This question already has an answer here:
We have a Debian Squeeze server running a fairly standard LAMP stack (back in the days it was set up using the Perfect Server guide at Howtoforge, so we're using ISPConfig as our backend admin panel) which has been locked down pretty well with regards to MTA's (nothing installed, no postfix, no EXIM etc.) and with the php mail() function thoroughly disabled, port 25 firewalled.
We routinely get SPAM warnings from e.g. MegaRBL however identifying our server IP as the source
Usually we track down a hacked Wordpress site, where we see a bunch of encrypted/obfuscated scripts and other junk, which we then nuke and hope for the best.
This approach is not satisfying to me as I am going mad with trying to figure out HOW they manage to send out SPAM from this server. I am guessing (and this might be totally wrong) that the scripts they manage to drop into the hacked Wordpress sites are Mail Transport Agents themselves. I obviously cannot gain much insight into what they are doing exactly as these scripts are encrypted / obfuscated.
All my google searches and research always points to Postfix or the mail() function and various guides on how to track this down and mitigate spam from these sources - but I am certain that all that stuff has been nuked from our server.
So my question here is threefold:
- Is it possible that these obfuscated scripts we find are in fact sending out mail without the aid of any binaries installed on my server? (e.g. Postfix, sendmail, whatever)
- Is there any way of logging / detecting this type of traffic being emitted from our server?
- Am I missing something? Postfix has been removed, I've doublechecked that the PHP mail() function is disabled, I've scoured the binaries looking for anything that might be mail related and nuked it, but I'm worried I might just be retarded and missing something obvious ...