linux – 如何找到我服务器上的哪个脚本发送垃圾邮件?

前端之家收集整理的这篇文章主要介绍了linux – 如何找到我服务器上的哪个脚本发送垃圾邮件?前端之家小编觉得挺不错的,现在分享给大家,也给大家做个参考。
参见英文答案 > How do I deal with a compromised server?13个
> Is there a static,server-side vulnerability/virus/malware/BadThings™ scanner?4个
我的服务器正在发送垃圾邮件,我无法找出发送它们的脚本.

电子邮件全部来自nobody @ myhost,因此禁用了cpanel,不允许任何人发送电子邮件

现在至少他们不会外出,我一直接受他们.这是我收到的邮件

  1. A message that you sent could not be delivered to one or more of its
  2. recipients. This is a permanent error. The following address(es) Failed:
  3.  
  4. eckert@clearfieldjeffersonredcross.org
  5. Mail sent by user nobody being discarded due to sender restrictions in WHM->Tweak Settings
  6.  
  7. ------ This is a copy of the message,including all the headers. ------
  8.  
  9. Return-path: <nobody@cpanel.myserver.com>
  10. Received: from nobody by cpanel.myserver.com with local (Exim 4.80)
  11. (envelope-from <nobody@cpanel.myserver.com>)
  12. id 1UBBap-0007EM-9r
  13. for eckert@clearfieldjeffersonredcross.org; Fri,01 Mar 2013 08:34:47 +1030
  14. To: eckert@clearfieldjeffersonredcross.org
  15. Subject: Order Detail
  16. From: "Manager Ethan Finch" <support@raleight.us>
  17. X-Mailer: Fscfz(ver.2.75)
  18. Reply-To: "Manager Ethan Finch" <support@raleight.us>
  19. Mime-Version: 1.0
  20. Content-Type: multipart/alternative;boundary="----------1362089087512FD47F4767C"
  21. Message-Id: <E1UBBap-0007EM-9r@cpanel.server.com>
  22. Date: Fri,01 Mar 2013 08:34:47 +1030
  23.  
  24. ------------1362089087512FD47F4767C
  25. Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
  26. Content-Transfer-Encoding: 7bit

这是我的exim日志日志:

  1. 2013-03-01 14:36:00 no IP address found for host gw1.corpgw.com (during SMTP connection from [203.197.151.138]:54411)
  2. 2013-03-01 14:36:59 H=() [203.197.151.138]:54411 rejected MAIL gpgjouczsr@gmail.com: HELO @R_502_103@ before MAIL
  3. 2013-03-01 14:37:28 H=(helo) [203.197.151.138]:54411 rejected MAIL admin@gmail.com: Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
  4. 2013-03-01 14:37:28 SMTP connection from (helo) [203.197.151.138]:54411 closed by DROP in ACL
  5. 2013-03-01 14:37:29 cwd=/var/spool/exim 2 args: /usr/sbin/exim -q
  6. 2013-03-01 14:37:29 Start queue run: pid=12155
  7. 2013-03-01 14:37:29 1UBBap-0007EM-9r ** eckert@clearfieldjeffersonredcross.org R=enforce_mail_permissions: Mail sent by user nobody being discarded due to sender restrictions in WHM->Tweak Settings
  8. 2013-03-01 14:37:29 cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1UBBap-0007EM-9r
  9. 2013-03-01 14:37:30 1UBHFp-0003A7-W3 <= <> R=1UBBap-0007EM-9r U=mailnull P=local S=7826 T="Mail delivery Failed: returning message to sender" for nobody@cpanel.server.com
  10. 2013-03-01 14:37:30 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UBHFp-0003A7-W3
  11. 2013-03-01 14:37:30 1UBBap-0007EM-9r Completed
  12. 2013-03-01 14:37:32 1UBHFp-0003A7-W3 aspmx.l.google.com [2607:f8b0:400e:c00::1b] Network is unreachable
  13. 2013-03-01 14:37:38 1UBHFp-0003A7-W3 => johnmyk@server.com <nobody@cpanel.server.com> R=lookuphost T=remote_smtp H=aspmx.l.google.com [74.125.25.26] X=TLSv1:RC4-SHA:128
  14. 2013-03-01 14:37:39 1UBHFp-0003A7-W3 Completed
  15. 2013-03-01 14:37:39 End queue run: pid=12155
  16. 2013-03-01 14:38:20 SMTP connection from [127.0.0.1]:36667 (TCP/IP connection count = 1)
  17. 2013-03-01 14:38:21 SMTP connection from localhost [127.0.0.1]:36667 closed by QUIT
  18. 2013-03-01 14:42:45 cwd=/ 2 args: /usr/sbin/sendmail -t
  19. 2013-03-01 14:42:45 1UBHKv-0003BH-LD <= root@cpanel.server.com U=root P=local S=1156 T="[cpanel.server.com] Root Login from IP 122.181.3.130" for johnmyk@server.com
  20. 2013-03-01 14:42:45 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UBHKv-0003BH-LD
  21. 2013-03-01 14:42:47 1UBHKv-0003BH-LD aspmx.l.google.com [2607:f8b0:400e:c00::1a] Network is unreachable
  22. 2013-03-01 14:42:51 1UBHKv-0003BH-LD => johnmyk@server.com R=lookuphost T=remote_smtp H=aspmx.l.google.com [74.125.25.27] X=TLSv1:RC4-SHA:128
  23. 2013-03-01 14:42:51 1UBHKv-0003BH-LD Completed
  24. 2013-03-01 14:43:22 SMTP connection from [127.0.0.1]:37499 (TCP/IP connection count = 1)
  25. 2013-03-01 14:43:23 SMTP connection from localhost [127.0.0.1]:37499 closed by QUIT

有没有办法找到哪个脚本或哪个用户正在生成这些脚本?

@H_502_17@解决方法
Linux恶意软件检测( http://www.rfxn.com/projects/linux-malware-detect/)安装非常简单:).点击此链接,下载 http://www.rfxn.com/downloads/maldetect-current.tar.gz.此文件链接位于网页的最顶部.然后解压缩此存档,通过在终端中运行cd转到新创建的目录.
在目录中运行

sudo ./install.sh

这将把扫描仪安装到您的系统.要执行扫描本身,您将运行

sudo /usr/local / sbin / maldet -a /

-a选项在这里意味着你想要扫描所有文件.使用-r代替仅扫描最近的. /指定应执行扫描的目录.所以只需将其更改为您想要的任何目录.

只是 )

猜你在找的Linux相关文章