/var/log/secure에 있는 로그 해석좀 부탁드립니다.

[손님]

안녕하세요 초보 리눅서입니다.

늘 고수님들의 도움을 받아 하나씩 배우고 있는데요... 제가 관리하는 서버에 제가 모르는 로그가 생겨서 불안한 맘에 글을 올립니다.

고수님들이 알려주시면 정말 감사하겠습니다.

참고로 배포판은 레드햇이구요 커널은 2.4.18입니다.

그리고 센드메일 버젼은 8.12.8이며 ssh는 OpenSSH_3.5p1을 사용하고 있습니다.

(이상로그 1)
Sep 29 11:06:34 xxx-system xinetd[1485]: Bad log_on_failure flag: RECORD [line=15]
Sep 29 11:06:34 xxx-system xinetd[1485]: Error parsing attribute log_on_failure - DISABLING SERVICE [line=15]
Sep 29 11:22:55 xxx-system opensshd[2118]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.

(이상로그 2)
Sep 29 11:00:02 xxx-system sendmail[1016]: h8T202B0001016: [211.205.113.171] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Sep 29 11:00:15 xxx-system sendmail[1017]: h8T1xxB0001017: ruleset=check_rcpt, arg1=<fedida@free.uk>, relay=[211.217.200.239], reject=550 5.7.1 <fedida@free.uk>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:02:22 xxx-system sendmail[1228]: h8T22LB0001228: ruleset=check_rcpt, arg1=<fervidbk@nacetech.ocm>, relay=[211.217.200.239], reject=550 5.7.1 <fervidbk@nacetech.ocm>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:03:43 xxx-system sendmail[1325]: h8T23gB0001325: [211.217.200.239] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Sep 29 11:04:18 xxx-system sendmail[1326]: h8T242B0001326: ruleset=check_rcpt, arg1=<fgnejrfg@ylpbf.pb.xe>, relay=[211.217.200.239], reject=550 5.7.1 <fgnejrfg@ylpbf.pb.xe>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:05:50 xxx-system sendmail[1459]: h8T25oB0001459: ruleset=check_rcpt, arg1=<financial@financial.or.kr>, relay=[211.217.200.239], reject=550 5.7.1 <financial@financial.or.kr>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:06:35 xxx-system sendmail[1487]: h8T26ZB0001487: ruleset=check_rcpt, arg1=<finev2@finev2.co.kr>, relay=[211.217.200.239], reject=550 5.7.1 <finev2@finev2.co.kr>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:07:55 xxx-system sendmail[1496]: h8T27sB0001496: ruleset=check_rcpt, arg1=<first@lettuceb.sl>, relay=[211.217.200.239], reject=550 5.7.1 <first@lettuceb.sl>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:08:56 xxx-system sendmail[1499]: h8T28uB0001499: ruleset=check_rcpt, arg1=<fjvm@betvb.arg>, relay=[211.217.200.239], reject=550 5.7.1 <fjvm@betvb.arg>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:09:18 xxx-system sendmail[1500]: h8T298B0001500: ruleset=check_rcpt, arg1=<fkopke@unlinfo.unl.edu>, relay=[211.217.200.239], reject=550 5.7.1 <fkopke@unlinfo.unl.edu>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:10:34 xxx-system sendmail[1627]: h8T2AXB0001627: ruleset=check_rcpt, arg1=<flower@kyungflower.com>, relay=[211.217.200.239], reject=550 5.7.1 <flower@kyungflower.com>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:11:06 xxx-system sendmail[1628]: h8T2B6B0001628: ruleset=check_rcpt, arg1=<flutters@apprehensivenesse.net>, relay=[211.217.200.239], reject=550 5.7.1 <flutters@apprehensivenesse.net>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:11:29 xxx-system sendmail[1634]: h8T2BTB0001634: ruleset=check_rcpt, arg1=<flyrr@onjv.bet>, relay=[211.217.200.239], reject=550 5.7.1 <flyrr@onjv.bet>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:11:59 xxx-system sendmail[1645]: h8T2BbB0001645: ruleset=check_rcpt, arg1=<fmb@formybody.co.kr>, relay=[211.217.200.239], reject=550 5.7.1 <fmb@formybody.co.kr>... Relaying denied. IP name lookup failed [211.217.200.239]
