Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Please help!

On sunday I started receiving a lot of email bounces which I investigated right away and saw someone who hadn't logged in seemed to be using vbulletin's sendmessage.php to send SPAM as www-data@ using my host.

So I disabled the script, shutdown postfix temporarily and deleted all email in the queue from www-data thinking the problem was now solved however I've started receiving a lot more bounces but this time I'm not seeing any trace of a script being used to send email.

Mail queue commands:

postqueue -p
mailq | tail -n +2 | awk 'BEGIN { RS = "" } / www-data/ { print $1 }' | tr -d '*!' | postsuper -d -

So how can this be?

I'm quite upset at the idea of this being done and would really like to put a stop to it now! And I've had a look at my host and I don't think anyone has accessed the shell although it's not impossible of course but I lock it down by IP address and I'm not seeing any unusual file edits when I search by last modified date.

From /var/log/mail.log:

Mar  5 03:38:39 wibble postfix/pickup[29971]: 16A91326175A: uid=33 from=<www-data>
Mar  5 03:38:39 wibble postfix/cleanup[27646]: 16A91326175A: message-id=<201303050938391.16A91326175A@mail.example.com>
Mar  5 03:38:39 wibble postfix/qmgr[17470]: 16A91326175A: from=<www-data@example.com>, size=2624, nrcpt=1 (queue active)
share|improve this question
    
This is probably a duplicate of serverfault.com/questions/218005/… .. –  NickW Mar 5 '13 at 10:51
    
I've just run rkhunter and chkrootkit. Neither is finding anything to report. –  Fat Finger Mar 5 '13 at 10:59
    
I'd say you probably have someone exploiting a form on a website. –  NickW Mar 5 '13 at 11:04
    
I installed mod security and found the culprit. It was a form. –  Fat Finger Mar 5 '13 at 11:23
    
Yeah, php mail() forms are often poorly protected against malicious users. –  NickW Mar 5 '13 at 11:26
show 2 more comments

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.