[postfix-jp:634] SPAM の踏み台にされた？

[Hideki -Henrich- Yamane <henrich@xxxxxxxxxxxxx>]

　やまねと申します。

　久々にサーバのmailqを見てみたら大量のメールが溜まっていてびっくり
　しました。差出人はhotmailのアカウント、宛先は１つのドメインに大量
　のユーザーという内容で、SPAMに使われているのではないか？と慌てて
　おります。ただ、どうやって判断したらいいのか、自分の経験と知識で
　は分別が付かないため、皆さんにお知恵を拝借しようと思いお尋ねする
　ことにしました。

　この様な場合、SPAMに使われているかどうかなど、どうやって判断したら
　いいのでしょうか？

---------------------------------------------------------------------

　このサーバの設定は以下のようになっています。

# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
debug_peer_level = 2
home_mailbox = Maildir/
inet_interfaces = all
mail_owner = postfix
message_size_limit = 102400000
mydestination = $myhostname, localhost.$mydomain
mydomain = xxx.com
myhostname = mail.xxx.com
mynetworks = 10.1.2.0/24, 127.0.0.0/8
myorigin = $mydomain
queue_directory = /var/spool/postfix
relay_domains = 
$mydestination,$virtual_maps,xxx.co.jp,xxx.net,xxx2.com,xxx2.net
smtpd_client_restrictions = permit_mynetworks, check_client_access hash:/etc/postfix/client_access
transport_maps = hash:/etc/postfix/relay



---------------------------------------------------------------------

　サーバは、とりあえずネットワークから引っこ抜き、mailqのリストを念
　のためにファイルに落とし、activesの中にあったファイルをコピーした
　上で消去してqueueを空にしました。

　/var/log/mail.logなどを参照すると、ここ数日で上記のようなメールが
　来ていたのが判りました。（逆に言うとそれまで気付きませんでした(--;

　＃以前にリレーのチェックをして大丈夫だったので…

　
　で、リレーのチェックを再度しようと思い、

　http://www.abuse.net/relay.html
　http://www.nanet.co.jp/rlytest/relaytest.html
　http://www.kyoto.wide.ad.jp/mta/relaycheck.html

　などを試しましたが、全てクリアしました。



　一応、怪しげだなーと思った部分のログを添付いたします。
　とんちんかんなことをやってるかも知れませんが、ご容赦下さい。


　何かお気づきの点があれば、アドバイス願います。
----------------------------------------------------------------
「夜明けの夢に　聞こえる声
  覚めては　うたかたの       Hideki -Henrich- Yamane
  あれは比翼の鳥の声」         henrich@xxxxxxxxxxxxx
                               y@xxxxxxxxxx(or henrich@xxxxxxxxx)

