Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a CentOS server, running Sendmail and ISPConfig as the panel. We recently noticed a huge increase in traffic coming from a phoney yahoo account. The logs show hundreds of emails being sent in a short time.

We are trying to isolate the script, but we have multiple sites running and don't know where to look first.

Ideas?

-- Since there have been no results, I assume either people don't know, it's never going to be easy or I'm not supplying enough information.

We have tried searching the files on the server for '@yahoo' and similar, but there's a chance it's getting the email address from an external site or file. Can we easily determine any references to external files? We use internal .js files for everything, so there shouldn't be too many of them.

or any other idea..

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Why do you consider that it must be a script on your server that is sending those emails ? you mention that you have sendmail on the machine running - maybe it is acting as open relay or someone has setup another process that forwards mail from it to your real sendmail?

Check your host open relay tester first, maybe: http://www.abuse.net/relay.html

So, atleast i'd start by this check list:

  • check if sendmail acts as open relay
  • stop sendmail for sending all mails and check what comes into the queue - the headers in the raw email itself could offer some clues ?
  • check what ports you have open and verify that each open port you have correspends to application you know that should be running.
  • during the flood of emails coming into your server, check what is happening with netstat and lsof
share|improve this answer
    
This is actually what we ended up doing. It appears that it might have been the issue. Thanks! –  gamerzfuse Aug 10 '10 at 12:47

You could run lsof while the spam is going on to see which files on the server are being accessed.

Also, while the spam is in the queue, try looking at the content of the message before it goes out to see if it provides any clues as to where it's from. For example, if it's from a form on one of the sites hosted on the server, it might reveal a unique field on the form, which you can then grep out of your site files.

share|improve this answer
    
I think we'll try that and see if we can figure out if it's a local file or not. –  gamerzfuse Aug 9 '10 at 17:57
    
Unfortunately, this probably would have worked, but our server doesn't support that function (it's a bit dated, admittedly). Is there an old-fashioned way of doing that? –  gamerzfuse Aug 9 '10 at 18:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.