Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server's been hacked EMERGENCY

I have a configured dovecot + postfix + mysql. Few days ago i have received abuse from DC that i am sending spam.

And really in the /var/log/mail.log i have found records of sending mails not by me , or my website. I have blocked outgoing 25 port as a precoution. First of all i have greped all the PHP scripts for base64_decode, eval and so on. No success. Also i have turned mail function from php by adding it to disable_function list. But spam is still going from my server and i do not understand where does it come from. Which application or which script causes that.

In /var/log/mail* logs i only see the fact that email was sent. I can see the content of it looking into /var/spool/postfix/... . But i need to find the PID or the PHP script which sends it.

Do you have any ideas on how to do it? I see that email comes from "root@..." so maybe it`s root-level running backdoor or something. Please, help.

share|improve this question

marked as duplicate by voretaq7 Aug 25 '12 at 2:42

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Can you post an excerpt of the outgoing logs? Specifically the lines you have pointed out above? – Tim Dec 25 '11 at 1:41

It could certainly smell like someone is doing something rather nasty on your machine.

First, you might want to check /tmp. Very often attackers put their "programs" down there, because they have easy access to it there. Simply list the files and look for anything unusual.

Next thing, take a process list "ps auxf" which should give you a nested overview. Go through every single line, see if a process you don't know is running. If there is something unfamiliar, google the name and see if teh interwebz knows something.

You can also do "netstat -nap" to see network connections and the process they belong to.

It can be quite a job to hunt this down, but it sounds like something on your server is the sinner, if you see nothing in the maillog about a connection coming from somewhere else.

share|improve this answer
I thought they somehow used postfix as a open relay so i tcpdump dst port 25 tcp but no success. Incoming packets where not ones that contained that spam. I do not see something suspicious in netstat -nlp and ps aux ... – Radium Dec 25 '11 at 7:54

If you are not seeing any suspect connection in netstat and you've already closed port 25, the spammer may be very well sending using the local /usr/bin/sendmail via php Mail() instead of connecting from the outside.

When every other method fails, you could also substitute /usr/bin/sendmail with a script which prints the PID of its parent process, as in the following:

echo $PPID > /tmp/parent_pids.log
share|improve this answer
Why? In 99% of all cases it will be the apache process. – mailq Dec 25 '11 at 11:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.