Sep 29 11:14:51 xxx-system sendmail[1723]: h8T2EpB0001723: ruleset=check_rcpt, arg1=<forged@birdiedt.edu>, relay=[61.73.50.252], reject=550 5.7.1 <forged@birdiedt.edu>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:15:59 xxx-system sendmail[1860]: h8T2FkB0001860: ruleset=check_rcpt, arg1=<foster@cs.uidaho.edu>, relay=[61.73.50.252], reject=550 5.7.1 <foster@cs.uidaho.edu>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:16:42 xxx-system sendmail[1874]: h8T2GfB0001874: ruleset=check_rcpt, arg1=<fpottere@vmsa.oac.uci.edu>, relay=[61.73.50.252], reject=550 5.7.1 <fpottere@vmsa.oac.uci.edu>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:16:59 xxx-system sendmail[1875]: h8T2GnB0001875: ruleset=check_rcpt, arg1=<fqwmvp@kjdfsindyljksdf.net>, relay=[61.73.50.252], reject=550 5.7.1 <fqwmvp@kjdfsindyljksdf.net>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:17:05 xxx-system sendmail[1883]: h8T2H5B0001883: ruleset=check_rcpt, arg1=<francesc@telcen.caen.it>, relay=[61.73.50.252], reject=550 5.7.1 <francesc@telcen.caen.it>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:18:40 xxx-system sendmail[1893]: h8T2IMB0001893: ruleset=check_rcpt, arg1=<fred@bbn-unix.arpa>, relay=[61.73.50.252], reject=550 5.7.1 <fred@bbn-unix.arpa>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:18:55 xxx-system sendmail[1902]: h8T2ItB0001902: ruleset=check_rcpt, arg1=<freedom@cham.jinbo.net>, relay=[61.73.50.252], reject=550 5.7.1 <freedom@cham.jinbo.net>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:19:29 xxx-system sendmail[1920]: h8T2JSB0001920: ruleset=check_rcpt, arg1=<freib@uvgry.arg>, relay=[61.73.50.252], reject=550 5.7.1 <freib@uvgry.arg>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:19:57 xxx-system sendmail[1923]: h8T2JgB0001923: ruleset=check_rcpt, arg1=<freraqvc77@ubgznvy.pbz>, relay=[61.73.50.252], reject=550 5.7.1 <freraqvc77@ubgznvy.pbz>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:20:21 xxx-system sendmail[2067]: h8T2KKB0002067: ruleset=check_rcpt, arg1=<friends@cybermail.com>, relay=[61.73.50.252], reject=550 5.7.1 <friends@cybermail.com>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:22:05 xxx-system sendmail[2093]: h8T2LoB0002093: ruleset=check_rcpt, arg1=<fsu-request@sovset.org>, relay=[61.73.50.252], reject=550 5.7.1 <fsu-request@sovset.org>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:22:43 xxx-system sendmail[2110]: h8T2MhB0002110: ruleset=check_rcpt, arg1=<ftp@ftp.segaoa.com>, relay=[61.73.50.252], reject=550 5.7.1 <ftp@ftp.segaoa.com>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:23:08 xxx-system sendmail[2116]: h8T2MvB0002116: ruleset=check_rcpt, arg1=<ftpadm@ftp.sayclub.com>, relay=[61.73.50.252], reject=550 5.7.1 <ftpadm@ftp.sayclub.com>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:23:25 xxx-system sendmail[2122]: h8T2NCB0002122: ruleset=check_rcpt, arg1=<ftpadmin@power.vi.uv.es>, relay=[61.73.50.252], reject=550 5.7.1 <ftpadmin@power.vi.uv.es>... Relaying denied. IP name lookup failed [61.73.50.252]
Sep 29 11:25:08 xxx-system sendmail[2280]: h8T2P8B0002280: ruleset=check_rcpt, arg1=<fusfuvhswurf@fkvnedubg.com>, relay=[61.73.50.252], reject=550 5.7.1 <fusfuvhswurf@fkvnedubg.com>... Relaying denied. IP name lookup failed [61.73.50.252]

이상로그 1의 경우 ssh를 xinetd로 운영하는데 xinetd를 리스타트 했을 경우에 발생하고 설정파일을 살펴보았지만 별다른 문제점을 발견하지 못했습니다.

xinetd의 설정은 아래와 같습니다.
1 # default: off
2 # description: OpenSSH server daemon For XINETD
3 service ssh
4 {
5 disable = no
6 flags = REUSE
7 protocol = tcp
8 socket_type = stream
9 instances = 50
10 wait = no
11 user = root
12 server = /usr/sbin/opensshd
13 server_args = -i
14 log_on_success = HOST PID
15 log_on_failure = HOST RECORD
16 }



이상로그 2번째는 누군가 메일서버를 무단으로 사용하려는 것 같은데
이렇게 처리되는 것이 정상인지 아니면 보안상 문제가 있는 것인지 모르겠습니다.

