Issue How to make log send email for check spam send via smtp or php script ?

[WSNHosting]

How to make log send email for check spam send via smtp or php script ?

i do url Many email messages are sent from PHP scripts on a Plesk server. How to find domains on which these scripts are running if Postfix is used?

not work. in mail.send not have information ?

i have problem about someone use smtp or php script send spam out

thankyou

 

[Brujo]

not work. in mail.send not have information ?

If you see no output from the above command, it means that no mail was sent using the PHP mail() function, that may indicate one of the mail accounts has been compromised.

there are several topics what you can do around this issue like: configure Plesk Panel > Tools & Settings > Outgoing Mail Control > Server-wide settings > Switch on limitations on outgoing email messages

see also Limiting Outgoing Mail

take into consider to vote for: Outgoing Mail Control collect sample of offending emails

You can also set per php version you have installed (usually under /opt/plesk/php/) the mail.log path in the php.ini to write this into a own logflie to identify the issue

 

[Linulex]

If you see no output from the above command, it means that no mail was sent using the PHP mail() function

Not true. This support artikel is not working anymore after the update to plesk 17.8.11, atleast not on centos 7. I have been testing with this and another script i use the last few days now and the log stays empty. I was going to open a new post about it, but posting here is just as good. The general idea is that plesk knows about it and fix there artikel so we can crack down on spam once more.

I used to have a permanent script in place to log mails send via websites and that is also not working anymore. Both the support article and my usual script worked fine until plesk 17.5.3

#!/usr/bin/perl -w

## https://kb.plesk.com/114845
## create as /usr/sbin/sendmail.postfix-wrapper
## chmod a+x /usr/sbin/sendmail.postfix-wrapper
## mv /usr/sbin/sendmail.postfix /usr/sbin/sendmail.postfix-bin
## ln -s /usr/sbin/sendmail.postfix-wrapper /usr/sbin/sendmail.postfix

## create /var/log/formmail 0666
## enable logrotation

## test via website, doesn't work via webmail (is smtp)

# use strict;
use Env;
my $date = `date`;
chomp $date;
open (INFO, ">>/var/log/formmail") || die "Failed to open file ::$!";
my $uid = $>;
my @info = getpwuid($uid);
#if($REMOTE_ADDR) {
#print INFO "$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME \n";
#}
#else {
print INFO "$date - $PWD - @info\n";
#}
my $mailprog = '/usr/sbin/sendmail.postfix-bin';
foreach (@ARGV) {
$arg="$arg" . " $_";
}
open (MAIL,"|$mailprog $arg") || die "cannot open $mailprog: $!\n";
while (<STDIN> ) {
print MAIL;
}
close (INFO);
close (MAIL);

regards
Jan

 

[WSNHosting]

Not true. This support artikel is not working anymore after the update to plesk 17.8.11, atleast not on centos 7. I have been testing with this and another script i use the last few days now and the log stays empty. I was going to open a new post about it, but posting here is just as good. The general idea is that plesk knows about it and fix there artikel so we can crack down on spam once more.

I used to have a permanent script in place to log mails send via websites and that is also not working anymore. Both the support article and my usual script worked fine until plesk 17.5.3

#!/usr/bin/perl -w

## https://kb.plesk.com/114845
## create as /usr/sbin/sendmail.postfix-wrapper
## chmod a+x /usr/sbin/sendmail.postfix-wrapper
## mv /usr/sbin/sendmail.postfix /usr/sbin/sendmail.postfix-bin
## ln -s /usr/sbin/sendmail.postfix-wrapper /usr/sbin/sendmail.postfix

## create /var/log/formmail 0666
## enable logrotation

## test via website, doesn't work via webmail (is smtp)

# use strict;
use Env;
my $date = `date`;
chomp $date;
open (INFO, ">>/var/log/formmail") || die "Failed to open file ::$!";
my $uid = $>;
my @info = getpwuid($uid);
#if($REMOTE_ADDR) {
#print INFO "$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME \n";
#}
#else {
print INFO "$date - $PWD - @info\n";
#}
my $mailprog = '/usr/sbin/sendmail.postfix-bin';
foreach (@ARGV) {
$arg="$arg" . " $_";
}
open (MAIL,"|$mailprog $arg") || die "cannot open $mailprog: $!\n";
while (<STDIN> ) {
print MAIL;
}
close (INFO);
close (MAIL);

regards
Jan

this code save file name ?
how to use ?

## create /var/log/formmail 0666 << make new file and chmod 0666 ?
## enable logrotation < how to setting ?

thankyou

 

[Linulex]

## create /var/log/formmail 0666 << make new file and chmod 0666 ?

yes
The name of the log file must be the same name as used in the script and have 0666 permission so its writable.
I leave it permanent so i dont place the log in /var/tmp, but in /var/log. the natural habitat of log files.

Same principle as used in the support post, they use

# touch /var/tmp/mail.send <-- name and place
# chmod a+rw /var/tmp/mail.send <-- make 0666

i use

# touch /var/log/formmail
# chmod a+rw /var/log/formmail

enable logrotation < how to setting ?

however you want. If you leave the script permanent you need log rotation, else it grows and grows.
I like my logs not compressed (so i can search them), rotated daily and kept for 30 days, but thats up to you.

But this is all besides the point: the point is that the plesk methode (in de support article), nore this script, don't work anymore.

regards
Jan

 

[Linulex]

I notice i have an extra header in the mail. This header is always there: with and without the script, so this is not added by the script

X-PHP-Originating-Script: 10001:mailvb.php

10001 = the UID of the system user, so it is impossible that this was added by php or the website.

If this header is always added by plesk you can add

always_bcc = [email protected]

to /etc/postfix/main.cf

for a short time, examine the source.

But to have the logs would be nice, we use them as proof towards clients to validate why a website has been disabled.

regards
Jan

 

[WSNHosting]

#!/usr/bin/perl -w

## https://kb.plesk.com/114845
## create as /usr/sbin/sendmail.postfix-wrapper
## chmod a+x /usr/sbin/sendmail.postfix-wrapper
## mv /usr/sbin/sendmail.postfix /usr/sbin/sendmail.postfix-bin
## ln -s /usr/sbin/sendmail.postfix-wrapper /usr/sbin/sendmail.postfix

## create /var/log/formmail 0666
## enable logrotation

## test via website, doesn't work via webmail (is smtp)

# use strict;
use Env;
my $date = `date`;
chomp $date;
open (INFO, ">>/var/log/formmail") || die "Failed to open file ::$!";
my $uid = $>;
my @info = getpwuid($uid);
#if($REMOTE_ADDR) {
#print INFO "$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME \n";
#}
#else {
print INFO "$date - $PWD - @info\n";
#}
my $mailprog = '/usr/sbin/sendmail.postfix-bin';
foreach (@ARGV) {
$arg="$arg" . " $_";
}
open (MAIL,"|$mailprog $arg") || die "cannot open $mailprog: $!\n";
while (<STDIN> ) {
print MAIL;
}
close (INFO);
close (MAIL);

this code save file name sendmail.postfix-wrapper ?
is not what file name ?
and how to run ?

 

[Linulex]

## create as /usr/sbin/sendmail.postfix-wrapper

as said in the script.
it is not run, it is the same kind of script as in the plesk support link you gave.

BUT: it doenst work, just like the script in the plesk support link you gave doesn't work anymore. just like i said in my very first post.

I used to have a permanent script in place to log mails send via websites and that is also not working anymore. Both the support article and my usual script worked fine until plesk 17.5.3

regards
Jan

 

[Brujo]

Not true. This support artikel is not working anymore after the update to plesk 17.8.11, atleast not on centos 7

Please take into consider to leave a comment on the mentioned article in the plesk knowledgebase about your results/findings, so that Plesk team can update the article if necessary and also other users can benefit when searching for a solution.

regards Brujo

 

[Linulex]

There is a link to the forum in plesk under "tools & settings" --> "Assistance and Troubleshooting"
There is also a link to support in plesk under "tools & settings" --> "Assistance and Troubleshooting"

This means that the forum is an the official channels that plesk uses to give "Assistance and Troubleshooting" to there clients.

So placing my findings in the forum should be enough.
I don't see the need to post my findings on 2 different places. That would only result in confusion.

Or am i wrong to presume that plesk monitors all the official announced places for "Assistance and Troubleshooting"?

regards
Jan

 

[ismahan11]

After some server changes our PHP configuration got nuked, which caused a client's large mailing list to time out partially through about 4,000 addresses or more. We want to avoid sending a duplicate mail as much as possible, and we have the original mailing list. The mail was sent using PHP's mail() function, which uses sendmail, which says it's using Exim. I've seen the command: sendmail -bp Which gives me a list of mail that appears was sent. This list isn't very big, and could be accurate (meaning the script timed out after sending only a hundred or so e-mails)

 

[Jllynch]

Please take into consider to leave a comment on the mentioned article in the plesk knowledgebase about your results/findings, so that Plesk team can update the article if necessary and also other users can benefit when searching for a solution.

regards Brujo

Ok I've just left a comment there. The script still isn't working.