GENO 악성코드 ftp계정 도용...

2010/02/02

Mprocmail,       P=/usr/local/bin/procmail, F=DFMSPhnu, S=11, R=22,

                A=procmail -m $h $f $u

# deal with other remote names 

R$*<@$*> $*            $#esmtp $@$2 $:$1<@$2>$3      user@host.domain

#R$*<@$*> $*           $#esmtp $@$2 $:$1<@$2>$3      user@host.domain

R$*<@$*.procmail>$*     $#esmtp $@$2 $:$1<@$2>$3

R$*<@$*>$*             $#procmail $@/etc/outgoing.rc $:$1<@$2procmail.>$3

          ---------------         --              --         -------- 

            탭              스페이스       스페이스      점의 위치에 주의

#

# envelope recipient rewirting --

# also header recipient if not masquerading recipients

#

S21

R$*<@$*.procmail>$*      $: $1<@$2>$3   sender/recipient common

R$+                     $: $>51 $1      qualify unqual'ed names

R$+                     $: $>61 $1

------------

#LOGFILE=/var/log/outgoing_mail

#VERBOSE=yes

PATH=/usr/local/bin:/usr/bin:/bin

SHELL=/bin/sh  # 명시적으로 사용할 shell을 지정하는 것이 좋을 것임.

DEFAULT=|    # 디폴트로 메일이 다른 프로그램의 인풋으로 사용된다

REC=$2        # 변수 2에(수신자) 있는 정보를 REC변수에 넣는다.

# 이하 자신의 처방전

:0 f

* ^Subject:.*test

| formail -A "X-envelope: 0=$0, 1=$1, 2=$2 $REC" |\

 $SENDMAIL -oi $REC

* ^Subject:.*

------

VERSIONID(`@(#)sora.mc  8.3 (Berkeley) 3/23/96')

OSTYPE(solaris2)dnl

FEATURE(nouucp)dnl

FEATURE(always_add_domain)dnl

FEATURE(local_procmail)dnl

MAILER(local)dnl

MAILER(smtp)dnl

------

m4 sol.mc > sendmail.cf

98/05/15

S21에서

R$*<@$*.procmail>$*      $: $1<@$2>$3   sender/recipient common

    ^^^

타이핑 미스체크함.

your.address.procmail과 같이 procmail을 붙였을경우 에러가 발생하는 경우가 있음

(solaris 2.6)이때 위 설정중 procmail을 붙이는 것을 parsemail 또는 out등을 붙여

에러가 없는 것으로 사용하면 됨

98/05/08  

1. dot의 위치변경

R$*<@$*>$*              $#procmail $@/etc/outgoing.rc $:$1<@$2.procmail>$3

R$*<@$*>$*              $#procmail $@/etc/outgoing.rc $:$1<@$2procmail.>$3

2. 탭의 숫자 명시

R$*<@*.procmail>$*      $: $1<@$2>$3    sender/recipient common

이때             ^^^^^^^^^^         ^^^^^^는 각기 탭이 하나만 사용되어야 합니다.

그렇지 않으면 replacement $3 out of bounds라는 에러를 만나게 됩니다.

3. 처방전의 예시명시

이 처방전은 제목이 test인 메일만 로그를 남기는 처방입니다. 

모든 메일에 대해 로그를 남기려면 * ^Subject:.* 로 바꾸시면 됩니다.

cd /usr/local/src 
wget http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-authlib-0.57.tar.bz2 
tar jvxf courier-authlib-0.57.tar.bz2 
chown -R root.root courier-authlib-0.57.tar.bz2 
cd courier-authlib-0.57 

./configure  --prefix=/usr/local/courier-authlib --with-redhat 
(default 로 설정하기 위해서 위의 옵션만 주면 된다) 
make 
make install 
make install-configure 

vi /usr/local/courier-authlib/etc/authlib/authdaemonrc 
    authmodulelist="authvchkpw" 

cp courier-authlib.sysvinit /etc/rc.d/init.d/courier-authlib 
chmod 744 /etc/rc.d/init.d/courier-authlib 
chkconfig --add courier-authlib 
/etc/rc.d/init.d/courier-authlib start 

[root@zosen courier-authlib-0.57]# pstree 
init-+-courierlogger---authdaemond---5*[authdaemond] 

[root@zosen courier-authlib-0.57]# ps aux | grep courier 
root      4192  0.0  0.1  2160  452 ?        S    10:35  0:00 /usr/local/courier-authlib/sbin/courierlogger -pid=/usr/local/courier-authlib/var/spool/authdaemon/pid -start /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4193  0.0  0.3  4204  776 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4194  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4195  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4196  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4197  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4198  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4273  0.0  0.2  5860  684 pts/0    R+  10:36  0:00 grep courier
cd /usr/local/src 
wget http://optusnet.dl.sourceforge.net/sourceforge/courier/courier-imap-4.0.6.tar.bz2 
tar jvxf courier-imap-4.0.6.tar.bz2 
chown -R root.root courier-imap-4.0.6 
cd courier-imap-4.0.6 

COURIERAUTHCONFIG=/usr/local/courier-authlib/bin/courierauthconfig 
CPPFLAGS=-I/usr/local/courier-authlib/include 
./configure --prefix=/usr/local/courier-imap --disable-root-check --with-redhat 

make 
make install 
make install-configure 

vi /usr/local/courier-imap/etc/imapd 

MAXDAEMONS=40 
MAXPERIP=40 
IMAP_EMPTYTRASH=Trash:7,Sent:30 
IMAPDSTART=YES 

cp courier-imap.sysvinit /etc/rc.d/init.d/courier-imap 
chmod 744 /etc/rc.d/init.d/courier-imap 
chkconfig --add courier-imap 
/etc/rc.d/init.d/courier-imap start 

