Spam outburst in an Exim server

Question

I have a Linux server running Exim. Some user is sending spam. I can tell this because almost every 24 hours I'm getting a huge number of undelivered mail in the nobody account.

I can see how the Exim queue quickly grows and, until now, I had to restart the server for the flood to stop.

I've tried using ps and top to identify the account that is generating the spam but I guess it's through a php script and it is being ran as nobody.

How could I trace the offending account / script ?

Thanks,

Answer 1

Nothing should run as nobody. Anything being run as nobody should be changed to run as the users responsible for them. If you've got a pile of shared-hosting PHP all running as the webserver user (the most common 'nobody' source -- RedHat has a lot to answer for), stop doing that -- use suPHP or something to bring back a bit of accountability.

In the immediate term, though, you should be able to correlate spam runs in your logs with hits in your webserver logs if it's a bodgy PHP script; once you've got the script, it's trivial to fix it or knobble it.

Answer 2

"almost every 24 hours I'm getting a huge number of undelivered mail in the nobody account"

That may actually be indicative of a backscatter attack. If you do not already have SPF setup for your domain(s), you might consider setting it up. It will not stop a backscatter attack, but will give some of the other systems a chance to reject the forged messages which are not originating from your infrastructure.