sendmail用s8自带的8.11.6，/var/log/syslog:如下：
Oct 21 08:45:19 xnjc sendmail[3934]: [ID 801593 mail.info] h9L0jJw03934:
from=<05zlj1005@ms45.hinet.net>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA,
relay=KH218-187-183-170.adsl.pl.apol.com.tw [218.187.183.170]
Oct 21 08:45:20 xnjc sendmail[3935]: [ID 801593 mail.notice] h9L0jJw03935: ruleset=check_rcpt,
arg1=<ados9155@ms73.hinet.net>, relay=KH218-187-183-170.adsl.pl.apol.com.tw [218.187.183.170],
reject=550 5.7.1 <ados9155@ms73.hinet.net>... Relaying denied
Oct 21 08:45:20 xnjc sendmail[3935]: [ID 801593 mail.info] h9L0jJw03935:
from=<05zlj1005@ms45.hinet.net>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA,
relay=KH218-187-183-170.adsl.pl.apol.com.tw [218.187.183.170]
Oct 21 08:45:20 xnjc sendmail[3936]: [ID 801593 mail.notice] h9L0jKw03936: ruleset=check_rcpt,
arg1=<ados9155@ms73.hinet.net>, relay=KH218-187-183-170.adsl.pl.apol.com.tw [218.187.183.170],
reject=550 5.7.1 <ados9155@ms73.hinet.net>... Relaying denied
Oct 21 08:45:20 xnjc sendmail[3936]: [ID 801593 mail.info] h9L0jKw03936:
from=<05zlj1005@ms45.hinet.net>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA,
relay=KH218-187-183-170.adsl.pl.apol.com.tw [218.187.183.170]
Oct 21 08:45:21 xnjc sendmail[3937]: [ID 801593 mail.notice] h9L0jKw03937: ruleset=check_rcpt, arg1=<ados9155@ms73.hinet.net>, relay=KH218-187-183-170.adsl.pl.apol.com.tw [218.187.183.170], reject=550 5.7.1 <ados9155@ms73.hinet.net>... Relaying denied
处理的办法
STEP 1.
首先你要让你的服务器恢复正常,你可以在你的前端的硬件防火墙或着路由器上面把来自218.187.183.170的IP deny掉，这样你就不会收到来自dsl.pl.apol.com.tw的信了，当然你也可以在邮件服务器主机上用TCP WARPPER或者NET SCREEN做IP的过滤，但是不建议你这么做，会很浪费你的邮件服务器的资源。
STEP 2.
然后我们开始找出那个猪头并收拾他！我们需要做的是找到他注册域的ISP管理员的EMAIL，然后干掉他。
当然你可以直接查找他发信的用户来找到我们需要的信息
例如这条记录Oct 21 08:45:19 xnjc sendmail[3934]: [ID 801593 mail.info] h9L0jJw03934:
from=<05zlj1005@ms45.hinet.net>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA,
你可以直接查用户05zlj1005或者他的关键句柄ms45
$whois 05zlj1005
$whois \!ms45
但是这样查是没有什么意义的，我们发现那个猪头使用随机数字生成用户，你查不到什么，当然也不排除你遇到十分弱智的猪。所以我们可以查站点的IP地址反向跟踪得到其真实的域名。
哪个猪头可能在哪里注册呢？？非洲？？欧洲？？米国？？？就先假设他在米国注册的，我们就需要查找北美的INTERNET注册机构，他的IP是218.187.183.170，我们需要查218.187.183.子网。
$whois -h whois.arin.net 218.187.183
这时你发现这个猪头可能没有在北美注册。没有关系，他回返回218.187.183.子网的注册地是apnic（亚太地区）
嘿嘿！！我们就去亚太区查他
$whois -h whois.apnic.net '-T inetnum -r 218.187.183'
.....
.....
admin-c: AA000-APNIC
tech-c : AA000-APNIC
tech-c : AA000
......
AA000就是这个子网管理员的关键句柄,接着查....
$whois -h whois.apnic.net '-r AA00'
person:John Doe
..........
e-Mail:john@doe.com
这个就是管理域的联系人的EMAIL当然还有电话什么的......你可以把LOG抓下来投诉他给你发垃圾邮件的行为。让管理员收拾他！
最常用的几个顶级INTERNET注册机构
北美 whois.arin.net
欧洲 whois.ripe.net
亚太地区 whois.apnic.net
.........
