Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Hi I have Debian Linux server which serves several PHP sites. Today I received mail from Datacenter where they say my server is sending spam and attached spam message. This was really message from my server and I managed to find it in exim4 mainlog. Question: how to identify where is the vulnerability in PHP code and which site (i have 3) send this mail? I've chrooted one site already and disabled php mail and all exec,system etc. functions for it but i'm not sure taht it is site sending mail. Any way to log message body for all outgoing mail?

share|improve this question
    
You are sure is a problem with PHP and not with your apache proxy ? –  Sacx Mar 22 '11 at 13:27
    
100% php. I can see headers in message indicating that it was PHP who send this message –  Dmytro Leonenko Mar 22 '11 at 14:17

1 Answer 1

up vote 3 down vote accepted

You could write & configure a wrapper around sendmail that does more logging

in php.ini:

sendmail_path = /usr/sbin/sendmail -t -i

change to:

sendmail_path = /usr/local/bin/myscript

Or in your php code, you could write your own mail function that acts as a wrapper around php mail that does the logging. Remember to validate all input.

share|improve this answer
    
OK. But what is the format of the wrapper? Any example (in any language in any form)? –  Dmytro Leonenko Mar 22 '11 at 14:16
    
Suggest you do the 2nd option, if you are running php sites you should be able to write it. –  jamespo Mar 22 '11 at 15:01
    
Look like it is what i need iezzi.ch/archives/217 –  Dmytro Leonenko Mar 22 '11 at 15:05
    
yes, that looks good –  jamespo Mar 22 '11 at 15:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.