0

Hi I have CentOS server which running mail server. Last 2 days server started to send spam. After doing some research I couldn't solve the issue.

Here is portion of statistics from Exim and the interesting thing is: it seems exim sending the messages.

Top 50 local senders by message count
-------------------------------------
  Messages      Bytes    Average   Local sender
      1704     8292KB       4982   exim
         4       2491        622   ********.net

Top 50 local senders by volume
------------------------------
  Messages      Bytes    Average   Local sender
      1704     8292KB       4982   exim
         4       2491        622   *******.net

Top 50 host destinations by message count
-----------------------------------------
  Messages  Addresses      Bytes    Average   Host destination
      1777       1777       26MB       15KB   local
        38        565          0          0   alt1.gmail-smtp-in.l.google.com
        36        431      113KB       3214   gmail-smtp-in.l.google.com
        26         78          0          0   mx.rediffmail.rediff.akadns.net
        25         29          0          0   mx.bt.lon5.cpcloud.co.uk
        21        334          0          0   alt2.gmail-smtp-in.l.google.com
        20         24      765KB       38KB   aspmx.l.google.com
        18        227          0          0   alt3.gmail-smtp-in.l.google.com
        13        203          0          0   alt4.gmail-smtp-in.l.google.com

I tried to get source script which sends emails and run the following command:

[root@server etc]# grep cwd /var/log/exim/main.log|grep -v /var/spool|awk -F"cwd=" '{print $2}'|awk '{print $1}'|sort|uniq -c|sort -n
     35

the output was 35 and no location near it.

Here is my ps aux result if something strange can be seen here:

[root@v65049 ~]# ps aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1  19208   964 ?        Ss   17:05   0:00 init
root         2  0.0  0.0      0     0 ?        S    17:05   0:00 [kthreadd/65049]
root         3  0.0  0.0      0     0 ?        S    17:05   0:00 [khelper/65049]
root       111  0.0  0.0  10644   236 ?        S<s  17:05   0:00 /sbin/udevd -d
root       467  0.0  0.0   6148   476 ?        Ss   17:05   0:00 /sbin/portreserve
root       473  0.0  0.1 183148  1024 ?        Sl   17:05   0:01 /sbin/rsyslogd -i /var/run/syslogd.pid -c 4
named      485  0.0  0.5 165476  4088 ?        Ssl  17:05   0:00 /usr/sbin/named -u named
root       501  0.0  0.0  64316   448 ?        Ss   17:05   0:00 /usr/sbin/sshd
root       536  0.0  0.1 108156  1040 ?        S    17:05   0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysq
mysql      697  0.0  1.7 556116 13672 ?        Sl   17:05   0:07 /usr/libexec/mysqld --basedir=/usr --datadir=/var/li
root       710  0.0  0.1  19288   876 ?        Ss   17:05   0:01 /usr/sbin/dovecot
dovecot    716  0.0  0.1  13000  1016 ?        S    17:05   0:00 dovecot/anvil
root       717  0.0  0.1  13132  1120 ?        S    17:05   0:00 dovecot/log
exim       727  0.0  0.1  91516   860 ?        Ss   17:05   0:00 /usr/sbin/exim -bd -q1h
root       730  0.0  0.2  91944  1876 ?        S    17:05   0:00 /usr/sbin/exim -q
nobody     737  0.0  0.0  55516   740 ?        Ss   17:05   0:00 proftpd: (accepting connections)
root       764  0.0  0.0 117180   744 ?        Ss   17:05   0:00 crond
root       774  0.0  0.0  21428   296 ?        Ss   17:05   0:00 /usr/sbin/atd
root       781  0.0  0.1  38136   860 ?        Ss   17:05   0:03 /usr/local/ispmgr/sbin/eximquota
root       783  0.0  0.1  39516  1232 ?        Ss   17:05   0:00 /usr/local/ispmgr/sbin/ihttpd 0.0.0.0 1500
root       785  0.0  0.0   4052   500 tty1     Ss+  17:05   0:00 /sbin/mingetty console
root       787  0.0  0.0   4052   500 tty2     Ss+  17:05   0:00 /sbin/mingetty tty2
root       850  0.0  0.2  94084  2228 ?        S    17:05   0:00 sshd: root@notty
root       889  0.0  0.1  55616  1056 ?        Ss   17:05   0:00 /usr/libexec/openssh/sftp-server
root       902  0.0  0.2  95184  2232 ?        S    17:05   0:02 sshd: root@pts/0
root       908  0.0  0.1 108392  1252 pts/0    Ss+  17:05   0:00 -bash
root       935  0.0  0.2  93944  2236 ?        S    17:06   0:01 sshd: root@pts/1
root       938  0.0  0.1 108404  1172 pts/1    Ss   17:06   0:00 -bash
root       978  0.0  0.0 100928   520 pts/1    S+   17:06   0:00 tail -f /var/log/maillog
root      4884  0.0  0.2  91944  1884 ?        S    18:05   0:00 /usr/sbin/exim -q
root      9112  0.0  0.2  91948  1892 ?        S    19:05   0:00 /usr/sbin/exim -q
root     13562  0.0  0.2  91944  1900 ?        S    20:05   0:00 /usr/sbin/exim -q
root     18115  0.0  0.3  91948  3060 ?        S    21:05   0:00 /usr/sbin/exim -q
root     18231  0.0  0.4  93944  3268 ?        S    21:06   0:00 sshd: root@pts/2
root     18235  0.0  0.2 108292  1732 pts/2    Ss+  21:06   0:00 -bash
root     20963  0.0  0.4  93944  3284 ?        S    21:35   0:00 sshd: root@pts/3
root     20974  0.0  0.2 108292  1812 pts/3    Ss   21:35   0:00 -bash
501      23921  0.0  0.4  43208  3332 ?        S    22:05   0:00 dovecot/imap
root     31184  0.0  1.2 396524  9840 ?        Sl   23:12   0:00 bin/ispmgr
root     31700  0.0  0.2  92212  2296 ?        S    23:19   0:00 /usr/sbin/exim -q
exim     31807  0.0  0.2  92408  2056 ?        S    23:20   0:00 /usr/sbin/exim -q
root     31857  0.1  0.2  92344  2276 ?        S    23:20   0:00 /usr/sbin/exim -q
root     31858  0.0  0.2  92344  2248 ?        S    23:20   0:00 /usr/sbin/exim -q
exim     31860  0.2  0.4  92540  3632 ?        S    23:20   0:00 /usr/sbin/exim -q
root     31863  0.0  0.2  92080  2148 ?        S    23:20   0:00 /usr/sbin/exim -q
exim     31865  0.3  0.4  92536  3712 ?        S    23:20   0:00 /usr/sbin/exim -q
exim     31868  0.4  0.4  92540  3684 ?        S    23:20   0:00 /usr/sbin/exim -q
exim     31869  0.2  0.5  92540  3940 ?        S    23:20   0:00 /usr/sbin/exim -q
root     31870  0.2  0.2  92080  2136 ?        S    23:20   0:00 /usr/sbin/exim -q
exim     31872  0.1  0.4  92348  3372 ?        S    23:20   0:00 /usr/sbin/exim -q
exim     31876  0.5  0.4  92572  3640 ?        S    23:20   0:00 /usr/sbin/exim -q
root     31877  0.0  0.1 110216  1140 pts/3    R+   23:20   0:00 ps aux

