Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : How to stop spamming :(

[madguy24]

Hi

My first post.. I read the rules and it seems that this is the place to post. Sorry if I am in wrong thread.

I need help on
-------------------
NOC says that spam mails are getting through my server and they are right too. AOL sends me reports of 100's of them. I doubt it is a mail script as I see the apache@serverhostname.tld in the mail logs. I disabled the mail function of PHP. But it is continuing.. My questions to techies here are

1) If possible, how can I block the mail function used in perl/cgi script ?
2) I removed the server's hostname from the /etc/localdomains. Is it a right move ?
3) External domains relay are disabled.
4) How to find the script and who is executing it and which domain ?
5) How can I prevent such attacks in future ?

Thanks for all your help with this

Maddy.

[PhilG]

If you want to stop it just rename your sendmail exe file.

you will probably benefit from this url too:
http://www.webhostingtalk.com/showth...hreadid=258294

Hope that helps.

[Arsalan]

Maddy,
Check your server's mail que. This is most probably an insecure Formmail script. If you look at a spam mail closely you should be able to find it and disable it.

[andreyka]

Disable relay from localhost, only smtp auth.

[madguy24]

Thanks Guys, Really thanks a lot for the inputs.

My mail queues i only showing apache@serverhostname. I assured that it is not php formmail by trying disable_functions=mail. My problem is how can I block the perl/cgi formmail script ? BTW I removed the server name from localdomains and it worked.

Regarding the andreyka's "Disable relay from localhost, only smtp auth." How can I disable relay from localhost..Sorry I am a novice.

Thanks

[Arsalan]

Login to WHM > Tweak Security > SMTP Tweak

and

WHM > Tweak Settings > Prevent the user 'nobody' from sending out mail to remote addresses (php and cgi scripts generally run as nobody if you are not using phpsuexec and suexec respectively.)