다시 해보자.. 되겠지.. 뭔가 잘못했겠지..
sendmail -> gmail 발송시
<로그>
Jan 17 13:25:26 id sendmail[31416]: v0H4P7uA031416: from=보내는 사람@soft.com, size=10, class=0, nrcpts=1, msgid=<201701170425.v0H4P7uA031416@id.cafe24.com>, proto=SMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]
Jan 17 13:25:26 id opendkim[31378]: v0H4P7uA031416: can't determine message sender; accepting
Jan 17 13:25:26 id sendmail[31416]: v0H4P7uA031416: Milter insert (1): header: Authentication-Results: id.cafe24.com; dkim=permerror (bad message/signature format)
Jan 17 13:25:27 id sendmail[31421]: STARTTLS=client, relay=gmail-smtp-in.l.google.com., version=TLSv1/SSLv3, verify=FAIL, cipher=AES128-SHA, bits=128/128
Jan 17 13:25:28 id sendmail[31421]: v0H4P7uA031416: to=email@gmail.com, delay=00:00:16, xdelay=00:00:02, mailer=esmtp, pri=120010, relay=gmail-smtp-in.l.google.com. [74.125.204.26], dsn=5.0.0, stat=Service unavailable
Jan 17 13:25:28 id sendmail[31421]: v0H4P7uA031416: to=보내는 사람@soft.com, delay=00:00:16, mailer=local, pri=120010, dsn=5.1.1, stat=User unknown
Jan 17 13:25:28 id sendmail[31421]: v0H4P7uA031416: v0H4PSuA031421: postmaster notify: User unknown
Jan 17 13:25:28 id sendmail[31421]: v0H4PSuA031421: to=root, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31581, dsn=2.0.0, stat=Sent
<반송>
--v0H4OxXw031400.1484627099/id.cafe24.com--
From MAILER-DAEMON@id.cafe24.com Tue Jan 17 13:25:28 2017
Return-Path: <MAILER-DAEMON@id.cafe24.com>
Received: from localhost (localhost)
by id.cafe24.com (8.13.8/8.13.8) id v0H4PSuA031421;
Tue, 17 Jan 2017 13:25:28 +0900
Date: Tue, 17 Jan 2017 13:25:28 +0900
From: Mail Delivery Subsystem <MAILER-DAEMON@id.cafe24.com>
Message-Id: <201701170425.v0H4PSuA031421@id.cafe24.com>
To: postmaster@id.cafe24.com
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="v0H4PSuA031421.1484627128/id.cafe24.com"
Subject: Postmaster notify: see transcript for details
Auto-Submitted: auto-generated (postmaster-notification)
This is a MIME-encapsulated message
--v0H4PSuA031421.1484627128/id.cafe24.com
The original message was received at Tue, 17 Jan 2017 13:25:12 +0900
from localhost.localdomain [127.0.0.1]
with id v0H4P7uA031416
----- The following addresses had permanent fatal errors -----
받는사람@gmail.com
(reason: 550-5.7.1 [서버IP 12] Our system has detected that this message is)
----- Transcript of session follows -----
... while talking to gmail-smtp-in.l.google.com.:
>>> DATA
<<< 550-5.7.1 [서버IP 12] Our system has detected that this message is
<<< 550-5.7.1 likely unsolicited mail. To reduce the amount of spam sent to Gmail,
<<< 550-5.7.1 this message has been blocked. Please visit
<<< 550-5.7.1 https://support.google.com/mail/?p=UnsolicitedMessageError
<<< 550 5.7.1 for more information. c66si19426888pfb.26 - gsmtp
