Re: How to determine which PHP-script allows spamming?

I would write simple perl wrapper around /usr/sbin/sendmail. It should distinguish between calling scripts and count speed of calls. If the script overwhelms certain threshold - put the letter at some spool for further analysis.

Rainer Duffner wrote:
Hello,

I have a big problem. Some customer probably got installed a PHP-script that allows to send-out mails with no trace to the original domain it belongs to (we had this before, were pollvote.php was used to install some kind of web-shell - but it was easily detectable which domain it was).

The problem is that I have close to 10000 domains on my cluster.
I tried to correlate httpd-logs with the maillogs, but it didn't lead to anything useful.
I'm currently grep'ing the whole content for some of the email-addresses used, but I'm pessimistic - it may be that the spammer loads even that list from remote - and it takes a lot of time to grep 400 GB.


What options do I have?
Can Snort detect this?

(The webserver uses qmail as MTA)



cheers,
Rainer