Please suggest what can I try to solve the issue and thanks in advance.

P.S. I have Apache running on the sever. I stopped it but the server continues to send emails.

Improve this question
4
  • 7
    Though shalt nuke it and rebuild.
    – Zoredache
    Sep 24, 2014 at 18:02
  • Local delivery is usually it bouncing mail back. But, as @Zoredache pointed out...take it out of production and rebuild it.
    – Nathan C
    Sep 24, 2014 at 18:03
  • @Zoredache you mean whole server or just exim?
    – simon
    Sep 24, 2014 at 19:10
  • 2
    The question should not be "whole server or just exim?", but rather "the whole VLAN or only the server?"
    – Mircea Vutcovici
    Sep 24, 2014 at 19:23

1 Answer 1

Reset to default
0

Try this and you can create a log entry which tells you the origin script.

http://blog.rimuhosting.com/2012/09/20/finding-spam-sending-scripts-on-your-server/

Extract from the link above (the essence):

By simply adding the following 2 lines into your php.ini then you can track down pretty much any outgoing spam using PHP

mail.add_x_header = On
mail.log = /var/log/phpmail.log
Improve this answer
3
  • Links can go dead, and when that happens this answer will be useless. Please make sure your answer is complete and includes all the necessary information.
    – Michael Hampton
    Sep 24, 2014 at 18:40
  • This will help if spammer is a php script, but as I mentioned I turned off httpd and the server continues to send mails.
    – simon
    Sep 24, 2014 at 19:11
  • and there isn't anything else running that might be able to run af webserver? php scripts can be run without a webserver....cmdline via cron for instance
    – ubunturinzler
    Sep 24, 2014 at 19:17

Not the answer you're looking for? Browse other questions tagged .