Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My question is that How can I know that which client's computer is infected? so that I can block him. I am running more than 300 websites on that server. that is really ruining the business. Could someone advice me how to tract that domain or computer? maillog does not provide sufficient information.

share|improve this question
    
Probably difficult to track it down now. But for the future, why not have a wrapper script for sendmail, which adds sender information, like vhost and stuff into a database. With that you could easily find out who to blame. –  derchris Mar 21 '11 at 18:04

2 Answers 2

up vote 1 down vote accepted

Given that you are running websites on the system, you could also have a compromised client script. A spammer can submit data to the script via HTTP, and the script will happily send mail on behalf of the spammer.

The easiest suggest I can give you is to correlate your Apache logs and your message injection logs via timestamp. Look for a timestamp in your Apache access logs around the same time as the message submission (same or a couple of seconds before) and look for a successful post. If you find a few consistent entries, look at that script and see if it sends email. If it does, you probably have your culprit.

If this server also runs a mail server, require SMTP authentication and then read your logs.

share|improve this answer

You could require authentication for SMTP, and provide unique username for each site. Also, disallow direct emailing from that host.

  1. Install SMTP server (for example postfix)
  2. Configure authentication, add users and deliver usernames/passwords to website owners
  3. Wait appropriate time
  4. Block all traffic to SMTP (port 25), except from your postfix processes.

Otherwise it's impossible to tell who is sending emails. If you allow direct connections, everyone can send their spam messages directly to receiving server, and you won't get anything to your email logs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.