别的你自己找吧~~~~~~~ ^_^
| sunmarmot 回复于：2003-10-23 15:29:40 |
| [img:c55c902518]http://joke.tom.com/img/assets/1/jyw1980.jpg[/img:c55c902518] |
| duxf 回复于：2003-10-23 15:37:03 |
| 当然你也可以在邮件服务器主机上用TCP WARPPER或者NET SCREEN做IP的过滤
怎么做? |
| 陈小奚 回复于：2003-10-23 15:39:52 |
| 这样也太麻烦了点？而且查到了也还只是报告一下，倒不如加个antispam直接。 |
| gyns56 回复于：2003-10-23 16:02:54 |
| 看文章长见识，不顶对不起楼主，我顶！
另外，那位陈小奚网友可以讲讲antispam吗？ |
| hitdwb 回复于：2003-10-23 18:10:13 |
| 我也顶。写的好 |
| sunmarmot 回复于：2003-10-24 10:02:51 |
| 当然你也可以用antispam做咯，但只是做DENY，和在路由上面做是一个效果
Home | Programming Resources | * General FAQ* Home Page Builder 2.0* HTML for the Conceptually Challenged* The CareWare IdeaExcel 7.0 SpreadsheetsHome Page Builder 2.0 -- HelpInterlibrary Loan Request Form KitPerl / CGI Scripts, C++ ProgramsTCP/IP Utilities Version 2.0The Anti-Spam Home PageWhere did my files go?Whois Utility The Anti-Spam Home Page The spam problem is not going away, it's getting worse! Learn how to stop junk e-mail. -- P. Lutus -- Message Page -- Tired of wading through all that junk mail? Learn how to stop the spammers -- here are instructions to automatically filter your e-mail, defend your site from exploitation by the spammers, and get involved! Use these links to choose the section you are interested in: General discussion Definition of spam Rules of the spam game What to do if you are on a site that permits spam How to alert a site that they are hosting a spammer How to identify a Spammer Spam do's and don'ts Write your congressional representatives How to report fraudulent e-mail E-mail filtering techniques How to edit sendmail.cf How to filter e-mail addresses and sites How to stop e-mail forwarding on your site How to test the changes in sendmail The spammer master lists Credits Other anti-spam resources General Discussion Here are the facts: According to some estimates, there are 50 million Americans with Internet accounts. Nearly all accounts have e-mail service. It costs virtually nothing to send an e-mail. There is no meaningful regulation of e-mail. This is a recipe for exploitation, and you are the target. All an advertiser has to do is obtain your e-mail address – after that, he can spam you again and again. I recently received two "spam" e-mails. The first offered to put a phone sex telephone number on my site – "Your choice of Straight, Gay, or Fetish lines available" – the second offered to sell me a list of 25 million e-mail addresses. As I read these messages, it struck me that, unless I fought back, I would be daily forced to look into the human sewer that spam e-mail represents, and I would be just one among millions of victims. To say it in plain English, I am going to fight spam, and I hope you will join me -- let's take the Internet back from the sewer rats. Definition of Spam A "spam" e-mail is generally defined as an unsolicited mailing, usually to many people. A message written for, and mailed to, one individual that is known to the sender is not spam, and a reply to an e-mail is not spam, unless the "reply" repeats endlessly. Spam e-mailers have become a separate part of the Internet, with their own host computers, methods, and politics. Many Internet sites have begun to forbid spamming, for several reasons – one is a sense that it is unethical, another is that, over time, other Internet sites will stop all e-mail from that site and thus prevent legitimate e-mail from getting through. As a result, spammers have begun to set up their own Internet sites -- sites that cater to, or encourage, spamming. Rules of the Spam game Your goal as an Internet user is to figure out a way to separate legitimate e-mail from spam. There are several ways to do this. One way, described below, is to set up your mail service so that known spammers are not allowed to deposit mail in your account. This method relies on knowing (1) the return e-mail address of the spammer, or (2) the name of the spammer's host computer. The spammer's goal is to get around your filtering methods. He can do this by (1) using a different e-mail address for each mailing, or (2) he can forward his e-mail by way of an intermediary, to conceal the actual origin. The second of these methods is often used without the knowledge or permission of the intermediary, and it usually results from an error in configuration – I will show you how to protect your site from this exploitation. Because it is very easy to simply create a new return address for each of millions of e-mails, filtering by way of return address is only effective when dealing with small-scale, amateur spammers. As a result, many sites simply block all e-mail from a particular spammer-friendly site. What this means is, if you have an account with a site that also welcomes spammers, your e-mail will sometimes not get through. This is why Internet sites are gradually splitting into two classes -- those that welcome spammers and have no normal users, and those that aggressively stop spamming from their sites to protect their legitimate users. What to do if you are on a site that permits spam If your e-mail cannot be delivered to a site you write to, it may be that your host site has one or more spammers among its clients. If this happens to you, use this method: Use a friend's e-mail account to write the destination site and ask whether your host site has been blacklisted, and the reason. If your site has been blacklisted because of spam problems, write your own site's support address (usually support@yoursite.com or webmaster@yoursite.com  and demand that all spammers be thrown off the site.