Apr  5 15:04:43 XXX postfix/smtpd[30451]: connect from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]
Apr  5 15:04:48 XXX postfix/smtpd[30451]: 6F5849BB64: client=slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]
Apr  5 15:04:49 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <dfowler@cac.
net>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<dfowler@xxxxxxx>
Apr  5 15:04:54 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <mxyap@xxxxxx
t>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<mxyap@xxxxxxx>
Apr  5 15:04:59 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <morbious@cac
.net>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<morbious@xxxxxxx>
Apr  5 15:05:04 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <phurry@xxxxx
et>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<phurry@xxxxxxx>
Apr  5 15:05:09 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <ldafoe@cari.
net>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<ldafoe@xxxxxxxx>
Apr  5 15:05:14 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <kingram@cari
.net>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<kingram@xxxxxxxx>
Apr  5 15:05:19 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <jspaffor@cac
.net>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<jspaffor@xxxxxxx>
Apr  5 15:05:24 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <epi@xxxxxxxx
>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<epi@xxxxxxxx>
Apr  5 15:05:29 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <governor@cac
.net>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<governor@xxxxxxx>
Apr  5 15:05:34 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <eric_jones@c
ari.net>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<eric_jones@xxxxxxxx>
Apr  5 15:05:39 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <deh@xxxxxxx>
: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<deh@xxxxxxx>
Apr  5 15:05:44 XXX postfix/smtpd[30451]: reject: RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]: 554 <mleon@xxxxxx
t>: Recipient address rejected: Relay access denied; from=<benedict_tisa@xxxxxxxxxxx> to=<mleon@xxxxxxx>
Apr  5 15:06:19 XXX postfix/smtpd[30451]: lost connection after RCPT from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]
Apr  5 15:06:19 XXX postfix/smtpd[30451]: disconnect from slip-32-102-75-107.wi.us.prserv.net[32.102.75.107]
Apr  5 15:08:32 XXX postfix/smtpd[30453]: connect from slip-32-102-75-85.wi.us.prserv.net[32.102.75.85]
Apr  5 15:08:35 XXX postfix/smtpd[30453]: C6A629BB64: client=slip-32-102-75-85.wi.us.prserv.net[32.102.75.85]
Apr  5 15:08:44 XXX postfix/cleanup[30454]: C6A629BB64: message-id=<0000200b7b6e$00001c01$000073f9@xxxxxxxxxxxx>
Apr  5 15:08:44 XXX postfix/qmgr[253]: C6A629BB64: from=<bearshield@xxxxxxxxxxx>, size=1353 (queue active)
Apr  5 15:08:45 XXX postfix/smtpd[30453]: 99C809BB7C: client=slip-32-102-75-85.wi.us.prserv.net[32.102.75.85]
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<boggie6@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<boglisa@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bonesandrules@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=
11, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bonghitterz@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11
, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bonnielo@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, s
tatus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<boodahahah@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
 status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<boomer691@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<boomshnkr@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<botaedo@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bourdin_kirill@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay
=11, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<boxersrthebest@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay
=11, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<boytroi@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bp29@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, statu
s=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bratpack@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, s
tatus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<breezy127@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brenda_lall@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11
, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brendakays@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
 status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brendo2@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brentmarcus@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11
, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bretarna@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, s
tatus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brethauser@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
 status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brett_nolan@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11
, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brettbk1@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, s
tatus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brianna23f@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
 status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brianstout@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
 status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brianuvtx@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brianwnuss@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
 status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<briguy71@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, s
tatus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brimstoneman66@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay
=11, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brittercritter@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay
=11, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brittylee@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brlinhart@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brlracer2@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brmisty@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bro_123@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brocknieves@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11
, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brokepimp@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<broodsbroad@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11
, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brookerin1011@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=
11, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brooklynbryant@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay
=11, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<broopl@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, sta
tus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brs2086@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brucecp@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bruto29@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, st
atus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<brwinter@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11, s
tatus=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bryancool27@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11
, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bryangates99@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=1
1, status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:46 XXX postfix/smtp[30456]: C6A629BB64: to=<bsalatino@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.69.53], delay=11,
status=sent (250 ok Wed Apr  4 23:08:46 2001:  ql 768903, qr 0)
Apr  5 15:08:54 XXX postfix/cleanup[30454]: 99C809BB7C: message-id=<000044024c60$000067cf$00007427@>
Apr  5 15:08:54 XXX postfix/qmgr[253]: 99C809BB7C: from=<bearskittykat@xxxxxxxxxxx>, size=1344 (queue active)
Apr  5 15:08:56 XXX postfix/smtpd[30453]: 8F84B9BB7D: client=slip-32-102-75-85.wi.us.prserv.net[32.102.75.85]
Apr  5 15:09:00 XXX postfix/smtp[30457]: 99C809BB7C: to=<bonedog63@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.22.89], delay=15,
status=sent (250 ok Wed Apr  4 23:08:59 2001:  ql 861490, qr 0)
Apr  5 15:09:00 XXX postfix/smtp[30457]: 99C809BB7C: to=<boner35@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.22.89], delay=15, st
atus=sent (250 ok Wed Apr  4 23:08:59 2001:  ql 861490, qr 0)
Apr  5 15:09:00 XXX postfix/smtp[30457]: 99C809BB7C: to=<bonnie_leib@xxxxxxxxx>, relay=mx3.mail.yahoo.com[128.11.22.89], delay=15
, status=sent (250 ok Wed Apr  4 23:08:59 2001:  ql 861490, qr 0)