Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I got my first dedicated server a couple of months ago, using it to learn Linux and server admin, and to host a couple personal sites. I'm very new to Linux, so I used examples and tutorials found across the web to set up the Debian 6 install I'm using. I even kept a list of all the steps I took, which can be found here:

https://docs.google.com/document/d/1WfuZwFPeUNEiTcru_95oHfPekviputcLTE4040Q4vL4/edit

Anyway, a couple of weeks ago I received notification from my host that I was sending spam. My first step was to uninstall exim (which is why step 10 is crossed out), and replaced it with MSMTP, and set-up logging.

The problem is, this didn't solve the problem. I had a friend of mine look at it, who suggested it might be an open relay, but wasn't. This lead him to give up, because he can't even tell what was sending the mail.

I've set-up mail logging in php.ini, and keeping an eye on that log, but that is only reporting legitimated emails, so I'm at a complete loss. Can anyone help me out?

Below are links to a couple of the reports I've had...

share|improve this question
    
Do you have any form which sends emails on any of the websites running on your Linux box? I would also check your webserver logs for any anomaly. –  Sameer Feb 6 '12 at 10:46
    
possible duplicate of My server's been hacked EMERGENCY –  John Gardeniers Feb 6 '12 at 10:51

1 Answer 1

up vote 2 down vote accepted

If your server has been infected by malware, it doesn't matter that you've changed mail servers, or secured it after the fact. It's a bit like putting heavy duty deadlocks on your door, but the robber is already inside your house.

The quick way to make sure the spam is stopping, is to disable Port 25 outbound using your firewall (iptables). This will of course disable legitimate mail as well, but that's better than actually sending out spam as far as I'm concerned.

If your server really has been infected with malware, the only solution is to wipe it and start again. But preferably after you've figured out how it got in in the first place, and make sure you patch that hole next time around.

For the record, before I even looked at your google doc, I thought "Hmm, I bet he has phpmyadmin installed." From what I can tell, it seems to be a piece of software just filled with security holes waiting to be exploited. If you really, really must use it, configure apache to require authentication for the phpmyadmin folder so that random bot scanners just pass it by. (personally, I prefer software such as SQLYog that connects to the hosted MySQL instance, but you only open the MySQL ports through the firewall for your remote IP address, if you have a static one)

share|improve this answer
1  
Since you are now using MSTMP via Google instead of Exim and the instructions you posted are using TLS on port 587, blocking port 25 outbound is safe and a very good idea. An even better idea is blocking everything and then allowing the known ports / hosts combinations (such as destination port 587 to Google and source port 22 to wherever you log in from). –  Ladadadada Feb 6 '12 at 10:46
    
The idea of blocking port 25 sounds like a very good one, and a good temporary fix, although I will be choosing to reinstall the OS (probably going with ubuntu this time). I did a quick search on blocking port 25 and run the following command: sudo iptables -A OUTPUT -p tcp --dport 25 -j DROP - is that correct? –  Daniel Hollands Feb 6 '12 at 10:54
    
@DanielHollands - honestly, iptables isn't my thing, but that looks OK to me –  Mark Henderson Feb 6 '12 at 19:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.