Symptoms

Many email messages are being sent from PHP scripts on the server. How can I find the domains on which these scripts are running if I am using Postfix?

Resolution

Note: This article is for Postfix. If you are using the Qmail mail server, see article
1711: Many email messages are sent from PHP scripts on the server. How can I find the domains on which these scripts are running?

There is a way to determine from which folder the PHP script that sends mail was run.

Note: Depending on your operating system and Plesk version, the paths can differ slightly from those listed below.

1. Create a /usr/sbin/sendmail.postfix-wrapper script with the following content:

   Create a file and open it for editing:

   #touch /usr/sbin/sendmail.postfix-wrapper
   #vi /usr/sbin/sendmail.postfix-wrapper
   

   Add the following content:

   #!/bin/sh
   (echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|/usr/sbin/sendmail.postfix-bin "$@"
   

   Note that this should be two lines, including #!/bin/sh.

2. Create a log file, /var/tmp/mail.send, and grant it a+rw rights. Make the wrapper executable, rename the old sendmail, and link it to the new wrapper. Then run the commands below:

   ~# touch /var/tmp/mail.send
   ~# chmod a+rw /var/tmp/mail.send
   ~# chmod a+x /usr/sbin/sendmail.postfix-wrapper
   ~# mv /usr/sbin/sendmail.postfix /usr/sbin/sendmail.postfix-bin
   ~# ln -s /usr/sbin/sendmail.postfix-wrapper /usr/sbin/sendmail.postfix
   

3. Wait for an hour and change the sendmail back:

   ~# rm -f /usr/sbin/sendmail.postfix
   ~# mv /usr/sbin/sendmail.postfix-bin /usr/sbin/sendmail.postfix
   

Check the /var/tmp/mail.send file. There should be lines starting with X-Additional-Header: pointing to the domain folders where the scripts that sent the mail are located.

You can see all the folders from which mail PHP scripts were run with the following command:

    ~# grep X-Additional /var/tmp/mail.send | grep `cat /etc/psa/psa.conf | grep HTTPD_VHOSTS_D | sed -e 's/HTTPD_VHOSTS_D//' `

NOTE: If you see no output from the above command, it means no mail was sent using the PHP mail() function from the Plesk virtual hosts directory.

Usually, that means one of the mail accounts has been compromised. Check the login attempt count:

# zgrep -c 'sasl_method=LOGIN' /usr/local/psa/var/log/maillog*
/usr/local/psa/var/log/maillog:221000
/usr/local/psa/var/log/maillog.processed:362327
/usr/local/psa/var/log/maillog.processed.1.gz:308956

If you see an unusually high number of login attempts, it is very likely accounts were compromised. You can try identifying these accounts in the following way:

# zgrep 'sasl_method=LOGIN' /usr/local/psa/var/log/maillog* | awk '{print $9}' | sort | uniq -c | sort -nr | head
891574 sasl_username=admin@example.com

To stop spam from being sent, change passwords for the compromised accounts and restart the Postfix service.

For Plesk 12 also visit Administrator’s Guide page

Configure and Test Postfix

Do Some More Configuration for Postfix

This section start to configure postfix to be more secure. There are some options that are personal preferences of the author and may be changed. They are as follows:

• Mail is stored in $HOME
• TLS required for sending mail remotely
• Certificates in /etc/postfix
• The ‘standard’ is /etc/pki/tls

1. Update the /etc/postfix/main.cf postfix configuration file and make the following changes:
   1. The following changes are updates:

   home_mailbox = Maildir/

   2. These changes are additions to the configuration file and may be added at the end of the file.

   #TLS - SMTP AUTH
   disable_vrfy_command = yes
   smtpd_use_tls = yes
   smtpd_tls_auth_only = yes
   tls_random_source = dev:/dev/urandom
   smtpd_tls_cert_file = /etc/postfix/cert.pem
   smtpd_tls_key_file = /etc/postfix/key.pem
   smtpd_sasl_auth_enable = yes
   smtpd_sasl_security_options = noanonymous
   broken_sasl_auth_clients = yes
   # Add some security
   smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination

2. Move your certificates to the proper location (/etc/postfix/cert.pem and /etc/postfix/key.pem respectivly) and set proper permissions (600).
   If you don’t have a certificate already, you may generate a self signed cert with the following commands: 

   cd /etc/postfix
   openssl req -new -x509 -nodes -out cert.pem -keyout key.pem -days 3650
   chmod 600 *.pem
   

3. Restart the server:

/sbin/service postfix restart

4. Try to send test mail to your local-user account both from localhost and a remote server.

This should work. It would also be a good test to make sure that your server will not relay mail so try to send mail to another host using your server. It is recommended to continue to send testing mail with telnet so the maximum amount of information is available to debug what is going wrong. You should notice a new response from the server after you ‘EHLO‘:

EHLO testdomain.com
250-host.example.com
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

5. Test if TLS is working correctly:

commands are in bold reponses are in italics

telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
220 host.example.com ESMTP Postfix
EHLO testdomain.com
250-host.example.com
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
STARTTLS
220 2.0.0 Ready to start TLS

If you do not see ‘Ready to start TLS’, something is wrong with your TLS setup.

Test by sending mail from a remote service/server.

The most common issue is networking issues. Please be sure your networking is setup correctly. For example the below is to allow port 25:tcp using iptables:

qshape deferred | head
Para ver todos loe email en cola

Tip rapidísimo de postfix.

Para mostrar que emails están en cola, osea, aun no se han enviado:

mailq

Para borrar un email de la cola:

postsuper -d queue_id

Para borrar todos esos emails de la cola:

postsuper -d ALL

Mas comandos:
 postsuper -d numero (eliminar el mensaje)
 postsuper -d ALL (eliminar todos los mensajes)
 postsuper -r Number (Encolar de nuevo el mensaje)
 postsuper -r ALL (Encolar de nuevo todos los mensajes)
 postqueue -p  (Mostrar la cola de correo por pantalla)
 postqueue -f  (Hacer un flush de la cola de correo, intentar enviar todos los correos)

Para saber cual es la cabecera de un mail:
 postcat -q Numero de la cabecera | more