그리고 해당 IP의 경로를 추적해보면 외국의 경우도 있지만 국내의 ip도 상당수 발견할 수 있었습니다.

만약 국내일 경우 이러한 것을 방지할 수 있도록 경고나 기타 불이익을 줄 수 있는 방법이 있을까요??

예를 들면 아래와 같은 정보를 찾을 수 있었습니다.
해당ip는 61.73.50.252였습니다.

[whois.apnic.net node-1]
Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 61.72.0.0 - 61.77.255.255
netname: KORNET
descr: KOREA TELECOM
descr: KOREA TELECOM Internet Operating Center
country: KR
admin-c: DL276-AP
tech-c: WK81-AP
remarks: ******************************************
remarks: Allocated to KRNIC Member.
remarks: If you would like to find assignment
remarks: information in detail please refer to
remarks: the KRNIC Whois Database at:
remarks: http://whois.nic.or.kr/english/index.html
remarks: ******************************************
mnt-by: MNT-KRNIC-AP
mnt-lower: MNT-KRNIC-AP
changed: hostmaster@apnic.net 20001212
changed: hostmaster@apnic.net 20010627
status: ALLOCATED PORTABLE
source: APNIC

person: Dongjoo Lee
address: Korea Telecom
address: 128-9 Youngundong Chongroku
address: SEOUL
address: 463-711
country: KR
phone: +82-2-747-9213
fax-no: +82-2-766-5901
e-mail: ip@ns.kornet.net
nic-hdl: DL276-AP
mnt-by: MNT-KRNIC-AP
changed: hostmaster@nic.or.kr 20010523
source: APNIC

person: Won Kang
address: Korea Telecom
address: 128-9 Youngundong Chongroku
address: SEOUL
address: 463-711
country: KR
phone: +82-2-747-9213
fax-no: +82-2-766-5901
e-mail: ip@ns.kornet.net
nic-hdl: WK81-AP
mnt-by: MNT-KRNIC-AP
changed: hostmaster@nic.or.kr 20010523
source: APNIC

inetnum: 61.73.42.0 - 61.73.54.255
netname: KORNET-XDSL-SINCHON-KR
descr: SINCHON NODE
descr: 157-1 DONGKYODONG MAPOKU
descr: SEOUL
descr: 121-200
country: KR
admin-c: GP25-KR
tech-c: WK30-KR
remarks: This IP address space has been allocated to KRNIC.
remarks: For more information, using KRNIC Whois Database
remarks: whois -h whois.nic.or.kr
mnt-by: MNT-KRNIC-AP
remarks: This information has been partially mirrored by APNIC from
remarks: KRNIC. To obtain more specific information, please use the
remarks: KRNIC whois server at whois.krnic.net.
changed: hostmaster@nic.or.kr 20030915
source: KRNIC

person: GilSoon Park
descr: KOREA TELECOM
descr: 128-9 Youngundong Chongroku
descr: SEOUL
descr: 110-460
country: KR
phone: +82-2-747-9213
fax-no: +82-2-766-5901
e-mail: gspark@kornet.net
nic-hdl: GP25-KR
mnt-by: MNT-KRNIC-AP
remarks: This information has been partially mirrored by APNIC from
remarks: KRNIC. To obtain more specific information, please use the
remarks: KRNIC whois server at whois.krnic.net.
changed: hostmaster@nic.or.kr 20030915
source: KRNIC

person: Won Kang
descr: KOREA TELECOM
descr: 128-9 Youngundong Chongroku
descr: SEOUL
descr: 110-460
country: KR
phone: +82-2-747-9213
fax-no: +82-2-766-5901
e-mail: ip@ns.kornet.net
nic-hdl: WK30-KR
mnt-by: MNT-KRNIC-AP
remarks: This information has been partially mirrored by APNIC from
remarks: KRNIC. To obtain more specific information, please use the
remarks: KRNIC whois server at whois.krnic.net.
changed: hostmaster@nic.or.kr 20030915
source: KRNIC

그럼 오늘도 고수님들의 따듯한 조언을 기다리겠습니다.

좋은 하루 되세요.

[truefeel]