authlog ständige sql transaktionen

TimSch · 3. Februar 2013

Hallo,

ich habe folgendes im Authlog gefunden. Die Sachen werden seit einiger Zeit bei
mir durchgeführt, muss ich mir Sorgen machen? ich kann damit leider nicht
wirklich was anfangen (ich verstehe die Befehle, aber nicht die Herkunft und
den Grund) von mir kommt das jedenfalls nicht.

Code

Feb  3 03:36:47
xxxxx postfix/smtpd[9132]: sql plugin trying to open db 'froxlor' on host
'127.0.0.1'




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin Parse the username
manager@xxxxxx.yourvserver.net




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin try and connect to a
host




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin trying to open db
'froxlor' on host '127.0.0.1'




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin Parse the username
manager@xxxxxx.yourvserver.net




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin try and connect to a
host




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin trying to open db
'froxlor' on host '127.0.0.1'




Feb  3 03:36:47 xxx postfix/smtpd[9132]: begin transaction




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin create statement from
userPassword manager xxxxx.yourvserver.net




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin doing query SELECT
password FROM mail_users WHERE username="manager@xxxx.your$




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin: no result found




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin create statement from
cmusaslsecretPLAIN manager xxxxx.yourvserver.net




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin doing query SELECT
password FROM mail_users WHERE username="manager@xxxx.your$




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin: no result found




Feb  3 03:36:47 xxx postfix/smtpd[9132]: commit transaction




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin Parse the username
manager@xxxxx.yourvserver.net




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin try and connect to a
host




Feb  3 03:36:47 xxx postfix/smtpd[9132]: sql plugin trying to open db
'froxlor' on host '127.0.0.1'




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin Parse the username
manager@xxxxx.yourvserver.net




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin try and connect to a
host




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin trying to open db
'froxlor' on host '127.0.0.1'




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin Parse the username
manager@xxxx.yourvserver.net




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin try and connect to a
host




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin trying to open db
'froxlor' on host '127.0.0.1'




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin Parse the username
manager@xxxx.yourvserver.net




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin try and connect to a
host




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin trying to open db
'froxlor' on host '127.0.0.1'




Feb  3 03:37:05 xxx postfix/smtpd[9132]: begin transaction




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin create statement from
userPassword manager xxxx.yourvserver.net




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin doing query SELECT
password FROM mail_users WHERE username="manager@xxxxx.your$




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin: no result found




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin create statement from
cmusaslsecretPLAIN manager xxxx.yourvserver.net




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin doing query SELECT
password FROM mail_users WHERE username="manager@xxxxx.your$




Feb  3 03:37:05 xxx postfix/smtpd[9132]: sql plugin: no result found




Feb  3 03:37:05 xxx postfix/smtpd[9132]: commit transaction

Alles anzeigen

[/code]

vielen Dank
Akhanto

___ · 3. Februar 2013

In mail.log stehen die auslösenden Login-Versuche.

TimSch · 3. Februar 2013

Hier der mail.log aus fraglicher Zeit

Code

Feb  3 03:36:31 xxxxxpostfix/smtpd[9132]: connect from rrcs-24-199-42-34.west.biz.rr.com[24.199.42.34]
Feb  3 03:36:32 xxxxxpostfix/smtpd[9132]: warning: rrcs-24-199-42-34.west.biz.rr.com[24.199.42.34]: SASL LOGIN authentication failed: authentic$
Feb  3 03:36:43 xxxxpostfix/smtpd[9132]: warning: rrcs-24-199-42-34.west.biz.rr.com[24.199.42.34]: SASL LOGIN authentication failed: authentic$
Feb  3 03:36:44 xxxxxpostfix/smtpd[9132]: warning: rrcs-24-199-42-34.west.biz.rr.com[24.199.42.34]: SASL LOGIN authentication failed: authentic$
Feb  3 03:36:44 xxxxxpostfix/smtpd[9132]: warning: rrcs-24-199-42-34.west.biz.rr.com[24.199.42.34]: SASL LOGIN authentication failed: authentic$
Feb  3 03:36:44 xxxxxpostfix/smtpd[9132]: warning: rrcs-24-199-42-34.west.biz.rr.com[24.199.42.34]: SASL LOGIN authentication failed: authentic$
Feb  3 03:36:47 xxxxxpostfix/smtpd[9132]: warning: rrcs-24-199-42-34.west.biz.rr.com[24.199.42.34]: SASL LOGIN authentication failed: authentic$
Feb  3 03:37:05 xxxxxpostfix/smtpd[9132]: warning: rrcs-24-199-42-34.west.biz.rr.com[24.199.42.34]: SASL LOGIN authentication failed: authentic$
Feb  3 03:37:06 xxxxxpostfix/smtpd[9132]: disconnect from rrcs-24-199-42-34.west.biz.rr.com[24.199.42.34]
Feb  3 03:40:26 xxxxxpostfix/anvil[9138]: statistics: max connection rate 1/60s for (smtp:24.199.42.34) at Feb  3 03:36:31
Feb  3 03:40:26 xxxxxpostfix/anvil[9138]: statistics: max connection count 1 for (smtp:24.199.42.34) at Feb  3 03:36:31

Alles anzeigen

scheinbar tatsächlich merkwürdig:
24.199.42.34 | Mail Server | IP Address Inspector | Project Honey Pot

was kann ich tun außer die IP in die Firewall einzutragen?

vielen Dank
Akhanto

Marcoo · 3. Februar 2013

Hallo.

Auf jedem Server erfolgen Angriffe bzw. wird versucht auf diesen zuzugreifen. Keine Sorge!

Versuch es mal mit fail2ban. Achtung! Du musst ggf. fail2ban anpassen, da iptables bei Linux-vServer nicht funktioniert.

LG

TimSch · 6. Februar 2013

Vielen Dank Leute!
Habe es soweit zum Laufen bekommen, mittlerweile habe ich auch die ganzen Jails verstanden.

LG
Akhanto