如何find我的服务器上的哪个脚本发送垃圾邮件?

我的服务器正在发送垃圾邮件,我无法找出哪个脚本正在发送它们。

这些电子邮件全部来自nobody@myhost因此禁止从cPanel中禁止nobody发送电子邮件

现在至less他们不出去,我一直在接受他们。 这是我得到的邮件:

 A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: [email protected] Mail sent by user nobody being discarded due to sender restrictions in WHM->Tweak Settings ------ This is a copy of the message, including all the headers. ------ Return-path: <[email protected]> Received: from nobody by cpanel.myserver.com with local (Exim 4.80) (envelope-from <[email protected]>) id 1UBBap-0007EM-9r for [email protected]; Fri, 01 Mar 2013 08:34:47 +1030 To: [email protected] Subject: Order Detail From: "Manager Ethan Finch" <[email protected]> X-Mailer: Fscfz(ver.2.75) Reply-To: "Manager Ethan Finch" <[email protected]> Mime-Version: 1.0 Content-Type: multipart/alternative;boundary="----------1362089087512FD47F4767C" Message-Id: <[email protected]> Date: Fri, 01 Mar 2013 08:34:47 +1030 ------------1362089087512FD47F4767C Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit 

这是我的日志logging:

 2013-03-01 14:36:00 no IP address found for host gw1.corpgw.com (during SMTP connection from [203.197.151.138]:54411) 2013-03-01 14:36:59 H=() [203.197.151.138]:54411 rejected MAIL [email protected]: HELO required before MAIL 2013-03-01 14:37:28 H=(helo) [203.197.151.138]:54411 rejected MAIL [email protected]: Access denied - Invalid HELO name (See RFC2821 4.1.1.1) 2013-03-01 14:37:28 SMTP connection from (helo) [203.197.151.138]:54411 closed by DROP in ACL 2013-03-01 14:37:29 cwd=/var/spool/exim 2 args: /usr/sbin/exim -q 2013-03-01 14:37:29 Start queue run: pid=12155 2013-03-01 14:37:29 1UBBap-0007EM-9r ** [email protected] R=enforce_mail_permissions: Mail sent by user nobody being discarded due to sender restrictions in WHM->Tweak Settings 2013-03-01 14:37:29 cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1UBBap-0007EM-9r 2013-03-01 14:37:30 1UBHFp-0003A7-W3 <= <> R=1UBBap-0007EM-9r U=mailnull P=local S=7826 T="Mail delivery failed: returning message to sender" for [email protected] 2013-03-01 14:37:30 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UBHFp-0003A7-W3 2013-03-01 14:37:30 1UBBap-0007EM-9r Completed 2013-03-01 14:37:32 1UBHFp-0003A7-W3 aspmx.l.google.com [2607:f8b0:400e:c00::1b] Network is unreachable 2013-03-01 14:37:38 1UBHFp-0003A7-W3 => [email protected] <[email protected]> R=lookuphost T=remote_smtp H=aspmx.l.google.com [74.125.25.26] X=TLSv1:RC4-SHA:128 2013-03-01 14:37:39 1UBHFp-0003A7-W3 Completed 2013-03-01 14:37:39 End queue run: pid=12155 2013-03-01 14:38:20 SMTP connection from [127.0.0.1]:36667 (TCP/IP connection count = 1) 2013-03-01 14:38:21 SMTP connection from localhost [127.0.0.1]:36667 closed by QUIT 2013-03-01 14:42:45 cwd=/ 2 args: /usr/sbin/sendmail -t 2013-03-01 14:42:45 1UBHKv-0003BH-LD <= [email protected] U=root P=local S=1156 T="[cpanel.server.com] Root Login from IP 122.181.3.130" for [email protected] 2013-03-01 14:42:45 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UBHKv-0003BH-LD 2013-03-01 14:42:47 1UBHKv-0003BH-LD aspmx.l.google.com [2607:f8b0:400e:c00::1a] Network is unreachable 2013-03-01 14:42:51 1UBHKv-0003BH-LD => [email protected] R=lookuphost T=remote_smtp H=aspmx.l.google.com [74.125.25.27] X=TLSv1:RC4-SHA:128 2013-03-01 14:42:51 1UBHKv-0003BH-LD Completed 2013-03-01 14:43:22 SMTP connection from [127.0.0.1]:37499 (TCP/IP connection count = 1) 2013-03-01 14:43:23 SMTP connection from localhost [127.0.0.1]:37499 closed by QUIT 

有什么方法可以find哪个脚本或哪个用户正在生成这些脚本?

Linux恶意软件检测( http://www.rfxn.com/projects/linux-malware-detect/ )的安装是相当简单的:)。 去通过这个链接,下载http://www.rfxn.com/downloads/maldetect-current.tar.gz 。 这个文件的链接位于网页的最顶端。 然后解压这个档案,在你的terminal上运行cd到新创build的目录。 在目录运行

sudo ./install.sh

这会将扫描仪安装到您的系统。 要执行扫描本身,你要运行

sudo / usr / local / sbin / maldet -a /

这里的一个选项意味着你想扫描所有的文件。 使用-r来代替只扫描最近的。 /指定应该执行扫描的目录。 所以把它改成你想要的任何目录。

只是 )

这些电子邮件全部来自nobody@myhost

查找以nobody身份运行的所有进程:

 ps -U nobody 

来自[127.0.0.1]的SMTP连接:36667(TCP / IP连接数= 1)

watch下运行netstat以查看哪个进程正在连接到端口25:

 watch 'netstat -na | grep :25' 

这些步骤可以帮助你找出罪魁祸首是… web服务器。 然后,您可以运行strace来查看发送电子邮件时调用哪个脚本:

 strace -f -e trace=open,stat -p 1234 -o wserver.strace 

(1234是Web服务器进程的父PID)

对用户的数据运行恶意软件扫描程序,如maldet或AVG或两者。 大多数恶意脚本都是由这些工具拾取的。