How to find the script on Plesk server that is sending SPAM as www-data user

Posted on 2009-04-22
Last Modified: 2013-12-20
I am running a Plesk 9.0.1 Web Server on Ubuntu 6.06.2 LTS and have about 100 small to medium web sites hosted on the server. The problem is that I believe one of the websites has a script that is allowing spam to be sent through the server. The reason I believe this is that I get 1000s of messages an our deferred in the mail queue that show to be sent from the www-data user.

My question is if someone can tell me how to find the script or scripts that is sending the SPAM?

Thanks in advance for your help.
Question by:mcminc
    LVL 32

    Expert Comment

    by:Kamran Arshad

    Is it a windows or Linux box?

    Author Comment

    It is a Linux Ubuntu 6.06.2 LTS machine

    Author Comment

    Does anyone have any ideas on what I can try?
    LVL 1

    Accepted Solution

    Take a look at the Plesk KB article:

    You will need to determine where the spam is originating. If it is a user, then frequent SMTP access can often pinpoint the user.  

    If is a web script, then you will see emails coming from the nobody user and you can use this technique:

    Featured Post

    Do You Know the 4 Main Threat Actor Types?

    Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

    Join & Write a Comment

    Granting full access permission allows users to access mailboxes present in their database. By giving full access permission one can open and read the content of any mailbox but cannot send emails from that mailbox.
    Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
    Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
    In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…

    733 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    24 Experts available now in Live!

    Get 1:1 Help Now