Wondering how to trace email spamming in Plesk? We can help you.
Recently we had a customer who couldn’t trace the mail spamming in his Plesk Linux server. A thousand email was being sent along with bounce-back messages. However, there is no such email server.
As part of our Server Management Services, we assist our customers with several Plesk queries.
Today, let us see how to trace email spamming in Plesk using PHP scripts.
Find the source of spam.
Before we proceed with the steps to find mail spamming from PHP scripts, let us see the steps in order to find mail spamming in qmail (Plesk).
This includes the steps to find spamming from PHP scripts in the Plesk server also.
Initially, we check the mail count in the qmail queue:
# /var/qmail/bin/qmail-qstatmessages in queue: 27303 messages in queue but not yet preprocessed: 100In addition, to see the inbox of mails:
/var/qmail/mailnames/Then to find the user that sends most of the mails (if the emails are sent without using PHP scripts):
# cat /var/log/maillog |grep -I smtp_auth |grep -I user |awk ‘{print $11}’ |sort |uniq -c |sort -nIn order to read message headers
# /var/qmail/bin/qmail-qread22 Sep 2012 15:03:07 CDT #2996948 9073 bouncing done remote user1@domain1.com done remote user2@domain2.com done remote user3@domain3.comFrom the above result, we can see the sender and recipients of messages. If the message has too many recipients, then it is mostly SPAM.
To view this message using its ID #2996948:
# find /var/qmail/queue/mess/ -name 2996948Finally, we check the result, starting after ‘Received’ to see its origin :
a) Received: (qmail 19514 invoked by uid 1009); 21 Oct 2007 17:48:22 +0700This means that mail was sent via some CGI script by user UID 1009.
Then, find a corresponding domain for this UID
# grep 1009 /etc/passwd
Now we can find the cgi script and deny it’s working.
b) Received: (qmail 19622 invoked from network); 21 Oct 2007 17:52:36 +0700 Received: from external_domain.com (10.0.0.1)If we get the above header, then the message was accepted for delivery via SMTP and the sender is an authorized mail user.
c) Received: (qmail 19514 invoked by uid 48); 21 Oct 2007 17:48:22 +0700If the uid is 48, then spam is sent using some PHP scripts. (48 – UID of apache user)
Trace email spamming in Plesk using PHP scripts
The script below shows currently running php scripts in the server.
# lsof +r 1 -p `ps axww | grep httpd | grep -v grep | awk ‘ { if(!str) { str=$1 } else str=str”,”$1}END{print str}’` | grep vhosts | grep phpTo find the exact location of php script, follow the below method:
1) Create /var/qmail/bin/sendmail-wrapper script.
#!/bin/sh (echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send| /var/qmail/bin/sendmail-qmail “$@”2) Then we run:
# touch /var/tmp/mail.send # chmod a+rw /var/tmp/mail.send # chmod a+x /var/qmail/bin/sendmail-wrapper # mv /var/qmail/bin/sendmail /var/qmail/bin/sendmail-qmail # ln -s /var/qmail/bin/sendmail-wrapper /var/qmail/bin/sendmail3) Eventually, revert it
# rm -f /var/qmail/bin/sendmail # ln -s /var/qmail/bin/sendmail-qmail /var/qmail/bin/sendmail /var/tmp/mail.send will contain lines starting with ‘X-Additional’ # grep X-Additional /var/tmp/mail.send | grep `cat /etc/psa/psa.conf | grep HTTPD_VHOSTS_D | sed -e ‘s/HTTPD_VHOSTS_D//’These will give the directories from where the mail script is running.
If the queue is high and corrupt, we can recreate the qmail queue in Plesk
/etc/init.d/qmail stop /etc/init.d/xinetd stopmv /var/qmail/queue /var/qmail/queue_oldrpm -Uvh –force psa-qmail-1.03-rh7.3.build030207.16This will recreate the Qmail queue structure.
/etc/init.d/qmail start /etc/init.d/xinetd start[Need help to trace spamming? We’d be happy to assist]
Conclusion
To conclude, locating the mail spammer in a Plesk server is a bit difficult when compared to Cpanel servers. Today, we saw how our Support Techs perform the same.
0 Comments