I'm testing some functionality for a new service I'm putting together. I have mail service setup powered by Postfix. I'm using Ubuntu Linux Natty (11.04)
I am trying to find a way to detect when the PHP mail() function is being used to send spam. I understand that there are some scripts that users may upload that open up vulnerabilities that may be exploited later. This scenario could also play out when the user attempts to use the mail() function to send mails to multiple accounts (thousands) to the point where it slows down the server.
What command-line tools on Ubuntu can I use to:
- Detect this abuse
- Isolate what user's account is being used to do this
- Shutdown the activity
Just looking for some pointers that I can do read up on.
Thanks in advance.