How to track the exim email spam in cpanel server
The cpanel server use exim as the email server. There is a never ending war going on with spam on internet. It may be probably due to insecure forms or improper exim configuration. Here are some tips avilable with exim commands that will help you to find which user in your server is sending massive spam emails.
-
- Step 1 : Get a total summery of cpanel users sendig spam email
# grep 'cwd=/home' /var/log/exim_mainlog | awk '{print $3}' | cut -d / -f 3 | sort -n | uniq -c | sort -bg
A sample result is as follows,
4 kfmm 7 pa4you 7 sugigarn 8 exnernu 12 guldbrand 24 silvatica 33 danskhundecenter 35 netrod 41 orkhullet 59 ksgabwpp 81 sarastorm 84 holm 134 ohigh 201 nordicparts 754 sarasperler
-
- Step 2 : Find the rate of email sending document roots, from which the email are originating.
# grep 'cwd=/home' /var/log/exim_mainlog | awk '{for(i=1;i<=10;i++){print $i}}' |grep cwd | sort -n | uniq -c | sort -n
A sample result is as follows,
7 cwd=/home/pa4you/public_html 8 cwd=/home/guldbrand/public_html 10 cwd=/home/netrod/soulx.com 10 cwd=/home/ohigh/school.rpq.dk/dream-portfolio 23 cwd=/home/netrod/soulx.net/wp-admin 24 cwd=/home/silvatica/public_html 25 cwd=/home/danskhundecenter/70201080.dk 33 cwd=/home/sarastorm/public_html/wp-admin 41 cwd=/home/orkhullet/public_html 48 cwd=/home/sarastorm/public_html 49 cwd=/home/ksgabwpp/public_html/mygear 83 cwd=/home/holm/public_html 121 cwd=/home/ohigh/kollenso.net 200 cwd=/home/nordicparts/public_html 753 cwd=/home/sarasperler
-
- Step 3 : Test if any live script is sending spam right now from the above path.
Syntax : ps auxwwwe | grep | grep --color=always "PATH-TO-The script " | head # ps auxwwwe | grep sarasperler | grep --color=always "/home/sarasperler" | head
-
- step 4 : Find the spam generating IP address via the above script. So that you can block that IP
# grep 'PATH-TO-SCRIPT' /etc/apache2/logs/domlogs/CPUSER/DOMAINNAME | awk '{print $1}' | sort -n | uniq -c | sort -n
-
- Step 5 : Check the exim input queue for spams
Some times, there will be still some spam emails in the exim input email queue. You can find the emails using the following command
# egrep -iR 'X-PHP-Script' /var/spool/exim/input/
-
- step 6 : The eximstats tool
There is a beautiful exim tool available. It is called eximstats . This will give a total summery of received and send emails from your server. This command should run as follows,
# eximstats -ne -nr /var/log/exim_mainlog
-
- Step 7 : Find the SMPT spammers.
These spammers directly connect to the smtp server port 25 using an smtp authentication. So if some one have a stole email account and password, then he can connect to to the exim smtp port and send massive emails from his desktop. This doesn’t need any php scripts in your server. It is too dangerous.
# netstat -plan | egrep ':25|:465' | awk {'print $5'} | cut -d: -f 1| sort -n | uniq -c| sort -n
-
- Step 8 : Get a summery of the current email queue
If you have massive emails in email queue. This command will show a summery of the emails setting in the server queue. Probably there will be a lot of failed emails too.
# exim -bpr | exiqsumm -c
Hello,
do you know a monitor or tool in order to check that without use a terminal?
thank you.