How do I track down the source of a script or user abusing a mail script to spam from a server as "nobody"?


mv /usr/sbin/sendmail /usr/sbin/sendmail.real


Create a new /usr/sbin/sendmail file with your favorite editor containing the following:



#!/usr/local/bin/perl

# use strict;
 use Env;
 my $date = `date`;
 chomp $date;
 open (INFO, “>>/var/log/formmail.log”) || die “Failed to open file ::$!\n”;
 my $uid = $>;
 my @info = getpwuid($uid);
 if($REMOTE_ADDR) {
         print INFO “$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME \n”;
 }
 else {

        print INFO “$date - $PWD -  @info\n”;

 }
 my $mailprog = ‘/usr/sbin/sendmail.real’;
 foreach  (@ARGV) {
         $arg=”$arg” . ” $_”;
 }

 open (MAIL,”|$mailprog $arg”) || die “cannot open $mailprog: $!\n”;
 while (<STDIN> ) {
         print MAIL;
 }
 close (INFO);
 close (MAIL);




Then run these commands:

chmod +x /usr/sbin/sendmail
touch /var/log/formmail.log
chmod 666 /var/log/formmail.log

This will now log the directory the script ran from (if its from php) and the user information. The log file is globally writable so this script should not be used for long periods of time and only while you can monitor the log file. Save the new sendmail script to another file name when you are done and rename the original sendmail binary.

mv /usr/sbin/sendmail /usr/sbin/sendmail.spam.check
mv /usr/sbin/sendmail.real /usr/sbin/sendmail


Use this script at your own risk. This script is provided as is and ThePlanet assumes no responsibility for any misuse or any issues that it may cause.

Your rating: None Average: 4 (1 vote)