Web Hosting Talk : Web Hosting Main Forums : Hosting Software and Control Panels : Emails being sent from my server

[angel1]

Hi, I was wondering here if anyone could help me as I am a little stuck. I have found out that my server is being used to send out spam emails and I want to stop this as soon as possible because I depsise recieving spam and I really hate having people use my server to send more. I don't use the server for email at all and I am really stuck on where to start on fixing this problem.

I tried to view the mail statistics on the WHM cpanel but I can not see the option. I do not have an email icon. I have web mail and email accounts but neither give me the option of statistics.

I am currently scanning through the whole ftp to see if there is any files that I do not recognise.

I would be so greatful if anyone could help me even with ideas of where to start because I am feeling a little lost right now.

Many thanks

[httpEasy]

Looking into FTP logs is a good start. How did you find out about the spam mails originally? Could any of your accounts be compromised?

[LnxtecH]

If you have suphp enabled, then from the exim logs you can see which user is spamming.
You may also take the time stamp of a spam email from the exim logs and search the domalogs for that time and you should be able to find something if it was end out from a webpage.

[angel1]

Originally Posted by httpEasy

Looking into FTP logs is a good start. How did you find out about the spam mails originally? Could any of your accounts be compromised?

Originally through the host, and I have changed every password to all the domains on there and the main account yet it still is being sent.

[angel1]

Originally Posted by LnxtecH

If you have suphp enabled, then from the exim logs you can see which user is spamming.
You may also take the time stamp of a spam email from the exim logs and search the domalogs for that time and you should be able to find something if it was end out from a webpage.

Thanks I will look in to this.

[24nt7linux]

Enable spf for all your domains and check whether the server is an open relay.

[SagoJonB]

Top items to check:

1) Make sure "SMTP Tweak" is enabled in WHM.
This SMTP tweak will prevent users from bypassing the mail server to send mail (This is a common practice used by spammers). It will only allow the MTA (mail transport agent), mailman, and root to connect to remote SMTP servers.

2) Make sure "Sender Verification" is checked in "Exim Configuration Manager" within WHM. "Sender Verification Callouts" is helpful as well, but is applicable more to receiving spam.

3) From ssh run netstat -naop | less
Look for any suspicious processes with dest port 25 - this should also list PID and full path of process (look for suspicious paths/binary filenames as well)

4) Install and run rkhunter & chkrootkit to look for potentially malicious scripts or replaced binaries (clamav would also be good idea if you haven't already installed the plugin through WHM)

5) Secure /tmp (search WHT there are numerous posts on this)

6) Make sure any web applications such as CMS's/blogs etc (Joomla esp) are updated to their latest versions.

The following two resources are excellent and detail using the exim log and other techniques to track down the account that is sending the spam and other measures on how to stop spam:

http://timelordz.com/wiki/index.php/..._Down_Spammers
http://www.configserver.com/free/spammers.html

The following is especially important to add extended logging to /var/log/exim_mainlog:

In WHM > Exim Configuration Editor > Switch to Advanced Mode > in the first textbox add the following line and then Save:

log_selector = +arguments +subject

Hope some of this helps and good luck!

[angel1]

Thanks for all the help. I am working through some of it now. I'm going to sound so dumb saying this but I'm drawing a blank on actually opening my exim log.

We think that we are being used as a relay and we don't believe it is a problem with a user account.

Thanks again for all the help.

[SagoJonB]

Best thing to do is to ssh in and:
# less /var/log/exim_mainlog

I believe the most recent entries are at the end, so you could read most recent first with:

# tac /var/log/exim_mainlog |less