070-8260-2526
ÆòÀÏ ¿ÀÀü 9½Ã ~ ¿ÀÈÄ 6½Ã
´ÜÀ§³óÇù
352-0331-1626-83
¿¹±ÝÁÖ:°¸¸¼öÅ×Å©³ÝÄÚ¸®¾Æ
|
ÀÚÁÖ¹¯´Â Áú¹® |
Ȩ > °í°´¼¾ÅÍ > ÀÚÁÖ¹¯´Â Áú¹®
|
Á¶È¸¼ö
|
8899
|
Áú¹®
|
¸ÞÀÏ·Î±× (maillog) ºÐ¼®
|
ÀÛ¼ºÀÚ : ¿ø¸¸¾ÆÂî
1. ±¸¼º : ¸ÞÀϷα״ ũ°Ô ³× ºÎºÐÀÇ Çʵå·Î ±¸¼ºµÇ¾î ÀÖ½À´Ï´Ù. °¢°¢ÀÇ Çʵ忡 ´ëÇØ ¾Ë¾Æº¸°í 4¹ø° ÇʵåÀÇ ³»¿ëÀÎ ¼¼ºÎÀûÀÎ Áö½ÃÀÚ ¿¡ ´ëÇØ ¾Ë¾Æº¸°Ú½À´Ï´Ù.
1.1 ù ¹ø° Çʵå: ÀÌ ·Î±×°¡ ¹ß»ýÇÑ ³¯Â¥ ¹× ½Ã°£ÀÔ´Ï´Ù.
1.2 µÎ ¹ø° Çʵå: È£½ºÆ® ³×ÀÓ ÀÔ´Ï´Ù
1.3 ¼¼ ¹ø° Çʵå: µ¥¸óÀÇ À̸§°ú PID ÀÔ´Ï´Ù.
1.4 ³× ¹ø° Çʵå: ¸Þ½ÃÁö¿Í °ü·ÃµÈ Çʵå ÀÔ´Ï´Ù.
1.4.1 ÀÌ Çʵ忡´Â ¸Þ½ÃÁö¿Í °ü·ÃµÈ ³»¿ëÀÇ ·Î±×°¡ ±â·ÏµË´Ï´Ù. ·Î±× ±â·Ï½Ã Ưº°ÇÑ Áö½ÃÀÚ·Î ±¸ºÐµÇ´Âµ¥ ±× Áö½ÃÀÚ¿¡ ´ëÇØ ¾Ë¾Æº¸°Ú½À´Ï´Ù.
1.4.1.1 from: ¹ß½ÅÀÚ ÁÖ¼Ò
1.4.1.2 size: ¸Þ½ÃÁöÀÇ ¹ÙÀÌÆ® Å©±â
1.4.1.3 class: ¸Þ½ÃÁöÀÇ µî±Þ(¿ì¼±¼øÀ§)À¸·Î½á ³·À»¼ö·Ï ¿ì¼±¼øÀ§°¡ ³ô½À´Ï´Ù
1.4.1.4 pri: ½ÃÀÛ ¸Þ½ÃÁöÀÇ ¿ì¼±¼øÀ§ µî±Þ
1.4.1.5 nrcpts: aliasing °ú forwardingÀ» °í·ÁÇؼ »ý½Å ¼ö½Å ¸Þ½ÃÁöÀÇ °³¼ö ÀÔ´Ï´Ù.
1.4.1.6 msgid: ¸Þ½ÃÁö ½Äº°ÀÚ(¸Þ½ÃÁö Çì´õ¿¡¼ ÃßÃâ)
1.4.1.7 proto: ¼ö½Å½Ã »ç¿ëµÈ ÇÁ·ÎÅäÄÝ( ESMTP or UUCP)
1.4.18 relay: ¸Þ½ÃÁö¸¦ Àü´ÞÇÑ ¸Ó½Å ÀÇ À̸§
1.4.1.9 to: ÄÞ¸¶·Î ºÐ¸®µÈ ¼ö½ÅÀÚ ¸®½ºÆ®
1.4.1.10 delay: ¸Þ½ÃÁö ¹ß½Å¿¡¼ ¼ö½Å½Ã ±îÁö °É¸° ½Ã°£
1.4.1.11 xdelay: ¸Þ½ÃÁö Àü¼Û ½Ãµµ¿¡ °É¸®´Â ½Ã°£(ÀϹÝÀûÀ¸·Î Á¢¼Ó½Ã°£)
1.4.1.12 mailer: ¸Þ½ÃÁö¸¦ Àü´ÞÇÏ´Â mailerÀÇ À̸§
1.4..1.13 stat: ¸Þ½ÃÁöÀÇ Àü´Þ »óÅÂ
1.4.1.14 ctladdr: ¹è´Þ¹°À» º¸³¾ ¼ö ÀÖ´Â ÀÚ°ÝÀ» °¡Áø »ç¿ëÀÚÀÇ À̸§ÀÔ´Ï´Ù.
