How can I find out which application is sending emails?
On the server I have qmail. I would like to check if there is some kind of script or application that sends emails (something like spam application). Is it possible to find out that?
Add a comment
|
2 Answers
qmail denotes the numeric user id of the system account in the headers. Look for a header in this form:
Received: (qmail 24531 invoked by uid 533); 26 Aug 2010 21:08:19 -0000
In this example you can quickly see that user 533 has produced this mail. In a web hosting environment with cleanly separated users this should help much.
However, qmail can't tell you which application created the mail in question (in fact, the mail may have reached qmail through a pipe to /var/qmail/bin/qmail-inject or /usr/sbin/sendmail so that qmail has no way of knowing who is producing the mail.
If you're facing a spammer, it would be a good idea to check your access_log: Look for timestamps that are identical with the timestamps of the mail in question.
-
-
Well - simply don't open port 25 without using some selective relaying method, ideally SMTP AUTH. Most SMTP AUTH patches for qmail leave the username of the authenticated user in the headers. (Many SMTP servers are pre-configured to allow relaying from localhost without any further authorization. I consider this bad practice.)– JonasAug 27, 2010 at 10:43
Check if it is caused by a rootkit download and run rootkit_hunter: http://www.rootkit.nl/projects/rootkit_hunter.html
