Как вычислить гадость на сервере (в логах видна отсылка емеила с моего сервера)

[isprov]

Привет .

Анализируя логи сервера (выход в интернет на нём закрыт), столкнулся со следующей ситуацией - заметил в почте рута следующие строки:

From MAILER-DAEMON@localhost.localdomain Tue Apr 8 23:27:18 2008
Return-Path: <MAILER-DAEMON@localhost.localdomain>
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
by localhost.localdomain (8.13.1/8.13.1) with ESMTP id m4270
for <root@localhost.localdomain>; Tue, 8 Apr 2008 23:27:18 +0400
Received: from localhost (localhost)
by localhost.localdomain (8.13.1/8.13.1/Submit) id m38J;
Tue, 8 Apr 2008 23:27:18 +0400
Date: Tue, 8 Apr 2008 23:27:18 +0400
From: Mail Delivery Subsystem <MAILER-DAEMON@localhost.localdomain>
Message-Id: <200804081927.m38J@localhost.localdomain>
To: root@localhost.localdomain
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="m38J/localhost.localdomain"
Content-Transfer-Encoding: 8bit
Subject: Warning: could not send message for past 4 hours
Auto-Submitted: auto-generated (warning-timeout)

This is a MIME-encapsulated message

--m38J/localhost.localdomain

**********************************************
** THIS IS A WARNING MESSAGE ONLY **
** YOU DO NOT NEED TO RESEND YOUR MESSAGE **
**********************************************

The original message was received at Tue, 8 Apr 2008 19:24:39 +0400
from root@localhost

----- Transcript of session follows -----
451 yahoo.com: Name server timeout
Warning: message still undelivered after 4 hours
Will keep trying until message is 5 days old

--m38J/localhost.localdomain
Content-Type: message/delivery-status

Reporting-MTA: dns; localhost.localdomain
Arrival-Date: Tue, 8 Apr 2008 19:24:39 +0400

Final-Recipient: RFC822; inconjito@yahoo.com
Action: delayed
Status: 4.4.3
Last-Attempt-Date: Tue, 8 Apr 2008 23:27:18 +0400
Will-Retry-Until: Sun, 13 Apr 2008 19:24:39 +0400

--m38J/localhost.localdomain
Content-Type: message/rfc822
Content-Transfer-Encoding: 8bit

Return-Path: <root>
Received: (from root@localhost)
by localhost.localdomain (8.13.1/8.13.1/Submit) id m38F
for inconjito@yahoo.com; Tue, 8 Apr 2008 19:24:39 +0400
Date: Tue, 8 Apr 2008 19:24:39 +0400
From: root <root>
Message-Id: <200804081524.m38F@localhost.localdomain>
To: inconjito@yahoo.com
Subject: back

Втр Апр 8 19:24:39 MSD 2008
-rw-r--r-- 1 root root 11 РђРїСЂ 8 19:22 tcp.log
----------------------------------------------------------------------
----------------------------------------------------------------------
Втр Апр 8 19:24:39 MSD 2008
-------------------------------------------------------------------EOF

Т.е. какая то байда на моём сервере пытается отослать письмо на inconjito@yahoo.com , причём я так понимаю не простое письмо ...
Как мне правильно найти и удалить это "г" с сервера ?

[Kataklysm]

Привет .

Анализируя логи сервера (выход в интернет на нём закрыт), столкнулся со следующей ситуацией - заметил в почте рута следующие строки:

From MAILER-DAEMON@localhost.localdomain Tue Apr 8 23:27:18 2008
Return-Path: <MAILER-DAEMON@localhost.localdomain>
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
by localhost.localdomain (8.13.1/8.13.1) with ESMTP id m4270
for <root@localhost.localdomain>; Tue, 8 Apr 2008 23:27:18 +0400
Received: from localhost (localhost)
by localhost.localdomain (8.13.1/8.13.1/Submit) id m38J;
Tue, 8 Apr 2008 23:27:18 +0400
Date: Tue, 8 Apr 2008 23:27:18 +0400
From: Mail Delivery Subsystem <MAILER-DAEMON@localhost.localdomain>
Message-Id: <200804081927.m38J@localhost.localdomain>
To: root@localhost.localdomain
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="m38J/localhost.localdomain"
Content-Transfer-Encoding: 8bit
Subject: Warning: could not send message for past 4 hours
Auto-Submitted: auto-generated (warning-timeout)

This is a MIME-encapsulated message

--m38J/localhost.localdomain

**********************************************
** THIS IS A WARNING MESSAGE ONLY **
** YOU DO NOT NEED TO RESEND YOUR MESSAGE **
**********************************************

The original message was received at Tue, 8 Apr 2008 19:24:39 +0400
from root@localhost

----- Transcript of session follows -----
451 yahoo.com: Name server timeout
Warning: message still undelivered after 4 hours
Will keep trying until message is 5 days old

--m38J/localhost.localdomain
Content-Type: message/delivery-status

Reporting-MTA: dns; localhost.localdomain
Arrival-Date: Tue, 8 Apr 2008 19:24:39 +0400

Final-Recipient: RFC822; inconjito@yahoo.com
Action: delayed
Status: 4.4.3
Last-Attempt-Date: Tue, 8 Apr 2008 23:27:18 +0400
Will-Retry-Until: Sun, 13 Apr 2008 19:24:39 +0400

--m38J/localhost.localdomain
Content-Type: message/rfc822
Content-Transfer-Encoding: 8bit

Return-Path: <root>
Received: (from root@localhost)
by localhost.localdomain (8.13.1/8.13.1/Submit) id m38F
for inconjito@yahoo.com; Tue, 8 Apr 2008 19:24:39 +0400
Date: Tue, 8 Apr 2008 19:24:39 +0400
From: root <root>
Message-Id: <200804081524.m38F@localhost.localdomain>
To: inconjito@yahoo.com
Subject: back

Втр Апр 8 19:24:39 MSD 2008
-rw-r--r-- 1 root root 11 РђРїСЂ 8 19:22 tcp.log
----------------------------------------------------------------------
----------------------------------------------------------------------
Втр Апр 8 19:24:39 MSD 2008
-------------------------------------------------------------------EOF

Т.е. какая то байда на моём сервере пытается отослать письмо на inconjito@yahoo.com , причём я так понимаю не простое письмо ...
Как мне правильно найти и удалить это "г" с сервера ?

Посмотри логи самой системы /var/log/messages. У тебя может быть в другом месте.
ИМХО. Тебя скорее всего кто-то Имеет. Так что настраивай iptables.