1.4.1.15 dsn: Delivery Status NotificationÀÇ ¾àÀÚ·Î½á ¹è´Þ »ýÅ ÅëÁö¸¦ ÀǹÌÇÕ´Ï´Ù (»óÅÂÄÚµå´Â RFC 2034¹®¼ÂüÁ¶)
2. ±¸¼º¿¹Á¦ 1
(¸ÞÀÏ º¸³»±â ¿¹Á¦)
#]mail -s "Hello" ¸ÞÀÏ ÁÖ¼Ò
Hello
Cc:
[root@paint /]]#
¾Æ·¡ÀÇ ¸ÞÀÏ ·Î±×´Â localhost¿¡¼ ¡°¹Þ´Â ¸ÞÀÏ ÁÖ¼Ò¡± ¿¡ ¸ÞÀÏÀ» Àü¼ÛÇßÀ» °æ¿ì º¸¿©Áö´Â ¸Þ½ÃÁö ÀÔ´Ï´Ù.
(1) Jul 25 13:14:53 (2) paint (3) sendmail[13896]: (4) j6P4EruN013896: from=root, size=42, class="0," nrcpts=1,
msgid=<200507250414.j6P4EruN013896@localhost.localdomain>, relay=root@localhost 1. 7¿ù 25ÀÏ 13½Ã 14ºÐ°æ¿¡ paint È£½ºÆ®¿¡ sendmail(ÇÁ·Î¼¼½º ¾ÆÀ̵ð 13896)µ¥¸óÀÌ ·Î±× ±â·ÏÀ» ³²°å½À´Ï´Ù. º¸³½»ç¿ëÀÚ´Â rootÀÌ°í, ¸Þ½ÃÁöÀÇ size´Â 42¹ÙÀÌÆ®, ¸Þ½ÃÁöÀÇ ¿ì¼±¼øÀ§´Â 0À̸ç, ¸Þ½ÃÁö °³¼ö´Â 1°³ÀÌ°í ¸Þ½ÃÁö¸¦ Àü´ÞÇÑ ¸Ó½ÅÀÇ À̸§Àº root@localhost ÀÔ´Ï´Ù. Jul 25 13:14:53 paint sendmail[13898]: j6P4Er0r013898: from=<root@localhost.localdomain>, size=339, class="0," nrcpts=1,
msgid=<200507250414.j6P4EruN013896@localhost.localdomain>, proto=ESMTP, daemon=MTA, relay=paint [127.0.0.1] 2. ÀÌ °úÁ¤Àº ¸Þ½ÃÁö¿¡ Çì´õ¸¦ ºÙÀÌ´Â °úÁ¤ °°½À´Ï´Ù. root@localhost.localdomainÀ¸·ÎºÎÅÍ Àü¼ÛµÈ ¸Þ½ÃÁöÀÇ Å©±â´Â 339¹ÙÀÌÆ®ÀÌ°í µî±ÞÀº 0ÀÔ´Ï´Ù. ÃÑ ¸Þ½ÃÁö °³¼ö´Â 1°³ÀÌ°í
Àü¼Û ÇÁ·ÎÅäÄÝÀº ESMPT¸¦ »ç¿ëÇß½À´Ï´Ù. µ¥¸óÀº MTA(Mail Transfer agent)ÀÌ°í, ¸Þ½ÃÁö¸¦ Àü´ÞÇÑ ¸Ó½ÅÀÇ À̸§Àº paint[127.0.0.1], Áï ·ÎÄà ȣ½ºÆ®ÀÔ´Ï´Ù. Jul 25 13:14:53 paint sendmail[13896]: j6P4EruN013896: to=¡±¹Þ´Â ¸ÞÀÏ ÁÖ¼Ò¡±, ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30042,
relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (j6P4Er0r013898 Message accepted for delivery) 3. ¸ÞÀÏÀ» ¹Þ´Â »ç¿ëÀÚ´Â ¡°¹Þ´Â ¸ÞÀÏ ÁÖ¼Ò¡± ÀÌ°í, ÀÌ ¸Þ½ÃÁö¸¦ ¹è´ÞÇÏ´Â ÀÚ°ÝÀ» °¡Áø »ç¿ëÀÚ´Â root ÀÔ´Ï´Ù. ¸Þ½ÃÁö ¹ß½Å¿¡ °É¸° ½Ã°£Àº 0ÃÊÀÌ°í mailer´Â relayÀÔ´Ï´Ù.
