Re: Tracking down bad php formmail scripts

Once upon a time, James Smallacombe <[email protected]> said:
> I've seen this in the past with various perl cgi's, but those could be 
> tracked down by looking at the apache cgi or suexec logs.  In this case, 
> it must be coming from a client's php script as it shows uid 80 (httpd) as 
> the invoker of qmail.
> 
> The question is, how do you track down which virtual host on your server 
> has the offending code, let alone the code itself?  I can see no further 
> clues in the headers or global httpd error log.

Yeah, PHP sucks like that.

The only way to track it down is to correlate log files.  You have
header timestamps; look in Apache access logs to see which *.php were
hit at that time (within a window, since Apache logs when the script
ends, and it may send more than one request).

In a new twist to make it harder to find and block the requesters, I
have seen spammers use a local account with a cracked password to upload
a PHP, open an HTTP request to the PHP, start feeding it addresses to
spam, and remove the PHP file from the system.  By the time you are
looking, the offending script no longer exists in the filesystem, and
(since it is still running) Apache hasn't logged anything.

If I had spare CPU and RAM on my shared hosting servers, I'd be running
PHP under fastcgi so even PHP scripts run as the site user to make it
much more obvious when crap like this is happening.

-- 
Chris Adams <[email protected]>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.
-- 
Eat sushi frequently. - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list