Hi I have Debian Linux server which serves several PHP sites. Today I received mail from Datacenter where they say my server is sending spam and attached spam message. This was really message from my server and I managed to find it in exim4 mainlog. Question: how to identify where is the vulnerability in PHP code and which site (i have 3) send this mail? I've chrooted one site already and disabled php mail and all exec,system etc. functions for it but i'm not sure taht it is site sending mail. Any way to log message body for all outgoing mail?
You could write & configure a wrapper around sendmail that does more logging
Or in your php code, you could write your own mail function that acts as a wrapper around php mail that does the logging. Remember to validate all input.