{"id":369,"date":"2026-09-19T11:36:53","date_gmt":"2026-09-19T11:36:53","guid":{"rendered":"https:\/\/rbl.watch\/blog\/zimbra-spam-tespiti\/"},"modified":"2026-09-19T11:36:53","modified_gmt":"2026-09-19T11:36:53","slug":"zimbra-spam-tespiti","status":"publish","type":"post","link":"https:\/\/rbl.watch\/blog\/zimbra-spam-tespiti\/","title":{"rendered":"Zimbra&#8217;da Spam Kayna\u011f\u0131n\u0131 Bulma"},"content":{"rendered":"\n<div style=\"border-left:4px solid #f59e0b;background:#fffbeb;padding:14px 18px;border-radius:8px;margin:0 0 8px;\">\n<strong>\u26a0\ufe0f \u00d6nce \u015funu bilin:<\/strong> Kara listeden <strong>\u00e7\u0131karma talebi son ad\u0131md\u0131r.<\/strong> Kayna\u011f\u0131 kapatmadan \u00e7\u0131karma istemek IP&#8217;nizi hemen yeniden listeler ve self-service \u00e7\u0131karma hakk\u0131n\u0131z\u0131 yakar. Kayna\u011f\u0131 kapat\u0131n; \u00e7o\u011fu liste kendili\u011finden d\u00fc\u015fer. Bkz. <a href=\"\/blog\/delist-oncesi-kontrol-listesi\/\">\u00e7\u0131karma \u00f6ncesi kontrol listesi<\/a>.\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Zimbra kendi log ve ara\u00e7 setini kulland\u0131\u011f\u0131 i\u00e7in genel Postfix rehberleri burada yar\u0131m kal\u0131r. Bu makale <code>zmprov<\/code>, <code>zmqstat<\/code> ve <code>audit.log<\/code> \u00fc\u00e7l\u00fcs\u00fcyle spam kayna\u011f\u0131n\u0131 (ele ge\u00e7irilmi\u015f hesab\u0131 veya geni\u015f relay yap\u0131land\u0131rmas\u0131n\u0131) dakikalar i\u00e7inde bulman\u0131z\u0131 sa\u011flar. Platform emin de\u011filseniz \u00f6nce <a href=\"\/blog\/sunucudan-spam-tespiti\/\">te\u015fhis ak\u0131\u015f\u0131na<\/a> bak\u0131n (Zimbra portu: 7071).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hangi Log Ne S\u00f6yler?<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>zimbra.log<\/strong> \u2014 MTA (Postfix\/amavis) trafi\u011fi; g\u00f6nderim ve SASL kimlik do\u011frulamas\u0131 burada.<\/li>\n<li><strong>mailbox.log<\/strong> \u2014 store (mailbox) katman\u0131 olaylar\u0131.<\/li>\n<li><strong>audit.log<\/strong> \u2014 kimlik do\u011frulama; ba\u015far\u0131l\u0131\/ba\u015far\u0131s\u0131z giri\u015fler ve kaynak IP&#8217;ler.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Ele Ge\u00e7irilmi\u015f Hesab\u0131 Bulma (SASL Say\u0131m\u0131)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Bir hesap di\u011ferlerinden kat kat fazla kimlik do\u011fruluyorsa \u015f\u00fcphelidir:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># En \u00e7ok kimlik do\u011frulayan hesap \u2014 biri di\u011ferlerinden kat kat fazlaysa \u015f\u00fcpheli\ncat \/var\/log\/zimbra.log | sed -n 's\/.*sasl_username=\/\/p' | sort | uniq -c | sort -nr | head<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Kuyruk Analizi ve Relay Yap\u0131land\u0131rmas\u0131<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># Kuyruk durumu\nsu - zimbra -c zmqstat\n\n# Relay aral\u0131\u011f\u0131 fazla geni\u015f mi \u2014 en s\u0131k yap\u0131lan yap\u0131land\u0131rma hatas\u0131\nsu - zimbra -c 'zmprov gs $(hostname) zimbraMtaMyNetworks'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>zimbraMtaMyNetworks<\/code> de\u011feri gere\u011finden geni\u015f bir aral\u0131k (\u00f6r. t\u00fcm bir \/16) i\u00e7eriyorsa, kimli\u011fi do\u011frulanmam\u0131\u015f \u00fc\u00e7\u00fcnc\u00fc taraflar sunucunuz \u00fczerinden g\u00f6nderim yap\u0131yor olabilir. Yaln\u0131zca g\u00fcvenilir yerel aral\u0131klar\u0131 b\u0131rak\u0131n.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">audit.log&#8217;ta Yabanc\u0131 \u00dclkeden Ba\u015far\u0131l\u0131 Giri\u015f<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># Ba\u015far\u0131l\u0131 kimlik do\u011frulamalar\u0131 ve kaynak IP'ler \u2014 beklenmedik \u00fclke\/IP aray\u0131n\ngrep 'oip=' \/var\/log\/zimbra\/audit.log | sed -n 's\/.