how to block an email sent using a script in EXIM

Question

I have a CentOS cPanel server and I host about 30 customers in this server.

Sometimes one of these accounts using a CMS get hacked, and the hacker is able to send out spam email using a CMS php vulnerability.

When it happens I see hundred of rows like this below in EXIM log:

2019-07-29 06:40:30 cwd=/home/nordic/public_html 4 args: /usr/sbin/sendmail -t -i -p125

My question is, may I configure temporarily exim.conf to block any email sent from:

/home/nordic/public_html

If yes, how to do that please?

Answer 1

I don't think that exim (as /usr/bin/sendmail) can see $CWD

but that doesn't mean that you cannot replace /usr/bin/sendmail with a script of your own that makes these sort of checks before invoking /usr/sbin/exim

eg:

#!/bin/sh
if [ -f  email_blocked.flag ] 
then exit 1
fi
exec /usr/sbin/exim "$@"

this script checks for existance of a file email_blocked.flag in the current directory and refuses to send if it is found.

This won't block anyone smart enough to call /usr/sbin/exim directly, but even disabling exim fully won't prevent them using phpmailer.