Date: Fri, 20 Sep 2013 00:12:50 +0400 From: "Eugene" <genie@geniechka.ru> To: "Glenn McCalley" <glenn@bnetmd.net>, <freebsd-questions@freebsd.org> Subject: Re: how to tell which process call sendmail Message-ID: <5D506458BDD84DADBF90491000A5AB0D@geniepc2011> In-Reply-To: <F76D6286C36C49BDB153CDF656C983F3@GLENN2> References: <F76D6286C36C49BDB153CDF656C983F3@GLENN2>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Glenn, I once wrote some (quick-and-dirty) perl script that monitors network traffic and logs (for matching outgoing connections) the process command line and (if apache) the respective vhost and request. But this would not help if they are calling the sendmail program directly to inject the message into mail queue. (Unverified guess: if you temporarily remove execute permissions on it, the execution error should probably be logged somewhere?). BTW most probably that is not your user as such, but rather some abused comment form or forum script or something like that. Best wishes Eugene -----Original Message----- From: Glenn McCalley Sent: Thursday, September 19, 2013 10:30 PM To: freebsd-questions@freebsd.org Subject: how to tell which process call sendmail So, some idiot is using a cgi or php or something to send mail out of his website that he shouldn't be sending. With a bunch of sites on the server, can't tell who. System accounting can tell me that sendmail was executed 32,976 times, but is there a way to tell what process /file name called it each time? Since it's always called by the www user that doesn't help -- I need to distinguish between legit processes that call 5 or 10 in a day and the idiot who calls the other 31,000 times. Thanks! Glenn. _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5D506458BDD84DADBF90491000A5AB0D>