我的服务器正在发送垃圾邮件，但我无法找出哪个脚本正在发送它们。
这些电子邮件均来自nobody@myhostcpanel 禁用的邮箱，因此nobody不应允许发送电子邮件
现在至少它们没有发出去，我一直在收到它们。这是我收到的邮件：
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[email protected]
Mail sent by user nobody being discarded due to sender restrictions in WHM->Tweak Settings
------ This is a copy of the message, including all the headers. ------
Return-path: <[email protected]>
Received: from nobody by cpanel.myserver.com with local (Exim 4.80)
(envelope-from <[email protected]>)
id 1UBBap-0007EM-9r
for [email protected]; Fri, 01 Mar 2013 08:34:47 +1030
To: [email protected]
Subject: Order Detail
From: "Manager Ethan Finch" <[email protected]>
X-Mailer: Fscfz(ver.2.75)
Reply-To: "Manager Ethan Finch" <[email protected]>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------1362089087512FD47F4767C"
Message-Id: <[email protected]>
Date: Fri, 01 Mar 2013 08:34:47 +1030
------------1362089087512FD47F4767C
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
这是我的 exim 日志：
2013-03-01 14:36:00 no IP address found for host gw1.corpgw.com (during SMTP connection from [203.197.151.138]:54411)
2013-03-01 14:36:59 H=() [203.197.151.138]:54411 rejected MAIL [email protected]: HELO required before MAIL
2013-03-01 14:37:28 H=(helo) [203.197.151.138]:54411 rejected MAIL [email protected]: Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
2013-03-01 14:37:28 SMTP connection from (helo) [203.197.151.138]:54411 closed by DROP in ACL
2013-03-01 14:37:29 cwd=/var/spool/exim 2 args: /usr/sbin/exim -q
2013-03-01 14:37:29 Start queue run: pid=12155
2013-03-01 14:37:29 1UBBap-0007EM-9r ** [email protected] R=enforce_mail_permissions: Mail sent by user nobody being discarded due to sender restrictions in WHM->Tweak Settings
2013-03-01 14:37:29 cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1UBBap-0007EM-9r
2013-03-01 14:37:30 1UBHFp-0003A7-W3 <= <> R=1UBBap-0007EM-9r U=mailnull P=local S=7826 T="Mail delivery failed: returning message to sender" for [email protected]
2013-03-01 14:37:30 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UBHFp-0003A7-W3
2013-03-01 14:37:30 1UBBap-0007EM-9r Completed
2013-03-01 14:37:32 1UBHFp-0003A7-W3 aspmx.l.google.com [2607:f8b0:400e:c00::1b] Network is unreachable
2013-03-01 14:37:38 1UBHFp-0003A7-W3 => [email protected] <[email protected]> R=lookuphost T=remote_smtp H=aspmx.l.google.com [74.125.25.26] X=TLSv1:RC4-SHA:128
2013-03-01 14:37:39 1UBHFp-0003A7-W3 Completed
2013-03-01 14:37:39 End queue run: pid=12155
2013-03-01 14:38:20 SMTP connection from [127.0.0.1]:36667 (TCP/IP connection count = 1)
2013-03-01 14:38:21 SMTP connection from localhost [127.0.0.1]:36667 closed by QUIT
2013-03-01 14:42:45 cwd=/ 2 args: /usr/sbin/sendmail -t
2013-03-01 14:42:45 1UBHKv-0003BH-LD <= [email protected] U=root P=local S=1156 T="[cpanel.server.com] Root Login from IP 122.181.3.130" for [email protected]
2013-03-01 14:42:45 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UBHKv-0003BH-LD
2013-03-01 14:42:47 1UBHKv-0003BH-LD aspmx.l.google.com [2607:f8b0:400e:c00::1a] Network is unreachable
2013-03-01 14:42:51 1UBHKv-0003BH-LD => [email protected] R=lookuphost T=remote_smtp H=aspmx.l.google.com [74.125.25.27] X=TLSv1:RC4-SHA:128
2013-03-01 14:42:51 1UBHKv-0003BH-LD Completed
2013-03-01 14:43:22 SMTP connection from [127.0.0.1]:37499 (TCP/IP connection count = 1)
2013-03-01 14:43:23 SMTP connection from localhost [127.0.0.1]:37499 closed by QUIT
有什么方法可以找到哪个脚本或哪个用户正在生成这些脚本或用户？
答案1
Linux 恶意软件检测 (http://www.rfxn.com/projects/linux-malware-detect/）安装非常简单 :)。通过此链接下载http://www.rfxn.com/downloads/maldetect-current.tar.gz。该文件的链接位于网页的最顶部。然后解压此存档，通过在终端中运行 cd 转到新创建的目录。在目录中运行
sudo./install.sh 复制代码
这将安装扫描仪到您的系统。要执行扫描本身，您需要运行
sudo /usr/local/sbin/maldet -a /
此处的 -a 选项表示您希望扫描所有文件。使用 -r 则仅扫描最近的文件。/ 指定应执行扫描的目录。因此，只需将其更改为您想要的任何目录即可。
只是 ）
答案2
这些电子邮件均来自
nobody@myhost
查找所有正在运行的进程nobody：
ps -U nobody
来自 [127.0.0.1]:36667 的 SMTP 连接（TCP/IP 连接数 = 1）
运行netstat查看watch哪个进程正在连接端口 25：
watch 'netstat -na | grep :25'
这些步骤可以帮助您找出罪魁祸首是…… Web 服务器。然后您可以运行strace以查看发送电子邮件时调用了哪个脚本：
strace -f -e trace=open,stat -p 1234 -o wserver.strace
（1234 是 Web 服务器进程的父 PID）