[root@zosen courier-imap-4.0.6]# pstree 
init-+-courierlogger---authdaemond---5*[authdaemond] 
    |-courierlogger---couriertcpd 

[root@zosen courier-imap-4.0.6]# ps aux | grep courier 
root      4192  0.0  0.1  2160  452 ?        S    10:35  0:00 /usr/local/courier-authlib/sbin/courierlogger -pid=/usr/local/courier-authlib/var/spool/authdaemon/pid -start /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4193  0.0  0.3  4204  776 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4194  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4195  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4196  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4197  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root      4198  0.0  0.3  4204  780 ?        S    10:35  0:00 /usr/local/courier-authlib/libexec/courier-authlib/authdaemond 
root    11701  0.0  0.1  1592  388 ?        S    11:17  0:00 /usr/local/courier-authlib/sbin/courierlogger -pid=/var/run/imapd.pid -start -name=imapd /usr/local/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=40 -nodnslookup -noidentlookup 143 /usr/local/courier-imap/sbin/imaplogin /usr/local/courier-imap/bin/imapd Maildir 
root    11702  0.0  0.1  3164  468 ?        S    11:17  0:00 /usr/local/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=40 -nodnslookup -noidentlookup 143 /usr/local/courier-imap/sbin/imaplogin /usr/local/courier-imap/bin/imapd Maildir 
root    11812  0.0  0.2  5796  704 pts/0    R+  11:17  0:00 grep courier 

[root@zosen courier-imap-4.0.6]# netstat -anp | grep LISTEN 
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                  LISTEN      1552/mysqld 
tcp        0      0 0.0.0.0:110                0.0.0.0:*                  LISTEN      18663/tcpserver  -> vpopmail 로써 pop3확인 
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                  LISTEN      9097/httpd 
tcp        0      0 0.0.0.0:21                  0.0.0.0:*                  LISTEN      1971/vsftpd 
tcp        0      0 0.0.0.0:25                  0.0.0.0:*                  LISTEN      5812/sendmail: acce 
tcp        0      0 :::143                      :::*                        LISTEN      11702/couriertcpd  -> imap 확인. 
tcp        0      0 :::22                      :::*                        LISTEN      1951/sshd 
unix  2      [ ACC ]    STREAM    LISTENING    4558  2016/saslauthd      /var/run/saslauthd/mux 
unix  2      [ ACC ]    STREAM    LISTENING    4577  2029/dbus-daemon-1  /var/run/dbus/system_bus_socket 
unix  2      [ ACC ]    STREAM    LISTENING    1240384 4193/authdaemond    /usr/local/courier-authlib/var/spool/authdaemon/socket.tmp 
unix  2      [ ACC ]    STREAM    LISTENING    3738  1552/mysqld        /tmp/mysql.sock
cd /usr/local/src 
wget http://superb.dl.sourceforge.net/sourceforge/squirrelmail/squirrelmail-1.4.5.tar.gz  ===> http://www.squirrelmail.org/download.php (다운페이지) 
cd /usr/local/apache/htdocs 
tar xvzf /usr/local/src/ 
chown -R nobody.nobody squirrelmail-1.4.5 
chmod -R 750 squirrelmail-1.4.5 
ln -s squirrelmail-1.4.5 squirrelmail 

mkdir /var/squirrelmail 
mkdir /var/squirrelmail/data 
mkdir /var/squirrelmail/attach 

cd squirrelmail 
cp data/default_pref /var/squirrelmail/data 
chown -R nobody.nobody /var/squirrelmail 
chmod -R 0770 /var/squirrelmail/data 
chmod -R 0730 /var/squirrelmail/attach 

cd config 
./conf.pl
Main Menu --
1.  Organization Preferences 
2.  Server Settings 
3.  Folder Defaults 
4.  General Options 
5.  Themes 
6.  Address Books 
7.  Message of the Day (MOTD) 
8.  Plugins 
9.  Database 
10. Languages 

D.  Set pre-defined settings for specific IMAP servers 

C  Turn color on 
S  Save data 
Q  Quit 

Command >> D 

Please select your IMAP server: 
    cyrus      = Cyrus IMAP server 
    uw          = University of Washington's IMAP server  (xinetd 의 imap 경우 ->  보통 sendmail에 다람쥐메일설치할경우 선택) 
    exchange    = Microsoft Exchange IMAP server 
    courier    = Courier IMAP server 
    macosx      = Mac OS X Mailserver 
    hmailserver = hMailServer 
    quit        = Do not change anything 
Command >> courier
<VirtualHost 222.122.45.177:80> 
    ServerAdmin webmaster@zosen.net 
    DocumentRoot /usr/local/apache/htdocs/squirrelmail 
    ServerName webmail.zosen.net 
    ErrorLog logs/webmail.zosen.net-error_log 
    CustomLog logs/webmail.zosen.net-access_log common 
</VirtualHost> 
cd /usr/local/apache/htdocs/squirrelmail/ 
wget http://heanet.dl.sourceforge.net/sourceforge/squirrelmail/all_locales-1.4.5-20050904.tar.gz 
tar xvzf all_locales-1.4.5-20050904.tar.gz 
cd locale  ==> 부분에 ko_KR 이있는지 확인.