Mon 21 Jul 2008
How to stop PHP nobody spammers
Posted by Tuks under Blogging , Dedicated Server Hosting , Email Hosting , Linux Web Hosting , Reseller Hosting , VPS Hosting , WHM Tutorials , Web Hosting , Web Hosting Articles , cPanel Issues , cheap linux web hostingNo Comments
Hello,
PHP and Apache are not being able to track which users are sending out mail through the PHP mail function from the nobody user causing leaks in formmail scripts and malicious users to spam from your server without you knowing who or where.
Monitiring exim_mainlog doesn’t exactly help, you see th email going out but you can’t track from which user or script is sending it. This is a quick and dirty way to get around the nobody spam problem on your Linux server.
If you check out your PHP.ini file you’ll notice that your mail program is set to: /usr/sbin/sendmail and 99.99% of PHP scripts will just use the built in mail(); function for PHP - so everything will go through /usr/sbin/sendmail
Requirements:
We assume you’re using Apache 1.3x, PHP 4.3x and Exim. This may work on other systems but we’re only tested it on a
Cpanel/WHM Red Hat Enterprise system.
Step 1:
Login to your server with root.
Step 2:
Turn off exim before proceeding
service exim stop
Step 3:
Take the Backup of your original /usr/sbin/sendmail file
mv /usr/sbin/sendmail /usr/sbin/sendmail_bak
Step 4:
You need to Create the spam monitoring script for the new sendmail.
pico /usr/sbin/sendmail
Paste in the following:
#!/usr/local/bin/perl
# use strict;
use Env;
my $date = `date`;
chomp $date;
open (INFO, “>>/var/log/spam_log”) || die “Failed to open file ::$!”;
my $uid = $>;
my @info = getpwuid($uid);
if($REMOTE_ADDR) {
print INFO “$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME n”;
}
else {
print INFO “$date - $PWD - @infon”;
}
my $mailprog = ‘/usr/sbin/sendmail.hidden’;
foreach (@ARGV) {
$arg=”$arg” . ” $_”;
}
open (MAIL,”|$mailprog $arg”) || die “cannot open $mailprog: $!n”;
while (<STDIN> ) {
print MAIL;
}
close (INFO);
close (MAIL);
save and close
Step 5:
Now change the new sendmail permissions
chmod a+x /usr/sbin/sendmail
Step 6:
Create a new log file to keep a history of all mail going out of the server using web scripts
touch /var/log/spam_log
chmod 0777 /var/log/spam_log
Step 7:
Start Exim up again.
/etc/init.d/exim start
Step 8:
You can Monitor your spam_log file for spam, try using any formmail or script that uses a mail function - a message board, a contact script.
tail - f /var/log/spam_log
Reference taken from : webhostgear.com