{"id":73,"date":"2015-05-12T08:36:43","date_gmt":"2015-05-12T08:36:43","guid":{"rendered":"http:\/\/www.smtp-server.net\/?p=73"},"modified":"2015-05-04T20:34:51","modified_gmt":"2015-05-04T20:34:51","slug":"smtp-autentizace-jednoduche-kroky-k-zamezeni-utoku-typu-smtp-authentication-relay-a-k-identifikaci-napadeneho-e-mailoveho-uctu-v-postfixu","status":"publish","type":"post","link":"https:\/\/www.smtp-server.net\/cs\/smtp-autentizace-jednoduche-kroky-k-zamezeni-utoku-typu-smtp-authentication-relay-a-k-identifikaci-napadeneho-e-mailoveho-uctu-v-postfixu\/","title":{"rendered":"Auth SMTP - Snadn\u00e9 kroky k zastaven\u00ed \u00fatoku SMTP AUTH Relay a identifikaci kompromitovan\u00e9ho e-mailov\u00e9ho \u00fa\u010dtu pro Postfix"},"content":{"rendered":"
https:\/\/youtube.com\/watch?v=IaGV9l_3xZM<\/div>\n

Dnes je mnoho e-mailov\u00fdch aplikac\u00ed, jako je Sendmail, Postfix nebo dokonce MS Exchange, p\u0159epracov\u00e1no tak, aby se sn\u00ed\u017eila mo\u017enost, \u017ee se stanou \u2018spam-relay\u2019. Podle na\u0161ich zku\u0161enost\u00ed je v\u011bt\u0161ina \u00fatok\u016f SMTP AUTH relay zp\u016fsobena kompromitac\u00ed slab\u011b zaheslovan\u00fdch u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f. Jakmile jsou \u00fa\u010dty objeveny a kompromitov\u00e1ny. Spamme\u0159i se ov\u011b\u0159\u00ed pomoc\u00ed u\u017eivatelsk\u00fdch pov\u011b\u0159en\u00ed, je jim umo\u017en\u011bno relay prost\u0159ednictv\u00edm serveru, kter\u00fd je n\u00e1sledn\u011b vyu\u017eit k rozes\u00edl\u00e1n\u00ed spamu.<\/p>\n

<\/p>\n

N\u00ed\u017ee uv\u00e1d\u00edme jednoduch\u00e9 kroky, jak tyto spamov\u00e9 e-maily rychle zastavit a zjistit, kter\u00fd \u00fa\u010det (nebo \u00fa\u010dty) byl napaden.<\/p>\n

Krok 1: Zastavit frontu e-mail\u016f v re\u017eimu \u010dek\u00e1n\u00ed<\/strong>.<\/p>\n

Velk\u00e9 mno\u017estv\u00ed spamov\u00fdch e-mail\u016f neust\u00e1le zahlcuje va\u0161i po\u0161tovn\u00ed frontu. Je\u0161t\u011b hor\u0161\u00ed je, \u017ee ve\u0161ker\u00fd tento spam zapl\u0148uje cel\u00fd v\u00e1\u0161 adres\u00e1\u0159 \/var. Proto je v\u017edy vhodn\u00e9 do\u010dasn\u011b pozastavit po\u0161tovn\u00ed frontu, dokud nezjist\u00edte, kter\u00fd \u00fa\u010det byl zneu\u017eit spammerem a odes\u00edl\u00e1 velk\u00e9 mno\u017estv\u00ed e-mail\u016f.<\/p>\n

Krok 2: Zkontrolujte si protokol e-mail\u016f.<\/strong><\/p>\n

P\u0159ejd\u011bte do adres\u00e1\u0159e \/var\/log\/maillog a rychle se pod\u00edvejte na \u0159\u00e1dek s pol\u00ed\u010dkem \u201efrom:\u201c. Mo\u017en\u00e1 tam uvid\u00edte spoustu e-mailov\u00fdch dom\u00e9n, kter\u00e9 nepat\u0159\u00ed k va\u0161\u00ed organizaci. Je to zp\u016fsobeno t\u00edm, \u017ee spammer fal\u0161uje pole \u201efrom:\u201c.<\/p>\n

