I have a CentOS cPanel server and I host about 30 customers in this server.

Sometimes one of these accounts using a CMS get hacked, and the hacker is able to send out spam email using a CMS php vulnerability.

When it happens I see hundred of rows like this below in EXIM log:

2019-07-29 06:40:30 cwd=/home/nordic/public_html 4 args: /usr/sbin/sendmail -t -i -p125

My question is, may I configure temporarily exim.conf to block any email sent from:


If yes, how to do that please?

1 Answer 1


I don't think that exim (as /usr/bin/sendmail) can see $CWD

but that doesn't mean that you cannot replace /usr/bin/sendmail with a script of your own that makes these sort of checks before invoking /usr/sbin/exim


if [ -f  email_blocked.flag ] 
then exit 1
exec /usr/sbin/exim "$@"

this script checks for existance of a file email_blocked.flag in the current directory and refuses to send if it is found.

This won't block anyone smart enough to call /usr/sbin/exim directly, but even disabling exim fully won't prevent them using phpmailer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .