Locate top scripts sending into Exim

  1. Login to your server via SSH as the root user.
  2. Run the following command to pull the most used mailing script’s location from the Exim mail log:grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F”cwd=” ‘{print $2}’ | awk ‘{print $1}’ | sort | uniq -c | sort -n

    Code breakdown:

    grep cwd /var/log/exim_mainlog Use the grep command to locate mentions of cwd from the Exim mail log. This stands for current working directory.
    grep -v /var/spool Use the grep with the -v flag which is an invert match, so we don’t show any lines that start with /var/spool as these are normal Exim deliveries not sent in from a script.
    awk -F”cwd=” ‘{print $2}’ | awk ‘{print $1}’ Use the awk command with the -Field seperator set to cwd=, then just print out the $2nd set of data, finally pipe that to the awk command again only printing out the $1st column so that we only get back the script path.
    sort | uniq -c | sort -n Sort the script paths by their name, uniquely count them, then sort them again numerically from lowest to highest.

    You should get back something like this:

    15 /home/userna5/public_html/about-us
    25 /home/userna5/public_html
    7866 /home/userna5/public_html/data

    Here we can see that the /home/userna5/public_html/data directory by far has more deliveries coming in than any others.

  3. Now we can run the following command to see what scripts are located in that directory:ls -lahtr /userna5/public_html/data

    In thise case we got back:

    drwxr-xr-x 17 userna5 userna5 4.0K Jan 20 10:25 ../
    -rw-r–r– 1 userna5 userna5 5.6K Jan 20 11:27 mailer.php
    drwxr-xr-x 2 userna5 userna5 4.0K Jan 20 11:27 ./

    So we can see there is a script called mailer.php in this directory

  4. Knowing the mailer.php script was sending mail into Exim, we can now take a look at our Apache access log to see what IP addresses are accessing this script using the following command:grep “mailer.php” /home/userna5/access-logs/example.com | awk ‘{print $1}’ | sort -n | uniq -c | sort -n

    You should get back something similar to this:

    2 123.123.123.126
    2 123.123.123.125
    2 123.123.123.124
    7860 123.123.123.123

    So we can clearly see that the IP address 123.123.123.123 was responsible for using our mailer script in a malicious nature.

  5. If you did find a malicous IP address sending out a large volume of messages from a script on your server you’ll probably want to go ahead and block them at your server’s firewall so that they can’t try to connect again. This can be accomplished with the following command:apf -d 123.123.123.123 “Spamming from script in /home/userna5/public_html/data”

You should now have learned how to use your server’s Exim mail log to see what scripts on your server are causing the most email activity, and also how to investigate to see if any of them are malicious in nature trying to send out spam from your server.

Advertisements

2 thoughts on “Locate top scripts sending into Exim

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s