This question already has an answer here:
- How do I deal with a compromised server? 13 answers
This question is not a duplicate of the other, the other is general, this is very specific.
my question is similar to - Who or what is sending spam from my server ( CentOS / Apache / suPHP ) but slightly different.
I have Centos 6.3, Apache/2.2.15, PHP 5.6.24 running Moodle, Passenger 4.0.41 and Postfix 2.6.6-6.el6_7.1 hosted at rackspace.
I dont believe my rails server sends mail through postfix, but moodle does for sure send password resets etc through postfix.
Bad guys are somehow sending spam from my server.
Here is what the postfix log looks like:
Aug 26 18:37:32 myserver postfix/error: CEF352EDAA: to=<firstname.lastname@example.org>, relay=none, delay=7714, delays=7714/0.03/0/0, dsn=4.4.2, status=deferred (delivery temporarily suspended: lost connection with mta5.am0.yahoodns.net[126.96.36.199] while sending RCPT TO)
Here is what the email looks like (from postfixq)
*** ENVELOPE RECORDS deferred/C/CEF352EDAA *** message_size: 13583 190 1 0 13583 message_arrival_time: Fri Aug 26 16:28:58 2016 create_time: Fri Aug 26 18:37:31 2016 named_attribute: rewrite_context=local sender_fullname: Apache sender: email@example.com *** MESSAGE CONTENTS deferred/C/CEF352EDAA *** regular_text: Received: by myserver.localdomain (Postfix, from userid 48) regular_text: id CEF352EDAA; Fri, 26 Aug 2016 16:28:58 +0000 (UTC) regular_text: content-type: text/html regular_text: Subject: Parabens, agora você pode desfrutar do melhor do cinema - Anote seu voucher: NETFLIX440140 regular_text: From: firstname.lastname@example.org
I added & bounced apache
mail.add_x_header = On mail.log = /var/log/phpmail.log
I get no log files from php....so I think it is not php...
The other interesting thing is I had postfix off at the time the message says it "arrived", notice the 2 hour delta between create and arrived.
The other interesting thing is my root mailbox is huge (/var/mail/root).
The last interesting thing is the bad guys put 200k spam in my queue last Thursday/Friday, I found and cleaned the queue by Sunday. Only ran postfix during the day all week, and nothing...then all of a sudden today turned it on, and bamm, slammed again.
I don't see anything nefarious in any apache log files.
I ran maldat and it found nothing.
My server is fairly well locked down at this point (but may not have been before), certificate login only, nothing scary in last...only running open ports on 80,443 and 22.
Any ideas? Any suggestions of where to look next, yes I am going to nuke this vm eventually.....but I hate the idea of not understanding where the bad guys got in and how they are doing it...