PHP and Apache has a history of not being able to track which users are sending out mail through the PHP mail function from the nobody user causing leaks inform mail scripts and malicious users to spam from your server without you knowing who or where.
Here I am going to tell you some easy step to trace nobody spammer.
- Login to your server and su - to root.
- Turn off exim while we do this so it doesn't freak out.
- Backup your original /usr/sbin/sendmail file. On systems using Exim MTA, the sendmail file is just basically a pointer to Exim itself.
- Create the spam monitoring script for the new sendmail. pico /usr/sbin/sendmail Paste in the following:
- Change the new sendmail permissions
- Create a new log file to keep a history of all mail going out of the server using web scripts
- Start Exim up again.
- Monitor your spam_log file for spam, try using any formmail or script that uses a mail function - a message board, a contact script.
Sample Log Output
Mon Apr 11 07:12:21 EDT 2005 - /home/username/public_html/directory/subdirectory - nobody x 99 99Nobody / /sbin/nologin
Now here you can see in above sample log that ” NOBODY IS SOMEBODY”.