*account=\/\/p' | sort | uniq -c | sort -nr | head<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Bir hesab\u0131n normalde hi\u00e7 ba\u011flanmad\u0131\u011f\u0131 bir \u00fclkeden ba\u015far\u0131l\u0131 giri\u015f yapmas\u0131, ele ge\u00e7irilmenin en net kan\u0131t\u0131d\u0131r.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">M\u00fcdahale S\u0131ras\u0131<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">S\u0131ra \u00f6nemlidir: \u00f6nce kayna\u011f\u0131 kesin, sonra kuyru\u011fu temizleyin \u2014 ters s\u0131rada kuyruk tekrar dolar.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># 1) Hesab\u0131 kilitle\nsu - zimbra -c 'zmprov ma kullanici@alan.com zimbraAccountStatus locked'\n\n# 2) Parolay\u0131 de\u011fi\u015ftir\nsu - zimbra -c 'zmprov sp kullanici@alan.com YeniGuvenliParola!'\n\n# 3) Kuyru\u011fu incele\/temizle, ard\u0131ndan MTA'y\u0131 yeniden ba\u015flat\nsu - zimbra -c zmmtactl restart<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Kal\u0131c\u0131 Koruma: Hesap Ba\u015f\u0131na G\u00f6nderim Limiti<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Zimbra&#8217;da <strong>cbpolicyd<\/strong> ile hesap ba\u015f\u0131na g\u00f6nderim limiti tan\u0131mlayarak, ele ge\u00e7irilen tek bir hesab\u0131n t\u00fcm sunucuyu kara listeye d\u00fc\u015f\u00fcrmesini engelleyebilirsiniz. Kurumsal \u00f6l\u00e7ekte y\u00f6netilen bir <a href=\"https:\/\/www.ihs.com.tr\/sunucu-kiralama\/zimbra-mail-sunucusu.html\" target=\"_blank\" rel=\"noopener\">Zimbra mail sunucusu<\/a> bu koruma katmanlar\u0131n\u0131 haz\u0131r sunar. Genel \u00f6nlemler i\u00e7in <a href=\"\/blog\/spam-tekrarini-onleme\/\">kal\u0131c\u0131 \u00f6nlemler<\/a> makalesine bak\u0131n.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kaynak Kapand\u0131 m\u0131? Son Kontrol<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u2610 \u015e\u00fcpheli hesap kilitli ve parolas\u0131 de\u011fi\u015fti<\/li>\n<li>\u2610 <code>zmqstat<\/code> kuyru\u011fu normale d\u00f6nd\u00fc<\/li>\n<li>\u2610 <code>zimbraMtaMyNetworks<\/code> yaln\u0131zca g\u00fcvenilir aral\u0131klar\u0131 i\u00e7eriyor<\/li>\n<li>\u2610 cbpolicyd ile g\u00f6nderim limiti devrede<\/li>\n<li>\u2610 IP yeni tespit alm\u0131yor \u2014 <a href=\"\/blacklist-check\">kontrol edin<\/a>, sonra <a href=\"\/blog\/delist-oncesi-kontrol-listesi\/\">\u00e7\u0131karmay\u0131 de\u011ferlendirin<\/a><\/li>\n<\/ul>\n\n","protected":false},"excerpt":{"rendered":"<p>\u26a0\ufe0f \u00d6nce \u015funu bilin: Kara listeden \u00e7\u0131karma talebi son ad\u0131md\u0131r. Kayna\u011f\u0131 kapatmadan \u00e7\u0131karma istemek IP&#8217;nizi hemen yeniden listeler ve self-service \u00e7\u0131karma hakk\u0131n\u0131z\u0131 yakar. Kayna\u011f\u0131 kapat\u0131n; \u00e7o\u011fu liste kendili\u011finden d\u00fc\u015fer. Bkz. \u00e7\u0131karma \u00f6ncesi kontrol listesi. Zimbra kendi log ve ara\u00e7 setini kulland\u0131\u011f\u0131 i\u00e7in genel Postfix rehberleri burada yar\u0131m kal\u0131r. Bu makale zmprov, zmqstat ve audit.log \u00fc\u00e7l\u00fcs\u00fcyle &#8230; <a title=\"Zimbra&#8217;da Spam Kayna\u011f\u0131n\u0131 Bulma\" class=\"read-more\" href=\"https:\/\/rbl.watch\/blog\/zimbra-spam-tespiti\/\" aria-label=\"Read more about Zimbra&#8217;da Spam Kayna\u011f\u0131n\u0131 Bulma\">Devam\u0131n\u0131 oku<\/a><\/p>\n","protected":false},"author":2,"featured_media":370,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nasil-yapilir"],"_links":{"self":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/posts\/369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/comments?post=369"}],"version-history":[{"count":0,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/posts\/369\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/media\/370"}],"wp:attachment":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/media?parent=369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/categories?post=369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/tags?post=369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}