554 5.0.0 Service unavailable
550 5.1.1 보내는 사람@soft.com... User unknown
--v0H4PSuA031421.1484627128/plantid.cafe24.com
Content-Type: message/delivery-status
Reporting-MTA: dns; id.cafe24.com
Received-From-MTA: DNS; localhost.localdomain
Arrival-Date: Tue, 17 Jan 2017 13:25:12 +0900
Final-Recipient: RFC822; 받는사람@gmail.com
Action: failed
Status: 5.7.1
Remote-MTA: DNS; gmail-smtp-in.l.google.com
Diagnostic-Code: SMTP; 550-5.7.1 [서버IP 12] Our system has detected that this message is
Last-Attempt-Date: Tue, 17 Jan 2017 13:25:28 +0900
--v0H4PSuA031421.1484627128/id.cafe24.com
Content-Type: message/rfc822
Return-Path: <보내는 사람@soft.com>
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
by id.cafe24.com (8.13.8/8.13.8) with SMTP id v0H4P7uA031416
for 받는사람@gmail.com; Tue, 17 Jan 2017 13:25:12 +0900
Authentication-Results: id.cafe24.com; dkim=permerror (bad message/signature format)
Date: Tue, 17 Jan 2017 13:25:07 +0900
From: 보내는 사람@soft.com
Message-Id: <201701170425.v0H4P7uA031416@id.cafe24.com>
X-Authentication-Warning: id.cafe24.com: localhost.localdomain [127.0.0.1] didn't use HELO protocol
UK_TEST
--v0H4PSuA031421.1484627128/id.cafe24.com--
검색어 : opendkim cannot determine message sender accepting,"sendmail"
검색어 : sendmail verify=fail gmail
20170118
내가 계속 테스트를 하면서 이상했던 점은 릴레이스팸인지..하는 것은 안되게 변경을 했고
테스트를 해도 안되고 있다고 나온다.
그런데 메일 로그를 보면 계속 메일을 발송하려는 시도가 있다..
이게 뭘까하고 찾다가 보게된 단어 스푸핑(spoofing)
스푸핑 방어에 대해 알아봐야 할 것 같다.
ARP 스푸핑(ARP Spoofing) 감지를 위한 arpwatch
http://ganesis.tistory.com/entry/201212261
/var/arpwatch/arp.dat 를 확인해보니.. arpwatch 는 설치안되어 있나보다.
yum install arpwatch 로 설치완료
먼저 /etc/sysconfig/arpwatch 파일을 열서 수정한다.
# -u : defines with what user id arpwatch should run
# -e : the where to send the reports
# -s : the -address
OPTIONS="-u pcap -e '메일주소' -s '보내는이(Arpwatch)' -n '192.168.100.0/24'"
위 옵션은 다음과 같은 의미를 가진다.
-e : 수신 Email 주소를 의미한다.
-s : 보내는이
-n : 감시할 IP대역
-u : arpwatch를 실행할 사용자 (기본 pcap이니 기본으로 두자)
스팸대응) 메일 릴레이대응 구글링 관련자료 펌업)다른 사람이 내 이메일을 사용하고 있나ARP Spoofing 감지하기 (arpwatch)message 로그로 MAP/IP 주소 쌍의 변경시 남겨지는 로그 확인
# tail -f /var/log/messagesARP 스푸핑(ARP Spoofing) 감지를 위한 arpwatch스펨메일중계 해결방법레드햇9(메일서버(sendmail)설치 및 운영SendMail 을 사용하여 메일 송수신 하기
http://www.koreaidc.com/bbs/set_view.php?b_name=idcpds&w_no=109
http://11q.kr/pc/bbs/board.php?bo_table=s11&wr_id=1626&sst=wr_hit&sod=desc&sop=and&page=25
http://www.ylabs.co.kr/index.php?document_srl=571&mid=board_centos
'차근차근 > 이것저것' 카테고리의 다른 글
| 아파치톰캣 오라클 연동 (0) | 2017.03.14 |
|---|---|
| centOS sendmail에서 gmail로 발송이 안됨. 11 - gmail을 통해서 전송 (2) | 2017.01.19 |
| centOS sendmail에서 gmail로 발송이 안됨. 9 (0) | 2017.01.13 |
| centOS sendmail에서 gmail로 발송이 안됨. 8 (0) | 2017.01.11 |
| centOS sendmail에서 gmail로 발송이 안됨. 7 - 다시 (0) | 2017.01.09 |