What if?

Krrrlson — Tue, 13 Feb 2007 20:32:40 -0800

What is the origin of the phrase: "what if they had ____ and nobody came?"

'nobody' spam

Witty — Wed, 03 May 2006 06:54:05 -0800

How can I determine exactly from where or how a server's email queue is being filled with outgoing spam from user 'nobody'? Here's the basic set up:
Redhat 9.0
Apache 1.3.34
Exim 4.52
Cpanel - latest version
(note: I'm looking at about 1,500 of these set ups, so massive changes aren't going to be possible, including the use of phpsuexec.)

So the deal is, a spam complaint comes in pegging a certain IP address as the culprit. I match it up with the actual server and find a mail queue with 60,000 outgoing messages, 59,995 of which are spam. The outgoing address is nobody@hostname.com (of course), since Apache runs as user nobody.

Occassionally, I can match up the timestamp of an email to an Apache log entry, showing me that a certain "contact us" script, or something of the sort, is being exploited. At that point, the"fix" is easy. But more often than not, especially when the cPanel installation has about 250 accounts, trying to find THE insecure script responsible for the creation of thousands of outgoing emails is like looking for a needle in a hystack.

Does anyone have any suggestions on how I can attack this problem more efficiently and productively?

Ask MetaFilter questions tagged with nobody

What if?

'nobody' spam