CHARSET=utf8/g