[OSX] Open relay?

[LePlatDuJour]

Goeie,

Ik heb -- tijdelijk -- een websiteje draaien op m'n macbookje thuis: drupal 6 + mamp pro. Op die site staat een contact form. Toen ik gisteren door m'n mail.log heen liep zag ik dingen staan als

code:

to=<[e-mail]>, relay=gmail-smtp-in.l.google.com

en toen gingen de alarmbellen af. Ben ik een open relay? Niet volgens abuse.net (en port 25 staat dicht). Het zijn er maar een paar, maar ik maak me toch zorgen. Iemand enig idee waar ik het zoeken moet? Iemand op het drupal forum suggereerde een root kit?

Hier is de complete log:

code:

Nov  5 06:38:54 magritte postfix/master[5168]: daemon started -- version 2.4.3, configuration /etc/postfix
Nov  5 06:38:54 magritte postfix/qmgr[5170]: 4D2CE82873: from=<[e-mail]>, size=617, nrcpt=1 (queue active)
Nov  5 06:38:54 magritte postfix/pickup[5169]: 745F6B8F16: uid=70 from=<_www>
Nov  5 06:38:54 magritte postfix/cleanup[5172]: 745F6B8F16: message-id=<[e-mail]>
Nov  5 06:38:54 magritte postfix/qmgr[5170]: 745F6B8F16: from=<[e-mail]>, size=1158, nrcpt=1 (queue active)
Nov  5 06:38:55 magritte postfix/smtp[5174]: 745F6B8F16: to=<[e-mail]>, relay=gmail-smtp-in.l.google.com[74.125.79.27]:25, delay=1, delays=0.37/0.05/0.19/0.39, dsn=2.0.0, status=sent (250 2.0.0 OK 1225863548 20si13559673eyc.9)
Nov  5 06:38:55 magritte postfix/qmgr[5170]: 745F6B8F16: removed
Nov  5 06:38:56 magritte postfix/smtp[5173]: 4D2CE82873: host in1.smtp.messagingengine.com[66.111.4.75] said: 451 4.7.1 <[e-mail]>: Recipient address rejected: Temporary deferral, try again soon (in reply to RCPT TO command)
Nov  5 06:38:58 magritte postfix/smtp[5173]: 4D2CE82873: to=<[e-mail]>, relay=in1.smtp.messagingengine.com[66.111.4.73]:25, delay=1274749, delays=1274745/0.21/3.4/0.15, dsn=4.7.1, status=deferred (host in1.smtp.messagingengine.com[66.111.4.73] said: 451 4.7.1 <[e-mail]>: Recipient address rejected: Still temporary deferral, try again soon, 48 seconds to go (in reply to RCPT TO command))
Nov  5 06:38:58 magritte postfix/qmgr[5170]: 4D2CE82873: from=<[e-mail]>, status=expired, returned to sender
Nov  5 06:38:58 magritte postfix/cleanup[5172]: 1FA20B8F2B: message-id=<[e-mail]>
Nov  5 06:38:58 magritte postfix/qmgr[5170]: 1FA20B8F2B: from=<>, size=2674, nrcpt=1 (queue active)
Nov  5 06:38:58 magritte postfix/bounce[5176]: 4D2CE82873: sender non-delivery notification: 1FA20B8F2B
Nov  5 06:38:58 magritte postfix/qmgr[5170]: 4D2CE82873: removed
Nov  5 06:38:58 magritte postfix/local[5177]: 1FA20B8F2B: to=<[e-mail]>, relay=local, delay=0.12, delays=0/0.09/0/0.02, dsn=2.0.0, status=sent (delivered to mailbox)
Nov  5 06:38:58 magritte postfix/local[5177]: warning: service not found: biff/udp
Nov  5 06:38:58 magritte postfix/qmgr[5170]: 1FA20B8F2B: removed
Nov  5 06:39:54 magritte postfix/master[5168]: master exit time has arrived
Nov 11 19:06:03 magritte postfix/master[54533]: daemon started -- version 2.4.3, configuration /etc/postfix
Nov 11 19:06:03 magritte postfix/pickup[54534]: 407BCCFB2E: uid=70 from=<_www>
Nov 11 19:06:03 magritte postfix/cleanup[54536]: 407BCCFB2E: message-id=<[e-mail]>
Nov 11 19:06:03 magritte postfix/qmgr[54535]: 407BCCFB2E: from=<[e-mail]>, size=1162, nrcpt=1 (queue active)
Nov 11 19:06:04 magritte postfix/smtp[54538]: 407BCCFB2E: to=<[e-mail]>, relay=gmail-smtp-in.l.google.com[72.14.221.27]:25, delay=1.7, delays=0.26/0.06/0.3/1.1, dsn=2.0.0, status=sent (250 2.0.0 OK 1226426809 12si879698fgg.0)
Nov 11 19:06:04 magritte postfix/qmgr[54535]: 407BCCFB2E: removed
Nov 11 19:07:03 magritte postfix/master[54533]: master exit time has arrived
Nov 14 17:05:45 magritte postfix/master[71394]: daemon started -- version 2.4.3, configuration /etc/postfix
Nov 14 17:05:45 magritte postfix/pickup[71395]: 429BED7262: uid=70 from=<_www>
Nov 14 17:05:45 magritte postfix/cleanup[71397]: 429BED7262: message-id=<[e-mail]>
