On my logs things are crazy, this is a sample of what I see:
Code: Select all
Dec 21 10:43:58 filtro MailScanner[31637]: Virus Scanning: Denial Of Service attack detected!
Dec 21 10:44:01 filtro MailScanner[32217]: Virus Scanning: Denial Of Service attack detected!
Dec 21 10:46:59 filtro MailScanner[31637]: Unpacking 7zip archive: nmsg-31637-71.txt
Dec 21 10:46:59 filtro MailScanner[32217]: Unpacking 7zip archive: nmsg-32217-67.txt
Dec 21 10:46:59 filtro MailScanner[32217]: Unpacking 7zip archive: nmsg-32217-64.txt
Dec 21 10:46:59 filtro MailScanner[31637]: Unpacking 7zip archive: nmsg-31637-77.txt
Dec 21 10:46:59 filtro MailScanner[31656]: Unpacking 7zip archive: nmsg-31656-69.txt
Dec 21 10:46:59 filtro MailScanner[31656]: Unpacking 7zip archive: nmsg-31656-73.txt
Dec 21 10:47:00 filtro MailScanner[31656]: Unpacking 7zip archive: nmsg-31656-78.txt
Dec 21 10:47:00 filtro MailScanner[31656]: Unpacking 7zip archive: nmsg-31656-81.txt
Dec 21 10:47:01 filtro MailScanner[31637]: Unpacking 7zip archive: nmsg-31637-100.txt
Dec 21 10:47:01 filtro MailScanner[31637]: Unpacking 7zip archive: nmsg-31637-102.txt
Dec 21 10:47:01 filtro MailScanner[31637]: Unpacking 7zip archive: nmsg-31637-106.txt
Dec 21 10:47:01 filtro MailScanner[31656]: Unpacking 7zip archive: nmsg-31656-90.txt
Dec 21 10:47:01 filtro MailScanner[31656]: Unpacking 7zip archive: nmsg-31656-94.txt
Dec 21 10:47:02 filtro MailScanner[31656]: Unpacking 7zip archive: nmsg-31656-98.txt
Code: Select all
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF90qh8z6Y78: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF90qh8z6Y78 for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF91WgQz6Y6q: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF91WgQz6Y6q for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF922VZz6Y7F: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF922VZz6Y7F for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF92gCMz6Y6X: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF92gCMz6Y6X for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF92h3jz1qNr: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF92h3jz1qNr for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF92kfvz6Y73: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF92kfvz6Y73 for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF935Ycz6Y7H: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF935Ycz6Y7H for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF93GYFz6Y6v: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF93GYFz6Y6v for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF95B4Yz1qNp: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF95B4Yz1qNp for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxF95F7Pz6Y6x: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxF95F7Pz6Y6x for relaying, will try again later
Dec 21 11:55:01 filtro MailScanner[26468]: Could not open file +</var/spool/MailScanner/milterout/4CzxFB07KSz6Y6l: No such file or directory
Dec 21 11:55:01 filtro MailScanner[26468]: Cannot open /var/spool/MailScanner/milterout/4CzxFB07KSz6Y6l for relaying, will try again later
Code: Select all
[host]# grep "4CzvF14vS4z66Qk" /var/log/maillog
Dec 21 10:24:37 filtro MailScanner[1770]: Requeue: 4Czv0N2KY7z2xS5S to 4CzvF14vS4z66Qk
Dec 21 10:24:43 filtro MailScanner[4354]: Could not open file +</var/spool/MailScanner/milterout/4CzvF14vS4z66Qk: No such file or directory
Dec 21 10:24:43 filtro MailScanner[4354]: Cannot open /var/spool/MailScanner/milterout/4CzvF14vS4z66Qk for relaying, will try again later
Code: Select all
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/14575/4Czvnw4Lpgz2WxWD.message
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/14575/4CzthQ29GCz2vkdY.message
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/14575/4Czvgb4g1Gz2WxWD.message
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/14575/4Czvnc6pBmz2vkdK.message
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/14575/4Czvfn0rH7z36lkG.message
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/14575/4Czvn24c6mz31YC5.message
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/14575/4Czvtp1KnXz31YCp.message
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/14575/4Cztl13DVpz2vkdT.message
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/14575/4Czthx4870z2vkdT.message
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/15224/4CzvmL3SV6z2WxWD.header
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/15224/4Czvhj2Zq1z2vkdP.header
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/15224/4Czvhm0bsrz2vkdK.header
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/15224/4Czvmf114Hz2vkdK.header
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/15224/4Czvj44DdHz2vkdT.header
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/15224/4CzvjB2mTtz2vkdT.header
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/15224/4Czvmh3qXLz366Qj.header
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/15224/4CzvjM06n5z2vkdK.header
WARNING: Failed to determine real path for: /var/spool/MailScanner/incoming/15224/4CzvjQ0sjWz2vkdK.header
I am reading that this could be a zip-bomb, I am not shure about this and I am now shure how to protect me from this attack.
Any help would be apreciated.