Origin of Spam Email

Question

I'm running Ubuntu with POSTFIX and I have spam mail continually trying to be sent out. I have blocked it all from the email server that they are going out on and now they are just continually being queued up. The server is running php/mysql with a number of websites on it. How can I tell where the messages are coming from? ie. from a php file on the server being executed or where?

example of mailq

2A8CA2D447   444542 Wed Feb 29 09:07:27  www-data@servername.com
(delivery temporarily suspended: lost connection with emailserver[emailserverip] while receiving the initial server greeting)
                                         lilibetharias1011@hotmail.com

Any help would be appreciated

Answer 1

Sounds like you have someone who hacked the server. There could be rootkits, invisible processes...if you're lucky it's just a script generating it. If you disconnect the computer from the network is it still trying to send more new mails? Then it's something on the server generating the mail.

The problem is that even if you clean what you can, you can't be sure you entirely cleaned it up.

Best practice is to wipe the machine and rebuild, and go back through your PHP code and SQL (if you're using a database) and verify you have all patches and no SQL injections possible, auditing everything you can. Then verify that you don't have Postfix set up as a mail relay, only allowing your own machine or your own IP or own subnet to send mail.

Answer 2

The single log message you provide does not tell you any of this explicitly.

The fact that the eventual sender address is www-data@servername.com implies that it was sent through an apache-owned process, probably php mail().

You cannot trivially forbid one web site to submit mail locally through sendmail(1) yet allow others the same thing; instead, consider denying all local mail submission and requiring web sites to submit mail over local SMTP.

If you wish to prevent any apache-owned processes to send mail for now, add the following to main.cf:

authorized_submit_users = !www-data, static:all

and reload postfix:

# postfix reload

Answer 3

You should probably examine the answers to this question:

• http://stackoverflow.com/questions/8898003/virtual-hosts-postfix-mail-log-show-sending-website

That would allow you to narrow down the domain/site which is sending these spam mails. Failing that you could look at your mail-server logs to see what time the mail was sent - then look for a corresponding POST in your Apache logs a second or so before that time. That might allow you to get lucky and determine the script which sent the mail..