DsnÀÌ 2.0.0Àº ¸Þ½ÃÁö Àü¼ÛÀÇ ¿Ï·á¸¦ ³ªÅ¸³»´Â »óÅÂÄÚµå ÀÔ´Ï´Ù. ¸Þ½ÃÁöÀÇ Àü´Þ »óŸ¦ ³ªÅ¸³»´Â stat´Â j6P4Er0r013898¿¡¼ ¸Þ½ÃÁö°¡ Çã°¡ µÇ¾úÀ½À» ¶æÇÕ´Ï´Ù. Jul 25 13:14:53 paint sendmail[13900]: j6P4Er0r013898: to=<¹Þ´Â ¸ÞÀÏ ÁÖ¼Ò>, ctladdr=<root@localhost.localdomain> (0/0), delay=00:00:00, xdelay=00:00:00,
mailer=esmtp, pri=30339, relay=¼ö½ÅÀ» Çã°¡ÇÑ È£½ºÆ®À̸§. [¾ÆÀÌÇÇ], dsn=2.0.0, stat=Sent (j6P4EkU09509 Message accepted for delivery) 4. ¸¶Áö¸·À¸·Î mailer´Â esmtp¸¦ »ç¿ëÇß°í, ¸Þ½ÃÁö¸¦ ½ÂÀÎÇÑ ¡°¼ö½ÅÀ» Çã°¡ÇÑ È£½ºÆ®À̸§¡± ¿¡ ¼º°øÀûÀ¸·Î ¸Þ½ÃÁö¸¦ º¸³ÂÀ½À» ³ªÅ¸³À´Ï´Ù.
3. ±¸¼º¿¹Á¦ 2
(¾Æ·¡ÀÇ ·Î±×´Â ¾Æ¿ô·è ÀͽºÇÁ·¹½º¿¡¼ ¸ÞÀÏÀ» ¹Þ¾Æ°¬À» ¶§ »ý±â´Â ·Î±×ÀÔ´Ï´Ù.)
Jul 25 14:51:18 paint ipop3d[14629]: pop3 service init from ¾ÆÀÌÇÇ
Jul 25 14:51:18 paint ipop3d[14629]: Mailbox vulnerable - directory /var/spool/mail must have 1777 protection
Jul 25 14:51:18 paint ipop3d[14629]: Login user=wonmanajji host=[È£½ºÆ® ¾ÆÀÌÇÇ] nmsgs=1/1
Jul 25 14:51:18 paint ipop3d[14629]: Mailbox vulnerable - directory /var/spool/mail must have 1777 protection
Jul 25 14:51:18 paint ipop3d[14629]: Logout user=wonmanajji host=[È£½ºÆ® ¾ÆÀÌÇÇ] nmsgs=0 ndele=1 ¡°È£½ºÆ® ¾ÆÀÌÇÇ¡±¸¦ »ç¿ëÇÏ´Â °÷¿¡¼ pop3 ¼ºñ½º¿¡ Á¢±ÙÇÏ¿© wonmanajji¶ó´Â »ç¿ëÀÚ·Î ·Î±×ÀÎ ÇÏ¿´½À´Ï´Ù.
ÃÑ ¸Þ½ÃÁö´Â 1°³ÀÌ°í ÀÐÁö ¾ÊÀº ¸Þ½ÃÁö´Â 1°³ ÀÔ´Ï´Ù. Mailbox vulnerable´Â º¸¾È°æ°í·Î½á /var/spool/mail ÀÇ µð·ºÅ丮 Å͹̼ÇÀ» 1777·Î º¯°æÇÒ °ÍÀ» ¿ä±¸ÇÏ°í ÀÖ½À´Ï´Ù.
¸¶Áö¸·À¸·Î wonmanajji À¯Áö°¡ ·Î±×¾Æ¿ôÇß½À´Ï´Ù.
|
|
|
|
|
|
|