My question is that How can I know that which client's computer is infected? so that I can block him. I am running more than 300 websites on that server. that is really ruining the business. Could someone advice me how to tract that domain or computer? maillog does not provide sufficient information.
2 Answers
Given that you are running websites on the system, you could also have a compromised client script. A spammer can submit data to the script via HTTP, and the script will happily send mail on behalf of the spammer.
The easiest suggest I can give you is to correlate your Apache logs and your message injection logs via timestamp. Look for a timestamp in your Apache access logs around the same time as the message submission (same or a couple of seconds before) and look for a successful post. If you find a few consistent entries, look at that script and see if it sends email. If it does, you probably have your culprit.
If this server also runs a mail server, require SMTP authentication and then read your logs.
You could require authentication for SMTP, and provide unique username for each site. Also, disallow direct emailing from that host.
- Install SMTP server (for example postfix)
- Configure authentication, add users and deliver usernames/passwords to website owners
- Wait appropriate time
- Block all traffic to SMTP (port 25), except from your postfix processes.
Otherwise it's impossible to tell who is sending emails. If you allow direct connections, everyone can send their spam messages directly to receiving server, and you won't get anything to your email logs.