[問題]我的伺服器好像受到了攻擊，似乎變成了別人的跳板(以解決)

[兀爾德]

如題，在這附上從LOG裡擷取一小段的資料(因為整個LOG要300多MB)

徵狀：不停的接受外部來的轉信或寄信工作，

LOG：

2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "VS1-IP Excessive unknown recipients - possible Open Relay http://help.yahoo.com/help/us/mail/spam/spam-18.html (#4.1."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalrock@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.141.222 SF pwgblzdyzlrqfz@yahoo.com.cn bcjp@hotmail.com "Socket Error # 10060 Connection timed out."
2005/02/06:23:55:03 SMTP 211.90.157.252 SS textvt@msa.hinet.net troger@pchome.com.tw 800
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "VS1-IP Excessive unknown recipients - possible Open Relay http://help.yahoo.com/help/us/mail/spam/spam-18.html (#4.1."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metals@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalshop@yahoo.com.tw "VS1-IP Excessive unknown recipients - possible Open Relay http://help.yahoo.com/help/us/mail/spam/spam-18.html (#4.1."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalshop@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalshop@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalshop@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalshop@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalshop@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalshop@yahoo.com.tw "Already connected."
2005/02/06:23:55:03 SMTP 61.31.136.110 SF znvvbw@yahooo.com.cn metalshop@?

我的網域名稱：www.bain.idv.tw

PS：請大大們幫忙看看，不過目前伺服器已經掛了，需要等白天我再去重開，之後在附上設定的照片

[fish206452]

關掉Open Relay~
恐怖喔

小心被yahoo列為黑名單喔
_________________
pchomespammail@pchome.com.tw

[兀爾德]

大家恭喜我吧，結果在這段時間我都沒開伺服器，直到過完年再回來看，重開以後到現在便沒在發生同樣的問題，好像沒在利用我的伺服器了，所以就醬囉，文章裡面的資訊就留給有興趣的大大研究(我是有看沒有懂)，如需我其他的資訊歡迎寄E-MAIL給我，或是在這留言，我都會在這看看新文章。

反正也已經PASS了，若有遇到相同問題的朋友，相信只要關閉伺服器個兩三天，等到駭客對你失去了興趣，我想他自然就會轉移目標了，但是大家要隨時監控喔。

[Arnor]