<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
Darren,
<br />
<br />When I had some similar instances on our old BlueQuartz servers - I always had a ton of crap mail that couldn't be delivered for one reason or another. That slowed down valid e-mail, and loaded up the CPU. You can see how much you've got by using the "mailq" command. It will show the mail waiting to be sent and give a count at the bottom of the list. I usually clean it all out during low-use periods (like middle of the night) by using "rm -f /home/spool/mqueue/*". Just realize, that will delete valid e-mail as well as crap - so be careful!
<br />
<br />
<br />And if you're interested in tracking what your server is sending out - use a custom IPTables firewall rule to log it. Try:
<br />iptables -I acctout 1 -p tcp --tcp-flags SYN --dport 25 -j LOG --log-prefix Outgoing_E-mail
<br />
<br />That will log all outgoing TCP Port 25 connection initiations to /var/log/messages. Then periodically run "cat /var/log/messages | grep Outgoing_E-mail | less" to see the outgoing mail connections. From that - you can get a pretty good guess if your server is still flooding out tons of crap.
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br /><font size="2">
<br />
<br /><b>---------- Original Message
-----------</b>
<br />
From: "Darren Shea" <dshea@ecpi.com>
<br />
To: <blueonyx@mail.blueonyx.it>
<br />
Sent: Tue, 17 Apr 2012 17:16:27 -0500
<br />
Subject: [BlueOnyx:10160] Re: Trojans and backdoors?
<br />
<br />> Thanks for all the suggestions, everyone. The particular hack does not
seem
<br />>
to use the mailserver, nor has it created any files in the /tmp directory. I
<br />>
have pored over the logs (mail and httpd) thoroughly, but I can't say
<br />>
they've really been a whole lot of help. I did try turning on suPHP, but
<br />>
that broke SquirrelMail also. There may be a configuration setting that can
<br />>
make that work; I'm still looking into it..
<br />>
<br />>
I did find one of my WordPress customers whose PHP settings allowed fopen
<br />>
and include - so I was able to lock that down. I also found several
<br />>
suspicious files in various user's directories, including some which
<br />>
appeared to execute strings of obfuscated code, and I removed all those. We
<br />>
don't appear to have had any new exploits in over 5 hours, but I am too
<br />>
nervous to relax about it yet!
<br />>
<br />>
Thank you,
<br />>
Darren
<br />>
ECPI Western Broadband
<br />>
(512)257-1077
<br />>
(254)213-6116 fax
<br />>
<br />>
-----Original Message-----
<br />>
From: blueonyx-bounces@mail.blueonyx.it
<br />>
[mailto:blueonyx-bounces@mail.blueonyx.it] On Behalf Of
<br />>
blueonyx-request@mail.blueonyx.it
<br />>
Sent: Tuesday, April 17, 2012 2:07 PM
<br />>
To: blueonyx@mail.blueonyx.it
<br />>
Subject: Blueonyx Digest, Vol 40, Issue 33
<br />>
<br />>
Send Blueonyx mailing list submissions to
<br />>
blueonyx@mail.blueonyx.it
<br />>
<br />>
To subscribe or unsubscribe via the World Wide Web, visit
<br />>
<a target="_blank" href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
<br />>
or, via email, send a message with subject or body 'help' to
<br />>
blueonyx-request@mail.blueonyx.it
<br />>
<br />>
You can reach the person managing the list at
<br />>
blueonyx-owner@mail.blueonyx.it
<br />>
<br />>
When replying, please edit your Subject line so it is more specific than
<br />>
"Re: Contents of Blueonyx digest..."
<br />>
<br />>
Today's Topics:
<br />>
<br />>
1. [BlueOnyx:10150] Trojans and backdoors? (Darren Shea)
<br />>
2. [BlueOnyx:10151] Re: Trojans and backdoors? (Matthew Komar)
<br />>
3. [BlueOnyx:10152] PHPMyAdmin Export Limit (SB9-PageKeeper
Service)
<br />>
4. [BlueOnyx:10153] Re: Trojans and backdoors?
<br />>
(SB9-PageKeeper Service)
<br />>
5. [BlueOnyx:10154] Re: Trojans and backdoors? (Chuck Tetlow)
<br />>
6. [BlueOnyx:10155] Re: PHPMyAdmin Export Limit (bob richards)
<br />>
7. [BlueOnyx:10156] Re: PHPMyAdmin Export Limit
<br />>
(SB9-PageKeeper Service)
<br />>
8. [BlueOnyx:10157] Re: Trojans and backdoors? (Michael Stauber)
<br />>
<br />>
------------------------------
<br />>
<br />>
Message: 8
<br />>
Date: Tue, 17 Apr 2012 21:07:09 +0200
<br />>
From: Michael Stauber <mstauber@blueonyx.it>
<br />>
Subject: [BlueOnyx:10157] Re: Trojans and backdoors?
<br />>
To: BlueOnyx General Mailing List <blueonyx@mail.blueonyx.it>
<br />>
Message-ID: <201204172107.10011.mstauber@blueonyx.it>
<br />>
Content-Type: Text/Plain; charset="utf-8"
<br />>
<br />>
Hi Darren,
<br />>
<br />>
> Our BlueOnyx system seems to have been compromised by some sort of
<br />>
> php-based Trojan which is allowing spammers to send spam through the
<br />>
> webserver. We're having a hard time tracking it down to a particular
<br />>
> virtual site, and shutting off php for all users is not an option -
<br />>
> besides the people using WordPress and shopping carts, the SquirrelMail
<br />>
> interface breaks when php is shut off.
<br />>
<br />>
Yeah, the logfiles are usually your best bet at finding this. Also check the
<br />>
<br />>
/tmp directory, as a lot of PHP based exploits use a round about to trick a
<br />>
vulnerable PHP script into downloading some code from somewhere into /tmp/
<br />>
and
<br />>
then during a second step try to execute that code.
<br />>
<br />>
The date and time stamps of such suspicious files in /tmp may give an idea
<br />>
as
<br />>
of when the attack happened, making it easier to find the right window of
<br />>
action in the logfiles.
<br />>
<br />>
Another option that helps at peventing and finding such exploits is to
<br />>
enable
<br />>
suPHP.
<br />>
<br />>
This is for two reasons: suPHP adds another layer of security which can help
<br />>
<br />>
to limit the effects of such exploits. But even if there is a blaring foul
<br />>
up
<br />>
in one of your PHP scripts that still allows undesired access, then the
<br />>
exploited scripts run as the user who owns the scripts.
<br />>
<br />>
So the exploit files that the attackers managed to download to /tmp are
<br />>
owned
<br />>
by the siteAdmin or owner of the script in question, which already directly
<br />>
points you to the site in question. Additionally emails sent by those PHP
<br />>
scripts show the owner of the script in the header of the emails, which
<br />>
again
<br />>
makes finding the culprit a really easy task.
<br />>
<br />>
If you want me to take a look, then please email me offlist with the details
<br />>
<br />>
and I'll see what I can do.
<br />>
<br />>
--
<br />>
With best regards
<br />>
<br />>
Michael Stauber
<br />>
-----
<br />>
No virus found in this message.
<br />>
Checked by AVG - <a target="_blank" href="http://www.avg.com/">www.avg.com</a>
<br />>
Version: 2012.0.1913 / Virus Database: 2411/4942 - Release Date: 04/17/12
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@mail.blueonyx.it
<br />>
<a target="_blank" href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>