0

I have a CentOS cPanel server and I host about 30 customers in this server.

Sometimes one of these accounts using a CMS get hacked, and the hacker is able to send out spam email using a CMS php vulnerability.

When it happens I see hundred of rows like this below in EXIM log:

2019-07-29 06:40:30 cwd=/home/nordic/public_html 4 args: /usr/sbin/sendmail -t -i -p125

My question is, may I configure temporarily exim.conf to block any email sent from:

/home/nordic/public_html

If yes, how to do that please?

0

I don't think that exim (as /usr/bin/sendmail) can see $CWD

but that doesn't mean that you cannot replace /usr/bin/sendmail with a script of your own that makes these sort of checks before invoking /usr/sbin/exim

eg:

#!/bin/sh
if [ -f  email_blocked.flag ] 
then exit 1
fi
exec /usr/sbin/exim "$@"

this script checks for existance of a file email_blocked.flag in the current directory and refuses to send if it is found.

This won't block anyone smart enough to call /usr/sbin/exim directly, but even disabling exim fully won't prevent them using phpmailer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.