Geeklog Forums

Since upgrading to 1.4.1 (and possibly before; I've just noticed it), I seem to be getting a number of spam messages sent from my own server to me (which bypasses my firewall, traveling behind it). I am using PHP's mail() function for sending mail, which is in turn configured for sendmail (I use CommuniGate Pro's "sendmail" work-alike).

Here's a typical bogus message (I'm seeing about five of these per day, and luckily, according to the logs in my mail server, only to me, so I'm not relaying out - yet):



As I currently host several GL sites, it's hard to tell which one is being hit. Here's an entry from my CommuniGate Pro log (different message, but illustrative of the report):



Wanting to not switch to the custom mail setup in lib-custom just yet, I tweaked lib-common to add the site name to the X-Mailer header in the hope that I may be able to determine which site it is which may have been penetrated. Looking at my GL users, I have not found the address used to send the messages, nor have I seen anyone logged in at the time any of these seem to have come through (I have fairly low traffic sites over here), so I am guessing that someone is able to pass arguments to lib-common.php (admin/mail.php is fairly well protected) to generate the traffic.

Any thoughts on this, or what I might want to do to better lock down my installations?

TIA

---

Lewis Rosenthal, CNA, CLP, CLE
Rosenthal & Rosenthal, LLC

Not sure how you're coming to the conclusion that the problem is with lib-common.php?

FWIW, lib-common.php has a simple protection against being called directly (it redirects to index.php). Besides, you would still need some code that actually calls the COM_mail function to send the email. So I'd say you should look elsewhere.

Make sure that you really replaced all the files when you did the upgrade. Make sure you don't have files in your webroot that shouldn't be there (anything outside of Geeklog's public_html directory, for example). Check that all the plugins you're using are up to date.

You could also try and correlate the date and time of those emails with suspicious entries in your webserver logfiles. Also see earlier discussions here and here.

bye, Dirk

Thanks for the quick follow-up, Dirk.



Only because mail.php is inaccessible from the outside without a login.



I know that it's supposed to redirect to index.php (tested that, just to be sure), and with REGISTER_GLOBALS off, it shouldn't be possible to push variables to it from outside, yet, I'm hard pressed to figure out from where these messages are originating (just got a new one this morning, and I see it is from my LI WireFree site, based on the modified X-Mailer).



Good advice. I'll look all of these over today. I wonder what else would allow for an email sent to root...? CAPTCHA, perhaps?

You could also try and correlate the date and time of those emails with suspicious entries in your webserver logfiles. Also see earlier discussions here and here.
[/QUOTE]

Thanks for the references. I tried looking through my Apache logs yesterday, but didn't come up with anything useful. I'll have another look today, and perhaps now that I know which site is generating the traffic, turn up the logging for that vhost in the conf.

Again, Dirk, thanks for your thoughts on this. I'll have a look at the links you've provided, dig a bit deeper into the logs, check my upgrade, and will follow up here when I know more. Hopefully, my experience may help someone else with a similar issue.

Cheers.

---

Lewis Rosenthal, CNA, CLP, CLE
Rosenthal & Rosenthal, LLC

Okay, I've just made some modifications and updates.

First, I removed the following (really) old files from webroot:



Next, here were the installed plugins:



I then upgraded:



My GL directory itself is located outside of webspace, and the contents appear to be clean (no old files hanging around).

I'll look over the Apache logs again shortly to see what I can find.

Thanks again for your help and suggestions, Dirk!

---

Lewis Rosenthal, CNA, CLP, CLE
Rosenthal & Rosenthal, LLC

Hmmm... It looks like it may have had something to do with the email story function. I did see entries in the log for that (and access to /profiles.php). I just tested it on myself, and sure enough, I had CAPTCHA turned off for emailing stories (though I'm not seeing a story in my received spam, just the junk).

I'll investigate further this afternoon, but I think that's what it was.

---

Lewis Rosenthal, CNA, CLP, CLE
Rosenthal & Rosenthal, LLC