bisti
20.09.11, 06:27
In letzte Zeit habe ich eine sehr seltsame Angriff auf meines smtp-server(exim 4.76) entdeckt: man versucht mir die HTTP-Kommandos verschicken, und zwar mit dem grossen Kopfteil:
2011-09-18 22:07:42 SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=[111.161.27.20] input="GET / HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_1_3 like Mac "
2011-09-18 22:07:43 no host name found for IP address 111.161.27.20
2011-09-18 22:07:47 H=(welcome.com) [111.161.27.20] F=<root@local.com> rejected RCPT <postmaster@localhost>: "111.161.27.20 is not allowed to send mail from local.com"
2011-09-18 22:07:48 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "Header0000: VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVV" H=(welcome.com) [111.161.27.20] next input="Header0001: VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVV\nHeader000"
Ist diese Angriff gefährlich, oder ich keine Sorgen machen soll?
2011-09-18 22:07:42 SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=[111.161.27.20] input="GET / HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_1_3 like Mac "
2011-09-18 22:07:43 no host name found for IP address 111.161.27.20
2011-09-18 22:07:47 H=(welcome.com) [111.161.27.20] F=<root@local.com> rejected RCPT <postmaster@localhost>: "111.161.27.20 is not allowed to send mail from local.com"
2011-09-18 22:07:48 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "Header0000: VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVV" H=(welcome.com) [111.161.27.20] next input="Header0001: VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVV\nHeader000"
Ist diese Angriff gefährlich, oder ich keine Sorgen machen soll?