RE: Re: Re: Mail from Apache ?

[email protected] wrote:
> On Fri, 20 May 2005 21:50:59 -0400,
> campbell-TtXmYh9KqR1Wk0Htik3J/w wrote:
> 
>> How about checking your apache logs, then, for something that
>> happened around this particular time. It might just give you an IP
>> and what page was being accessed. Older forms for mail on the web
>> are notorious for bad stuff. If you have multiple logs for virtual
>> domains, a quick grep of all of them for the time should let you
>> know which ones to spend time on.
> 
> This is the first I did, of course. But there's nothing
> noteworthy; with 200 users, I have several hits per second,
> and I looked through +/- 10 minutes around one of those mails.
> This is actually what made me think that one of my users
> doing something in their public_html, like playing with PHP
> or so. It looks like there is no log of mail sent from a
> php-page identifying the page it was sent from, then ?
> Oh, well, if life is like that ... !
> Maybe I was still to much under the paranoia of that jukebox of last
> week. 
> 

A few possible solutions...

1- Make a search (grep) on 'mail(' in your webserver's doc root (and
users's UserDir if activated).

2- Read about php's safe_mode feature.
http://ca3.php.net/features.safe-mode

3- If possible, stop sendmail for a while and see who screams.

Hth

Ugo

> Thanks anyway !
> 
> Uwe
> 
> 
> _______________________________________________
> Tao-discuss mailing list
> [email protected]
> http://mailman.taolinux.org/mailman/listinfo/tao-discuss