Mail Transfer Agent (MTA)を動かしているといろんな攻撃がなされます．こちらではかなり昔からsendmailを使用していて，ログをときどき見ています．<\/p>\n\n\n\n
かつてはむやみにメールを送り込もうという単純な攻撃が多くたいていは，IPアドレスの逆引きができないとか，認証が必要という形でsendmailがリジェクトしてきました．<\/p>\n\n\n\n
最近変わった攻撃としては，arg1ですから送信元のアドレスに，悪意あるPerlスクリプトをwgetやcurlでダウンロードさせて実行さようというスクリプトを記述したメール送信を偽装した試みが複数回なされました．<\/p>\n\n\n\n
そのPerlスクリプトを試しにダウンロードしてざっと眺めてみました．バックドアを作るもののようですが，はたしてarg1に書かれたスクリプトが実行されることがあるのか，実行したとしてsendmailの権限でバックドアが作れるのか疑問です．ただ，成功例があるから攻撃してくるのでしょうけれど．<\/p>\n\n\n\n
また，昨日までの数日間，認証を試みる辞書攻撃と思われる試みが繰り返し行われました．<\/p>\n\n\n\n
まあ，辞書攻撃でこちらの認証が突破はできないと思いますが，気持ち悪いので攻撃元のIPアドレスを遮断しました．全部で7個くらいあったので，ボットからの攻撃と思われます．<\/p>\n\n\n\n
MTAを動かしているといろんな風景が眺められて面白いです．<\/p>\n","protected":false},"excerpt":{"rendered":"
Mail Transfer Agent (MTA)\u3092\u52d5\u304b\u3057\u3066\u3044\u308b\u3068\u3044\u308d\u3093\u306a\u653b\u6483\u304c\u306a\u3055\u308c\u307e\u3059\uff0e\u3053\u3061\u3089\u3067\u306f\u304b\u306a\u308a\u6614\u304b\u3089sendmail\u3092\u4f7f\u7528\u3057\u3066\u3044\u3066\uff0c\u30ed\u30b0\u3092\u3068\u304d\u3069\u304d\u898b\u3066\u3044\u307e\u3059\uff0e \u304b\u3064\u3066\u306f\u3080\u3084\u307f\u306b\u30e1\u30fc\u30eb\u3092\u9001\u308a\u8fbc\u3082\u3046\u3068\u3044\u3046\u5358\u7d14\u306a\u653b\u6483\u304c\u591a\u304f\u305f\u3044\u3066\u3044\u306f\uff0cIP\u30a2\u30c9\u30ec\u30b9\u306e\u9006\u5f15\u304d\u304c\u3067\u304d\u306a\u3044\u3068\u304b\uff0c\u8a8d\u8a3c\u304c\u5fc5\u8981\u3068\u3044\u3046\u5f62\u3067sendmail\u304c\u30ea\u30b8\u30a7\u30af\u30c8\u3057\u3066\u304d\u307e\u3057\u305f\uff0e \u6700\u8fd1\u5909\u308f\u3063\u305f\u653b\u6483\u3068\u3057\u3066\u306f\uff0carg1\u3067\u3059\u304b\u3089\u9001\u4fe1\u5143\u306e\u30a2\u30c9\u30ec\u30b9\u306b\uff0c\u60aa\u610f\u3042\u308bPerl\u30b9\u30af\u30ea\u30d7\u30c8\u3092wget\u3084curl\u3067\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u305b\u3066\u5b9f\u884c\u3055\u3088\u3046\u3068\u3044\u3046\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u8a18\u8ff0\u3057\u305f\u30e1\u30fc\u30eb\u9001\u4fe1\u3092\u507d\u88c5\u3057\u305f\u8a66\u307f\u304c\u8907\u6570\u56de\u306a\u3055\u308c\u307e\u3057\u305f\uff0e \u305d\u306ePerl\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u8a66\u3057\u306b\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u3056\u3063\u3068\u773a\u3081\u3066\u307f\u307e\u3057\u305f\uff0e\u30d0\u30c3\u30af\u30c9\u30a2\u3092\u4f5c\u308b\u3082\u306e\u306e\u3088\u3046\u3067\u3059\u304c\uff0c\u306f\u305f\u3057\u3066arg1\u306b\u66f8\u304b\u308c\u305f\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u5b9f\u884c\u3055\u308c\u308b\u3053\u3068\u304c\u3042\u308b\u306e\u304b\uff0c\u5b9f\u884c\u3057\u305f\u3068\u3057\u3066sendmail\u306e\u6a29\u9650\u3067\u30d0\u30c3\u30af\u30c9\u30a2\u304c\u4f5c\u308c\u308b\u306e\u304b\u7591\u554f\u3067\u3059\uff0e\u305f\u3060\uff0c\u6210\u529f\u4f8b\u304c\u3042\u308b\u304b\u3089\u653b\u6483\u3057\u3066\u304f\u308b\u306e\u3067\u3057\u3087\u3046\u3051\u308c\u3069\uff0e \u307e\u305f\uff0c\u6628\u65e5\u307e\u3067\u306e\u6570\u65e5\u9593\uff0c\u8a8d\u8a3c\u3092\u8a66\u307f\u308b\u8f9e\u66f8\u653b\u6483\u3068\u601d\u308f\u308c\u308b\u8a66\u307f\u304c\u7e70\u308a\u8fd4\u3057\u884c\u308f\u308c\u307e\u3057\u305f\uff0e \u307e\u3042\uff0c\u8f9e\u66f8\u653b\u6483\u3067\u3053\u3061\u3089\u306e\u8a8d\u8a3c\u304c\u7a81\u7834\u306f\u3067\u304d\u306a\u3044\u3068\u601d\u3044\u307e\u3059\u304c\uff0c\u6c17\u6301\u3061\u60aa\u3044\u306e\u3067\u653b\u6483\u5143\u306eIP\u30a2\u30c9\u30ec\u30b9\u3092\u906e\u65ad\u3057\u307e\u3057\u305f\uff0e\u5168\u90e8\u30677\u500b\u304f\u3089\u3044\u3042\u3063\u305f\u306e\u3067\uff0c\u30dc\u30c3\u30c8\u304b\u3089\u306e\u653b\u6483\u3068\u601d\u308f\u308c\u307e\u3059\uff0e MTA\u3092\u52d5\u304b\u3057\u3066\u3044\u308b\u3068\u3044\u308d\u3093\u306a\u98a8\u666f\u304c\u773a\u3081\u3089\u308c\u3066\u9762\u767d\u3044\u3067\u3059\uff0e<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_daextam_enable_autolinks":"","footnotes":""},"categories":[8,10],"tags":[],"class_list":["post-20106","post","type-post","status-publish","format-standard","hentry","category-linux","category-network"],"publishpress_future_action":{"enabled":false,"date":"2026-05-30 05:18:11","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"category","extraData":[]},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts\/20106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=20106"}],"version-history":[{"count":0,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts\/20106\/revisions"}],"wp:attachment":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20106"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}