我的服务器昨晚发送了83000封垃圾邮件，我一直在追查这个罪魁祸首，但是我不确定如何找出问题所在。
导致我相信这是一个使用PHP mail()的脚本; 函数或CGI ..所以，我怎么找出哪个脚本？
编辑更正，354284电子邮件发送与50'到'每个地址…. 17,714,200电子邮件….优秀。
编辑看起来像一个SMTP用户/机器人networking…邮件正在通过身份validation的用户发送….
Apr 22 06:31:41 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25411 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25412 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25413 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25414 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25415 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:42 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:42 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25416 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25417 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:43 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:43 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:43 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25418 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:43 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25419 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:43 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25420 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:43 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:43 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:43 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:43 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:43 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:43 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25422 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25421 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25423 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25424 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25425 (adsl-71-129-165-22.dsl.irvnca.pacbell.net) Apr 22 06:31:45 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:45 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:45 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:45 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:46 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:46 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:46 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:46 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:46 impulsemedia smtp_auth: SMTP connect from [email protected] [71.129.165.22] Apr 22 06:31:46 impulsemedia smtp_auth: smtp_auth: SMTP user [email protected] : /var/qmail/mailnames/--removed--.com/--removed-- logged in from [email protected] [71.129.165.22] Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: Handlers Filter before-queue for qmail started ... Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: [email protected] Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: [email protected] Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: [email protected] Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: [email protected] Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: [email protected] Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: [email protected] Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: [email protected]
然后有50个或更多的“到”地址，原因是我没有在日志中捕捉到这是他们在这里login – 倾倒队列中的大部分电子邮件，然后300米+日志的其余部分是交付邮件看起来像一个脚本。 那个IP地址'71 .129.165.22'也出现在spamhause CBL上….
出现问题时，只需要上一堂课仔细阅读我的日志。
-Sean
本周早些时候，我们也遭到了垃圾邮件发送者的攻击。 我发现的一条build议是查看可以find的最早垃圾邮件的完整标题，并查找UID调用的信息。 您可以在密码文件中查看，以确定哪个login用于运行发送电子邮件的进程。
就其价值而言，垃圾邮件的入口点竟然是我们的networking邮件界面。 垃圾邮件发送者使用现有帐户和密码login，然后使用Web邮件应用程序发送电子邮件。 据我所知，垃圾邮件发送者从来没有妥协过实际的系统。
你应该创build一个包装logging有关请求的各种信息。
Parallels为Plesk系统做了一个例子，但看起来有点泛泛： http : //kb.parallels.com/1711
虽然你可能只是grep'邮件（'这不是从PHP发送电子邮件的唯一方法，也可以通过各种程序执行function来完成（标准邮件只是在php.ini中定义的程序的一个包装） ）或者它可能连接到一个SMTP端口。
无论如何，它应该花费一些时间来处理消息量 – 或者需要大量的HTTP请求 – 这两者在你的web服务器日志中都是明显的。
我build议将php.ini文件中configuration的命令replace为尽可能多地收集关于调用它的信息 – 并将其logging在某处。 另外，如果您的计算机上已经打开了端口25，请阻止对脚本的访问（请注意，这可能会破坏您提供给用户的服务）。
我会看看apache的访问日志，因为很有可能你的webroot中有一个脚本使用了mail（）函数，并且这个脚本不安全。 我强烈怀疑这是一个罪魁祸首。 该脚本很可能被称为mail.php
如果这样做没有任何帮助，那么强制使用grep的方法就是使用mail（）函数的文件。
如果您正在运行网站，可能是某个网页中的隐藏/不需要的function，或者是可能的损坏。 在您认为发送邮件的时间间隔内，查看Web服务器访问日志中的类似访问。
我也寻找可能发送邮件的cronjobs。 如果您使用的是Linux，请键入ls -la /var/spool/cron/crontabs/以查找所有安装了cron作业的用户并查看它们。
希望这可以帮助！
是啊 – 看起来发生了什么是用户有他们的凭据被盗（某种？）和一个机器人或东西使用这些发送邮件 – 我禁用了帐户，并停止了一切。 大的线索是IP地址，用户离我不远（在多伦多外面），但发源IP在加州…. –
所以，感谢大家的意见[所有有效和有用的技术]，但问题不是一个不安全的脚本。
我确实发现sendmail包装特别有用。 我必须保持方便的一个技巧
-Sean