ここ数日，sendmailのユーザー認証をこじ開けようと辞書攻撃を受け続けています．無駄な攻撃ですが万一まぐれで当たったらと思うと気持ち悪いので，新しい攻撃から33個のIPアドレスを “DROP” するように，設定しました．合計で254個になりました．<\/p>\n\n\n\n
今回の攻撃は1〜数分間隔で “www”, “postmaster” などありがちなユーザー名で認証を試みてきます．そして，試行するごとにIPアドレスが変わってきます．ボットなのかIP偽装なのかわかりません（sendmailのログには “may be forged” ってでてますが）．<\/p>\n\n\n\n
ボットにしても偽装にしても1つの邪悪なIPアドレスがある場合，8bitのサブネットごと “DROP” するように設定していますから，善良な方（やMTA）からの接続も受け付けなくなる危険性があります．<\/p>\n\n\n\n
もし，昨日までつながっていたのにつながらなくなったらお知らせ下さい（あ，無理か😓）．<\/p>\n\n\n\n
その後も次から次へと新しいIPアドレスで攻撃してくるので，攻撃元IPアドレスを “DROP” するのをやめました．<\/p>\n","protected":false},"excerpt":{"rendered":"
\u3053\u3053\u6570\u65e5\uff0csendmail\u306e\u30e6\u30fc\u30b6\u30fc\u8a8d\u8a3c\u3092\u3053\u3058\u958b\u3051\u3088\u3046\u3068\u8f9e\u66f8\u653b\u6483\u3092\u53d7\u3051\u7d9a\u3051\u3066\u3044\u307e\u3059\uff0e\u7121\u99c4\u306a\u653b\u6483\u3067\u3059\u304c\u4e07\u4e00\u307e\u3050\u308c\u3067\u5f53\u305f\u3063\u305f\u3089\u3068\u601d\u3046\u3068\u6c17\u6301\u3061\u60aa\u3044\u306e\u3067\uff0c\u65b0\u3057\u3044\u653b\u6483\u304b\u308933\u500b\u306eIP\u30a2\u30c9\u30ec\u30b9\u3092 “DROP” \u3059\u308b\u3088\u3046\u306b\uff0c\u8a2d\u5b9a\u3057\u307e\u3057\u305f\uff0e\u5408\u8a08\u3067254\u500b\u306b\u306a\u308a\u307e\u3057\u305f\uff0e \u4eca\u56de\u306e\u653b\u6483\u306f1\u301c\u6570\u5206\u9593\u9694\u3067 “www”, “postmaster” \u306a\u3069\u3042\u308a\u304c\u3061\u306a\u30e6\u30fc\u30b6\u30fc\u540d\u3067\u8a8d\u8a3c\u3092\u8a66\u307f\u3066\u304d\u307e\u3059\uff0e\u305d\u3057\u3066\uff0c\u8a66\u884c\u3059\u308b\u3054\u3068\u306bIP\u30a2\u30c9\u30ec\u30b9\u304c\u5909\u308f\u3063\u3066\u304d\u307e\u3059\uff0e\u30dc\u30c3\u30c8\u306a\u306e\u304bIP\u507d\u88c5\u306a\u306e\u304b\u308f\u304b\u308a\u307e\u305b\u3093\uff08sendmail\u306e\u30ed\u30b0\u306b\u306f “may be forged” \u3063\u3066\u3067\u3066\u307e\u3059\u304c\uff09\uff0e \u30dc\u30c3\u30c8\u306b\u3057\u3066\u3082\u507d\u88c5\u306b\u3057\u3066\u30821\u3064\u306e\u90aa\u60aa\u306aIP\u30a2\u30c9\u30ec\u30b9\u304c\u3042\u308b\u5834\u5408\uff0c8bit\u306e\u30b5\u30d6\u30cd\u30c3\u30c8\u3054\u3068 “DROP” \u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u3066\u3044\u307e\u3059\u304b\u3089\uff0c\u5584\u826f\u306a\u65b9\uff08\u3084MTA\uff09\u304b\u3089\u306e\u63a5\u7d9a\u3082\u53d7\u3051\u4ed8\u3051\u306a\u304f\u306a\u308b\u5371\u967a\u6027\u304c\u3042\u308a\u307e\u3059\uff0e \u3082\u3057\uff0c\u6628\u65e5\u307e\u3067\u3064\u306a\u304c\u3063\u3066\u3044\u305f\u306e\u306b\u3064\u306a\u304c\u3089\u306a\u304f\u306a\u3063\u305f\u3089\u304a\u77e5\u3089\u305b\u4e0b\u3055\u3044\uff08\u3042\uff0c\u7121\u7406\u304b\ud83d\ude13\uff09\uff0e \u8ffd\u8a18\uff082023\/05\/12\uff09 \u305d\u306e\u5f8c\u3082\u6b21\u304b\u3089\u6b21\u3078\u3068\u65b0\u3057\u3044IP\u30a2\u30c9\u30ec\u30b9\u3067\u653b\u6483\u3057\u3066\u304f\u308b\u306e\u3067\uff0c\u653b\u6483\u5143IP\u30a2\u30c9\u30ec\u30b9\u3092 “DROP” \u3059\u308b\u306e\u3092\u3084\u3081\u307e\u3057\u305f\uff0e<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_daextam_enable_autolinks":"","footnotes":""},"categories":[8,10],"tags":[],"class_list":["post-21169","post","type-post","status-publish","format-standard","hentry","category-linux","category-network"],"publishpress_future_action":{"enabled":false,"date":"2026-05-08 00:10:53","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"category","extraData":[]},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts\/21169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=21169"}],"version-history":[{"count":0,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts\/21169\/revisions"}],"wp:attachment":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}