5

I'm worried about dodgy php scripts or other malicious software on my linux server sending out spam. Or maybe I left an open relay

What are the ways to check I'm not sending any spam out?

Improve this question

7 Answers 7

Reset to default
5

One of the easiest ways is to check your /var/log/maillog (default location) to see if it's sending out mail that you're not expecting.

Improve this answer
5
  • That's exactly what I'm looking for, Thanks! (strangely, that file doesn't exist on my server though)
    – aidan
    Feb 26, 2010 at 10:27
  • Well- depending on your setup, it might be elsewhere (try a search)- else, could it be that you haven't sent any mail yet?
    – AliGibbs
    Feb 26, 2010 at 10:42
  • might be mail.log in ubuntu. looks clear.
    – aidan
    Feb 26, 2010 at 11:00
  • Looking at help.ubuntu.com/8.04/serverguide/C/postfix.html it does seem that the default mail location is /var/log/mail.log Might be worth writing a test php mail script (or I have one if you want) to check its logging to this location
    – AliGibbs
    Feb 26, 2010 at 11:06
  • 5
    The MTA (mail transfer agent) installed on the server may not be used at all, and the spam may still be sent from the machine by other means: e.g. misconfigured proxy server or malicious software running on the machine and sending the emails directly (not using local MTA).
    – Jacek Konieczny
    Feb 26, 2010 at 12:33
1

I've used abuse.net in the past to check that my server is not an open relay.

Not used it for a while though, but gotta be worth a quick test if you're worried/unsure.

Improve this answer
1
  • That's a useful link to have. Using it now. thanks.
    – aidan
    Feb 26, 2010 at 11:00
1

Do you have PHP scripts on your server that make use of email? Make damn sure that those don't allow visitors to specify the address that mail is sent to. That means not having To fields in forms that create email.

That alone is not enough, as spammers can inject mail headers into poorly written mailer scripts. Check out http://www.alt-php-faq.org/local/115/ for a discussion on this.

You may not have control of all the scripts on your server, so you may want to read http://ilia.ws/archives/149-mail-logging-for-PHP.html which gives details of a PHP extension which logs all use of the mail function. That will give you a specific place to look for PHP related mail activity, which may be useful if you also send mail legitimately from this server.

Improve this answer
1

The best way is to monitor traffic generated by the machine. This may show if something suspicious is happening no matter what is the source of the spam (is that badly configured mail server, badly configured proxy or some malicious software). Especially take look at outgoing connections to port 25. If you can see much more such connection than mails the machine is supposed to send, then the machine is probably abuse. But closer inspection you can also find many 'MX' queries (sent to find victims' name servers) or suspicious incoming connections (used to control a 'trojan horse' software).

Next step is to find the abused service and fix it.

Improve this answer
2
  • Sounds good. What's a good way of monitoring the traffic on port 25? Wireshark? (I've only got a CLI - no GUI)
    – aidan
    Mar 1, 2010 at 16:48
  • 1
    Anything will do. Wireshark (it has simple text interface too), tcpdump (you can write a dump file, and then open it somewhere else with Wireshark GUI), iptraf (will show what is going on 'on the wire' with quite visual form, sill text console).
    – Jacek Konieczny
    Mar 1, 2010 at 18:22
1

You need to check your mail logs - 

/var/log/exim_mainlog.

and there are many ways to identify if any one is spamming. If your IP is blacklisted - most likely your server is sending a lot of spam. And if mail queue is very large -also..

Anyway, here are points to check:

  • Check your mailqueue, especially bounces to nobody and emails from nobody.
  • Make sure, you have installed "MailHeaders" extension for PHP and that nobody
    servermail is being redirected to some existing account and that you actually check
    these bounces to identify source of spam. This PHP extension will add path to the
    file, which has generated that mail.
  • Make sure you have some limit of how many emails your users are allowed to send per hour.


These are some points which will periodically notify, if some script is sending too much emails.

If you are unsure about all this, then I can look and fix these things.

Improve this answer
0

What about this script, this will also find php script sending spam

find / -type f -name ".php" | xargs grep -l 'mail' | xargs grep -in 'mail' > ~/mail.scripts.log

Improve this answer
-1

prints destination of all email which sent from your server:

 grep  'to=<[a-z0-9_\.-]\+@[\da-z\.-]\+\.[a-z\.]\{2,6\}>' -o /var/log/maillog
Improve this answer
1
  • Gratuitous use of cat is gratuitous.
    – womble ♦
    Aug 9, 2016 at 0:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .