Here I am going to tell you some easy step to trace nobody spammer.
- Step 1
- Login to your server and su - to root.
- Step 2
- Turn off exim while we do this so it doesn't freak out./etc/init.d/exim stop
- Step 3
- Backup your original /usr/sbin/sendmail file. On systems using Exim MTA, the sendmail file is just basically a pointer to Exim itself.
- Step 4
- Create the spam monitoring script for the new sendmail. pico /usr/sbin/sendmail Paste in the following:#!/usr/local/bin/perl
# use strict;
use Env;
my $date = `date`;
chomp $date;
open (INFO, ">>/var/log/spam_log") || die "Failed to open file ::$!";
my $uid = $>;
my @info = getpwuid($uid);
if($REMOTE_ADDR) {
print INFO "$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME n";
}
else {
print INFO "$date - $PWD - @infon";
}
my $mailprog = '/usr/sbin/sendmail.hidden';
foreach (@ARGV) {
$arg="$arg" . " $_";
}
open (MAIL,"|$mailprog $arg") || die "cannot open $mailprog: $!n";
while ( ) {
print MAIL;
}
close (INFO);
close (MAIL); - Step 5
- Change the new sendmail permissions
- Step 6
- Create a new log file to keep a history of all mail going out of the server using web scripts
- Step 7
- Start Exim up again.
- Step 8
- Monitor your spam_log file for spam, try using any formmail or script that uses a mail function - a message board, a contact script.
Sample Log Output
/home/username/public_html/directory/subdirectory - nobody x 99 99Nobody / /sbin/nologin
Now here you can see in above sample log that ” NOBODY IS SOMEBODY”.
