HOW-TO: finding "Nobody" spammer

[alexgtsx]

Plesk 8.0.1 issue

New plesk uses /etc/alternatives/mta as mail parser. This program works incorrectly! Any ideas about logging mails from apache?

 

[vonaras]

This script is very useful - much thanks to those who did the work creating and fine-tuning it.

Question:

How can I determine if the mail being sent is actually spam?

Output from the script:

Mon Nov 20 10:58:22 CST 2006 - /home/httpd/vhosts/domain1.com/httpdocs/contact/form - apache x 48 48   Apache /var/www /sbin/nologin

This could be a legitimate email - how do I know for sure?

 

[NightMan]

Then you should log the mail body as well. it will show the content of the mail.

 

[vonaras]

Hi Nightman,

That would be pretty handy ... except I must have cut class the day they taught that, because I can't make it work.

Do you think that you could adapt bartje3's instructions above to reflect the extra code needed to log the actual messages?

(or anyone else?)

Much thanks.

 

[NightMan]

go to this part

}
open (MAIL,"|$mailprog $arg") || die "cannot open $mailprog: $!\n";
while (<STDIN> ) {
print MAIL;
}

replace it with following

}
open (MAIL,"|$mailprog $arg") || die "cannot open $mailprog: $!\n";
while (<STDIN> ) {
print MAIL;
print INFO;
}

 

[vonaras]

Cool - that worked perfectly!!!

Thanks a bunch!

I actually was close to that .... really, I was

Now I have to work on log rotation ... I will really need it with all that data.

Thanks again!

 

[CyberTech]

it logged on freebsd but sendmail not working, failed to send email!
path = /usr/local/psa/qmail/bin/sendmail
Thanks,