My debian server is sending spam, and I don't know why :(

Question

I got my first dedicated server a couple of months ago, using it to learn Linux and server admin, and to host a couple personal sites. I'm very new to Linux, so I used examples and tutorials found across the web to set up the Debian 6 install I'm using. I even kept a list of all the steps I took, which can be found here:

https://docs.google.com/document/d/1WfuZwFPeUNEiTcru_95oHfPekviputcLTE4040Q4vL4/edit

Anyway, a couple of weeks ago I received notification from my host that I was sending spam. My first step was to uninstall exim (which is why step 10 is crossed out), and replaced it with MSMTP, and set-up logging.

The problem is, this didn't solve the problem. I had a friend of mine look at it, who suggested it might be an open relay, but wasn't. This lead him to give up, because he can't even tell what was sending the mail.

I've set-up mail logging in php.ini, and keeping an eye on that log, but that is only reporting legitimated emails, so I'm at a complete loss. Can anyone help me out?

Below are links to a couple of the reports I've had...

• http://snipt.org/zmls3
• http://snipt.org/zmlH9

Answer 1

If your server has been infected by malware, it doesn't matter that you've changed mail servers, or secured it after the fact. It's a bit like putting heavy duty deadlocks on your door, but the robber is already inside your house.

The quick way to make sure the spam is stopping, is to disable Port 25 outbound using your firewall (iptables). This will of course disable legitimate mail as well, but that's better than actually sending out spam as far as I'm concerned.

If your server really has been infected with malware, the only solution is to wipe it and start again. But preferably after you've figured out how it got in in the first place, and make sure you patch that hole next time around.

For the record, before I even looked at your google doc, I thought "Hmm, I bet he has phpmyadmin installed." From what I can tell, it seems to be a piece of software just filled with security holes waiting to be exploited. If you really, really must use it, configure apache to require authentication for the phpmyadmin folder so that random bot scanners just pass it by. (personally, I prefer software such as SQLYog that connects to the hosted MySQL instance, but you only open the MySQL ports through the firewall for your remote IP address, if you have a static one)