Nov 14 17:05:45 magritte postfix/qmgr[71396]: 429BED7262: from=<[e-mail]>, size=616, nrcpt=1 (queue active)
Nov 14 17:05:47 magritte postfix/smtp[71399]: 429BED7262: host in1.smtp.messagingengine.com[66.111.4.72] said: 451 4.7.1 <[e-mail]>: Recipient address rejected: Temporary deferral, try again soon (in reply to RCPT TO command)
Nov 14 17:05:48 magritte postfix/smtp[71399]: 429BED7262: to=<[e-mail]>, relay=in1.smtp.messagingengine.com[66.111.4.71]:25, delay=3.7, delays=0.29/0.07/3.2/0.21, dsn=4.7.1, status=deferred (host in1.smtp.messagingengine.com[66.111.4.71] said: 451 4.7.1 <[e-mail]>: Recipient address rejected: Still temporary deferral, try again soon, 49 seconds to go (in reply to RCPT TO command))
Nov 14 17:06:45 magritte postfix/master[71394]: master exit time has arrived
Nov 26 16:13:07 magritte postfix/master[25422]: daemon started -- version 2.4.3, configuration /etc/postfix
Nov 26 16:13:07 magritte postfix/qmgr[25424]: 429BED7262: from=<[e-mail]>, size=616, nrcpt=1 (queue active)
Nov 26 16:13:08 magritte postfix/pickup[25423]: D4E39FB53F: uid=70 from=<_www>
Nov 26 16:13:08 magritte postfix/cleanup[25425]: D4E39FB53F: message-id=<[e-mail]>
Nov 26 16:13:08 magritte postfix/qmgr[25424]: D4E39FB53F: from=<[e-mail]>, size=735, nrcpt=1 (queue active)
Nov 26 16:13:09 magritte postfix/smtp[25427]: 429BED7262: host in1.smtp.messagingengine.com[66.111.4.70] said: 451 4.7.1 <[e-mail]>: Recipient address rejected: Temporary deferral, try again soon (in reply to RCPT TO command)
Nov 26 16:13:10 magritte postfix/smtp[25428]: D4E39FB53F: host in1.smtp.messagingengine.com[66.111.4.72] said: 451 4.7.1 <[e-mail]>: Recipient address rejected: Still temporary deferral, try again soon, 49 seconds to go (in reply to RCPT TO command)
Nov 26 16:13:11 magritte postfix/smtp[25427]: 429BED7262: to=<[e-mail]>, relay=in1.smtp.messagingengine.com[66.111.4.73]:25, delay=1033646, delays=1033643/0.19/3.2/0.16, dsn=4.7.1, status=deferred (host in1.smtp.messagingengine.com[66.111.4.73] said: 451 4.7.1 <[e-mail]>: Recipient address rejected: Still temporary deferral, try again soon, 48 seconds to go (in reply to RCPT TO command))
Nov 26 16:13:11 magritte postfix/qmgr[25424]: 429BED7262: from=<[e-mail]>, status=expired, returned to sender
Nov 26 16:13:11 magritte postfix/cleanup[25425]: 5C68CFB542: message-id=<[e-mail]>
Nov 26 16:13:11 magritte postfix/qmgr[25424]: 5C68CFB542: from=<>, size=2672, nrcpt=1 (queue active)
Nov 26 16:13:11 magritte postfix/bounce[25429]: 429BED7262: sender non-delivery notification: 5C68CFB542
Nov 26 16:13:11 magritte postfix/qmgr[25424]: 429BED7262: removed
Nov 26 16:13:11 magritte postfix/local[25430]: 5C68CFB542: to=<[e-mail]>, relay=local, delay=0.13, delays=0/0.1/0/0.02, dsn=2.0.0, status=sent (delivered to mailbox)
Nov 26 16:13:11 magritte postfix/local[25430]: warning: service not found: biff/udp
Nov 26 16:13:11 magritte postfix/qmgr[25424]: 5C68CFB542: removed
Nov 26 16:13:12 magritte postfix/smtp[25428]: D4E39FB53F: to=<[e-mail]>, relay=in1.smtp.messagingengine.com[66.111.4.71]:25, delay=4.5, delays=1.3/0.02/3.1/0.13, dsn=4.7.1, status=deferred (host in1.smtp.messagingengine.com[66.111.4.71] said: 451 4.7.1 <[e-mail]>: Recipient address rejected: Still temporary deferral, try again soon, 47 seconds to go (in reply to RCPT TO command))
Nov 26 16:14:07 magritte postfix/master[25422]: master exit time has arrived
Nov 26 19:50:13 magritte postfix[26366]: error: to submit mail, use the Postfix sendmail command
Nov 26 19:50:13 magritte postfix[26366]: fatal: the postfix command is reserved for the superuser
Nov 26 19:50:27 magritte postfix[26367]: fatal: usage: postfix [-c config_dir] [-Dv] command
Nov 26 19:50:59 magritte postfix/postqueue[26371]: fatal: usage: postqueue -f | postqueue -i queueid | postqueue -p | postqueue -s site
Nov 26 19:51:11 magritte postfix/postqueue[26372]: warning: Mail system is down -- accessing queue directly

