Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm testing some functionality for a new service I'm putting together. I have mail service setup powered by Postfix. I'm using Ubuntu Linux Natty (11.04)

I am trying to find a way to detect when the PHP mail() function is being used to send spam. I understand that there are some scripts that users may upload that open up vulnerabilities that may be exploited later. This scenario could also play out when the user attempts to use the mail() function to send mails to multiple accounts (thousands) to the point where it slows down the server.

What command-line tools on Ubuntu can I use to:

  1. Detect this abuse
  2. Isolate what user's account is being used to do this
  3. Shutdown the activity

Just looking for some pointers that I can do read up on.

Thanks in advance.

share|improve this question
1  
Might want to work on your accept rate –  Justin Pearce Mar 3 '12 at 2:26

1 Answer 1

up vote 1 down vote accepted

I imagine you already have some method of telling which mails were sent by which users or which scripts. If you don't, that would be the first thing to work on. Look at VERP and the smtp-id.

The raw numbers per user/script will be a good indicator of spamminess. My experience with spammers is that they don't try to hide, they just try to blast out as many emails as they can before they are caught.

Graphing these numbers in something like Cacti, munin or Zabbix is very useful.

I would also install Spamassassin and run the outbound mail through it. A combination of high volume and high spam score would definitely be worth looking in to.

As for stopping any abuse once it's detected. chmod 000 the script and use mailq and postsuper -d to kill any mail that's still in the mail queue.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.