If your service does not cooperate, change services . Canceling an account is one of the most powerful signals you can send -- a loss of revenue. This problem – blocking an entire site – is why legitimate sites will act to stop spamming if you bring it to their attention. It is also why spammers end up on sites that specialize in spamming, sites that will not listen to your complaints. So, before writing to complain, you need to discover which kind of site you are writing to. How to alert a site that they are hosting a spammer If you are writing to a legitimate site, they will usually have a special address ( abuse@sitename.com set up to deal with the problem. They may thank you for writing and ask for more information (such as the e-mail header, which shows the actual path the e-mail took through the Internet).
If you are writing to a spam-friendly site, chances are they will not write back, or they will reply with a justification of their practices, or (in some cases) they will simply place you address in their master list of victims (this happened to me). Be aware that, if the spammer is using forwarding, you may end up writing a complaint to an innocent Internet site that was exploited by the spammer. If this happens, you may want to alert that site that their e-mail server is configured incorrectly and should be reconfigured as shown below. How to identify a Spammer You can use my Whois Utility to find the spammer's actual identity. Simply look at the e-mail header, find the source host name (this may take practice because spammers try to hide the actual host name) or address and type it into the "Whois" utility. Or, if you are comfortable using a UNIX shell and have this kind of access, you can issue the Whois command from there. Do not rely on the e-mail's return address. This is much too easy to fake. The other information in the e-mail header is more useful and more likely to lead to the actual sender. Spam Do's and Dont's The primary rule: Never make lists of e-mail addresses, and if you do, do not e-mail the list. This is a common practice, especially among the relatively inexperienced. It happens like this -- Joe Beginner receives an interesting article and he immediately wants to mail it to all his friends -- but he does it by including all the addresses in a single posting. The problem? Each recipient gets a copy of all the addresses. Then one of Joe's friends forwards it to all his friends the same way. The address list becomes very large, and finally it falls into the hands of someone in the spam trade. Instead, Joe Beginner should mail a separate copy to each of his friends. The point is there should never be more than one address on an e-mail. Never respond to a spam e-mail. For a spammer, one "hit" among thousands of mailings is enough to justify the practice. Instead, if you want a product that is advertised in a spam e-mail, go to a Web site that also carries the product, inquire there, and tell them you do not approve of spam methods and will not patronize a company that uses spammers. Never respond to the spam e-mail's instructions to reply with the word "remove." This is just a trick to get you to react to the e-mail -- it alerts the sender that a human is at your address, which greatly increases its value. If you reply, your address is placed on more lists and you receive more spam. Never sign up with sites that promise to remove your name from spam lists. These sites are of two kinds: (1) sincere, and (2) spam address collectors. The first kind of site is ignored (or exploited) by the spammers, the second is owned by them -- in both cases your address is recorded and valued more highly because you have just identified it as read by a human. Never mail-bomb spam sites or engage in hacking to stop spammers. This only increases the amount of wasted Internet traffic, creates sympathy for spammers, and makes the Internet even less reliable than it already is. Take meaningful action to stop spammers. Filter their messages or their sites using the methods described below, write their host sites (without revealing your real e-mail address!) and any sites that are used as relays, write your congressional representatives. Write your congressional representatives In the long term, this approach may be the only effective one. Spammers will probably figure out a way around most of the direct, technical methods I describe here, so legislation may be required to stop them. You may not want to involve government in the Internet, because if one law is passed that regulates an aspect of the Internet, others may follow. I assure you, I understand and sympthize with this position, and there is always a risk in getting government involved in anything. But the spammers are already taking advantage of the methods of government, through lobbying for their own cause, taking advantage of loopholes in existing laws, and relying on governmental inertia and public apathy to help their cause. By getting involved, we send a signal to government that we won't stand to be abused as we have, and we also send a signal to companies that they will lose public approval if they use spammers to promote their products. Both are powerful reasons to write letters, make phone calls, and send faxes. If not us, then who, and if not now, when? Write your congressional representative -- click here. Write your state's senators -- click here. Write the Federal Trade Commission, demand action against spammers -- click here. How to report fraudulent