Krok 3: Identifikace napaden\u00e9ho \u00fa\u010dtu p\u0159i ov\u011b\u0159ov\u00e1n\u00ed p\u0159ipojen\u00ed pomoc\u00ed SMTP AUTH<\/strong><\/p>\n

Nyn\u00ed zkontrolujeme e-mailov\u00e9 \u00fa\u010dty, kter\u00e9 byly napadeny. Spus\u0165te p\u0159\u00edkaz `have cat grep sasl_username` a v\u00fdsledek se\u0159a\u010fte. M\u011bl by se zobrazit dlouh\u00fd seznam pokus\u016f o p\u0159ihl\u00e1\u0161en\u00ed a relac\u00ed u t\u011bchto napaden\u00fdch \u00fa\u010dt\u016f. M\u016f\u017eete tak\u00e9 prov\u00e9st rychl\u00fd v\u00fdpo\u010det pomoc\u00ed p\u0159\u00edkazu `wc -l`, abyste zjistili celkov\u00fd po\u010det relac\u00ed u konkr\u00e9tn\u00edho u\u017eivatele.<\/p>\n

Krok 4: Deaktivujte napaden\u00fd e-mailov\u00fd \u00fa\u010det.<\/strong><\/p>\n

Jakmile m\u00e1me \u0159et\u011bzec SASL_username, kter\u00fd p\u0159edstavuje u\u017eivatelsk\u00fd \u00fa\u010det, doporu\u010dujeme v\u00e1m heslo deaktivovat nebo jej zm\u011bnit na slo\u017eit\u00e9 heslo.<\/p>\n

Krok 5: P\u0159esu\u0148te frontu e-mail\u016f nebo sma\u017ete spamov\u00fd e-mail<\/strong><\/p>\n

Te\u010f se mus\u00edme vypo\u0159\u00e1dat s frontou e-mail\u016f. Nejjednodu\u0161\u0161\u00ed a nejrychlej\u0161\u00ed zp\u016fsob je p\u0159esunout frontu e-mail\u016f a \u00faklid prov\u00e9st a\u017e pozd\u011bji. Nebo m\u016f\u017eete tyto spamov\u00e9 e-maily smazat pomoc\u00ed skriptu v Bashu.<\/p>\n

Krok 6: Uvoln\u011bn\u00ed fronty e-mail\u016f<\/strong><\/p>\n

Nezapome\u0148te po dokon\u010den\u00ed \u00fadr\u017ebov\u00e9ho procesu uvolnit frontu e-mail\u016f a nad\u00e1le sledovat e-mailov\u00fd provoz.<\/p>","protected":false},"excerpt":{"rendered":"

Today lots of the email application such as Sendmail, Postfix, or even MS Exchange has been re-designed to reduce the possibility of become an ‘spam-relay’. From our experience, most of the SMTP AUTH relay attack is caused by the compromised of the weakly password protected user accounts. Once the accounts discovered and been compromised. Spammer Read more about Auth SMTP – Easy Steps to Stop SMTP AUTH Relay Attack and Identify Compromised Email Account for Postfix<\/span>[…]<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-73","post","type-post","status-publish","format-standard","hentry","category-smtp-servers"],"_links":{"self":[{"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/posts\/73","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/comments?post=73"}],"version-history":[{"count":1,"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/posts\/73\/revisions"}],"predecessor-version":[{"id":74,"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/posts\/73\/revisions\/74"}],"wp:attachment":[{"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/media?parent=73"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/categories?post=73"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.smtp-server.net\/cs\/wp-json\/wp\/v2\/tags?post=73"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}