I have a Linux server running Exim. Some user is sending spam. I can tell this because almost every 24 hours I'm getting a huge number of undelivered mail in the nobody account.

I can see how the Exim queue quickly grows and, until now, I had to restart the server for the flood to stop.

I've tried using ps and top to identify the account that is generating the spam but I guess it's through a php script and it is being ran as nobody.

How could I trace the offending account / script ?



Nothing should run as nobody. Anything being run as nobody should be changed to run as the users responsible for them. If you've got a pile of shared-hosting PHP all running as the webserver user (the most common 'nobody' source -- RedHat has a lot to answer for), stop doing that -- use suPHP or something to bring back a bit of accountability.

In the immediate term, though, you should be able to correlate spam runs in your logs with hits in your webserver logs if it's a bodgy PHP script; once you've got the script, it's trivial to fix it or knobble it.

| improve this answer | |

"almost every 24 hours I'm getting a huge number of undelivered mail in the nobody account"

That may actually be indicative of a backscatter attack. If you do not already have SPF setup for your domain(s), you might consider setting it up. It will not stop a backscatter attack, but will give some of the other systems a chance to reject the forged messages which are not originating from your infrastructure.

| improve this answer | |
  • You would hope that the questioner is capable of differentiating between local NDAs and remote backscatter... – womble Jul 5 '11 at 2:01
  • The description did not identify if the headers were examined. – user48838 Jul 5 '11 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.