e-mail Most spam is simply annoying, but some of it is illegal. One obvious category is an e-mail that asks you to send, say, $5 to several addresses in the letter, and promises big returns if you follow the letter's instructions -- this is called a "pyramid scheme" and it is illegal. There are many other kinds of illegal e-mail, too many to describe here. If you believe an e-mail is fraudulent, you should report it. Here are some addresses that accept fraud reports: FTC Spam Report e-mail address (uce@ftc.gov) The Federal Trade Commission Home Page The National Fraud Information Center A list of State Attorneys General + Agency List E-mail filtering techniques This technical procedure is (1) for the relatively experienced Internet user, and (2) applies to those servers running the sendmail server program. There are other kinds of servers and programs, but the majority of Internet sites are using some version of sendmail. If you are using a different type of server or software, click here . If you have not delved into UNIX, configuration files and so forth, you may want to enlist the help of someone with this kind of experience, or ask your Internet service provider for help. Also, many Internet users do not have control over their site's mail configuration. If you are in this situation, simply make your site administrators aware of your wishes and give them the address of this site. Here is the basic procedure: Locate sendmail.cf, the sendmail configuration file. Copy the original version to a safe location. Make the changes described below. Create /etc/spammers.txt, a list of e-mail addresses to be excluded from your server. Create /etc/spamdomains.txt, a list of host and domain sites to be excluded from your server. Create /etc/relaydomains.txt, a list of host and domain sites you want to permit relaying through your site (all others will be blocked). This file should be created, even if it has no entries. Put the new version of sendmail.cf in place. Test your mail service to be sure that you have not made an error that might disable e-mail on your site. The configuration file sendmail.cf is usually located in the /etc directory on your server. If your site is a virtual server, be sure to contact your site support service to be sure that you do not edit the system-wide sendmail.cf file, but only your own virtual server's file. How to edit sendmail.cf Load sendmail.cf into your favorite text editor. Locate the end of the options section, the point in the file that I have marked with the comment below: (previous file contents) ############# # Options # ############# Oa1 # Wait (in minutes) for alias file rebuild OA/etc/aliases # location of alias file OC10 # Checkpoint queue runs every N deliveries OF0600 # Temporary file mode Og100 # Default GID OH/etc/sendmail.hf # SMTP help file OI # Insist that the name server be running Ok5 # Open connection cache size Om # Expand aliases to include sender On # Verify RHS in newaliases OQ/usr/spool/mqueue # Queue directory OS/etc/sendmail.st # Stat file OT3d # Queue timeout and warning time Ou126 # Default UID Ot # Use TZ environment variable # > > > insert the check_mail code block below this comment <<< ################################# # Ruleset 0 - Resolve address # ################################# S0 R<@> $#local$:<> Null address is local (following file contents) Now that you have located the correct insertion point in sendmail.cf, you may choose to insert the first of the sections described below (check_mail). The second section (check_relay) must be placed at the end of the file. After you have made your insertion(s) and saved your changes, you should test sendmail by sending yourself an e-mail. Any syntax or other errors will prevent sendmail from operating correctly. If this test fails, you should replace your edited version of sendmail.cf with the original. How to filter e-mail addresses and sites Insert the following section into sendmail.cf at the point specified in How to edit sendmail.cf . This section provides the code for both the address method and the host method described in the next section. ##################################################################### # Ruleset check_mail - Stop Spammers (see http://www.vix.com/spam/) # ##################################################################### # spam site list files F{SpamDomains} /etc/spamdomains.txt F{Spammers} /etc/spammers.txt Scheck_mail R<$={Spammers}> $#error $@ 4.7.1 $: "471 We don't accept junk mail" R$={Spammers} $#error $@ 4.7.1 $: "471 We don't accept junk mail" R$* $: $>3 $1 R$*<@$*$={SpamDomains}.>$* $#error $@ 4.7.1 $: "471 We don't accept junk mail from your domain" R$*<@$*$={SpamDomains}>$* $#error $@ 4.7.1 $: "471 We don't accept junk mail from your domain" R$* $@ ok R$* $#error $@ 4.1.8 $: "418 can't resolve your name, check your DNS" To capture this code, simply drag your mouse across it and place it in your text editor. If you cannot do this, click here. Create a text file named /etc/spammers.txt (see The spammer master lists for a current list). Put one or more e-mail addresses in the file, each on a separate line. Example: company1@spamsite.com company2@spamsite.com This method only filters particular addresses -- a determined spammer will not be stopped by this approach. It is too easy to simply create another e-mail address. Create a text file named /etc/spamdomains.txt (see The spammer master lists for a current list). Put one or more host and domain names in this file, each on a separate line. Example: spammer.spamsite1.com spamsite2.com The first example above stops all e-mail from the host site "spammer.spamsite1.com." The second example stops all e-mail from the entire domain "spamsite2.com." The check_mail code accepts both kind of entries, depending on your wishes -- you may want to stop a particular host, or all e-mail from an entire spammer-friendly domain. Stopping all e-mail from a host or domain is more powerful than the e-mail address method -- it eliminates e-mail from an entire site, but at the risk of blocking legitimate e-mail. If you receive a complaint from a legitimate user of that site that they cannot e-mail you, just explain that their site permits spamming and ask them to write their site's administrators to correct the problem at the source. How to stop e-mail forwarding on your site This method will prevent an unscrupulous spammer from concealing his true identity by forwarding e-mail through your site. It will also keep you from being misidentified as a spammer. Insert the following section into sendmail.cf at the end of the file as described in How to edit sendmail.cf . This section provides code to verify that e-mails are either beginning or ending their journey at your site, and blocks all others. ############################################################## # Ruleset check_rcpt - Shutdown relaying through this server # ############################################################## # dequoting map - Needed for SPAM hack below Kdequote dequote # permitted relay sites file F{RelayOK} -o /etc/relaydomains.txt Scheck_rcpt # anything terminating locally is ok R<$+ @ $=w > $@ OK R<$+ @ $* $={RelayOK} > $@ OK # anything originating locally is ok R$* $: $(dequote "" $&{client_name} $) R$=w $@ OK R$* $={RelayOK} $@ OK R$@ $@ OK # anything else is bogus R$* $#error $: "550 Relaying Denied" To capture this code, simply drag your mouse across it and place it in your text editor. If you cannot do this, click here. Precautions about blocking forwarding: If you want to permit some sites to forward e-mail by way of your site, you must add their host or domain names to a text file named /etc/relaydomains.txt. Create this file if necessary. This code segment, like the previous one, accepts both host (host.sitename.com) and domain (sitename.com) names. With some e-mail clients, this code segment may prevent you from sending mail to other sites. If it does, use this procedure: If you are accessing your Web server from a separate site, add the host or domain name of that site to /etc/relaydomains.txt and test again. If this test fails, simply remove this code segment from your sendmail.cf file. Don't forget to create a file named /etc/relaydomains.txt, even if it is empty. Enter the names of any sites you want to permit relaying through your site, as well as any sites you use to access your server. How to test the changes in sendmail Send yourself an e-mail. If sendmail is working, you will receive the message. Edit your e-mail client configuration -- temporarily change your return e-mail address to that of a spammer that appears in your /etc/spammers.txt file (or temporarily enter your own return address in /etc/spammers.txt). Now send yourself another e-mail. This e-mail should be blocked. Remember to put back your correct return e-mail address. If your Web server and your internet access service have separate domain names, you must put the domain name of your access service in /etc/relaydomains.txt in order to be able to send e-mail. Be sure to make this entry and test your ability to send e-mail. There is no easy way to test the /etc/spamdomains.txt file and code. The hard way is to temporarily enter the name of a site you have access to, and e-mail yourself from there. If all is well, this e-mail test will fail. Remember to remove the temporary entry from /etc/spamsites.txt. The spammer master lists Here are current copies of the spammer lists from www.arachnoid.com. These are names of sites that have sent one or more unsolicited commercial mailings to www.arachnoid.com or another reputable source for spam site names. You will certainly have to add to these lists as time passes, because well-heeled spammers will simply purchase new domain names to stay ahead of this blocking technique. spammers.txt -- e-mail addresses of known spammers spamdomains.txt -- host and domain names of sites that permit spammers Credits I am indebted to the people at the Sendmail Home Page for their assistance with this code. I would never have gotten it to work correctly without their help (because sendmail uses its own, private language). Other anti-spam resources Here are some other Internet sites that are involved in this issue: Fight Spam on the Internet! -- many resources and links to sites, including more technical details of filtering on more platforms than I have covered here. The Coalition Against Unsolicited Commercial Email -- an organization that is fighting spam. These Pages Created and Maintained using Arachnophilia. Main Page Home | Programming Resources | * General FAQ* Home Page Builder 2.0* HTML for the Conceptually Challenged* The CareWare IdeaExcel 7.0 SpreadsheetsHome Page Builder 2.0 -- HelpInterlibrary Loan Request Form KitPerl / CGI Scripts, C++ ProgramsTCP/IP Utilities Version 2.0The Anti-Spam Home PageWhere did my files go?Whois Utility |
| gyns56 回复于：2003-10-24 11:49:30 |
| 楼主很强呀，文章我收了，谢了。
希望楼主再发好文！ |
| msscisd 回复于：2003-10-24 12:09:10 |
| 长见识,thank u |
延伸阅读
文章来源于领测软件测试网 https://www.ltesting.net/