[benoni]

De server werkt niet als SMTP relay, de mails worden lokaal geïnjecteerd zo te zien.

Als je via SMTP de mails binnenkrijgt had je die connects op postfix/smtpd teruggezien in je mail.log, zoiets:

code:

Nov 25 12:39:50 server postfix/smtpd[26794]: connect from unknown[192.168.x.x]
Nov 25 12:39:50 server postfix/smtpd[26794]: D577E1F7B97: client=unknown[192.168.x.x]

Grep even door het logbestand van Apache (/Library/Logs/WebServer/access_log of zoiets) met de tijdsmarkeringen die je bij de regels met 'from=<[e-mail]>' vindt in de mail.log. Waarschijnlijk zie je dan welke PHP pagina verantwoordelijk is voor het lek, en welke gebruikers die benutten.

Zie je geen matches in je Apache logs, dan is er blijkbaar een los proces gestart die mail injecteert, dus dan heb je een trojan of rootkit te pakken.

[LePlatDuJour]

Dôh, apache_access log staat standaard uit. Net aangezet, maar aangezien het maar erg weinig voorkomt (gelukkig maar!) moet ik afwachten of er nog wat in komt. Kan ik makkelijk een melding (mailtje) laten sturen als een bepaalde postfix regel (met relay d'r in) in de log voorkomt?

Rootkits: rkhunter vindt in elk geval geen rootkits; ClamAV is nog aan het scannen. Ik blijf maar even hopen dat 't Drupal is, maar dan zou 't in de mail logs van Drupal te zien moeten zijn.

Brrr. Rootkits, virii.. dacht dat ik daar van af was, maar niet, dus.

[benoni]

Ik had nog een scriptje in elkaar geschoven voor monitoring, maar had niet direct tijd om het af te maken. Mocht het nog relevant zijn: logmonitor.sh in "Het grote "handige scripts" topic"

Er zullen ook wel kant-en-klare programma's voor te vinden zijn (voor GUI of CLI).