运行 Nginx 和 PHP 的 Ubuntu 服务器上的 Spambot
我的 VPS 感染了垃圾邮件机器人。我收到来自 VPS 主机的电子邮件，通知我正在发送垃圾邮件，并且它锁定了端口 25。
我正在运行 Ubuntu (21.10) 和 Ubuntu (21.10)。 Nginx (1.18.0) 网络服务器。
我重新启用了端口 25，试图通过监视修复后的邮件队列并检查标头来了解垃圾邮件机器人的具体位置。
我正在寻找的是发送这些电子邮件的原始脚本...
postqueue -p
-- 这为我提供了邮件队列中服务器发送的所有电子邮件的详细信息。
postcat -q CA4784615B 37C
--- 当应用于示例垃圾邮件的邮件 ID 时，此命令会向我提供附加信息。
我认为我需要找到原始 PHP 脚本，因此我已在电子邮件标题中启用了日志记录。
当我在启用 X-PHP-Originating 后查看电子邮件标题时- 脚本日志记录，它仍然不显示发送电子邮件的内容或位置。
有人可以帮忙吗？这真的让我的客户很恼火，因为服务器没有发送电子邮件，并且所有联系表单都已关闭。
谢谢，
Adam
编辑找到了一个潜在的解决方案：**
我安装了适用于 Linux 的 Sophos v9 防病毒软件：
https://www.sophos.com/en-us/support/downloads/endpoint-client
启用按需扫描并运行快速扫描：
它发现了这一点：
<一href="https://i.sstatic.net/CXGCv.jpg" rel="nofollow noreferrer">Sophos 结果
减去有问题的域名，它发现了 PHP/WebShell-O——一个可以利用的漏洞用于僵尸网络。
由于擦除了所有有问题的文件，因此在网络层和网络层解锁了端口 25。查看邮件队列，我没有看到任何垃圾邮件！
会继续关注，但这可能就结束了！
My VPS is infected with a spambot. I receive emails from the VPS host informing me spam emails are being sent and it locked down port 25.
I'm running Ubuntu (21.10) & Nginx (1.18.0) web server.
I've re-enabled port 25 to try to get to the bottom of where the spambot is by monitoring the post-fix mail queue and examining the headers.
What I am looking for is the originating script sending these emails...
postqueue -p
-- This gives me a breakdown of all the emails sent by the server in the mailqueue.
postcat -q CA4784615B 37C
--- This command when applied to the message ID of a sample spam email gives me attached information.
I think I need to find the originating PHP script, so I have enabled logging that in the header of emails.
Enabled PHP Originating Script Logging
When I look at the header of emails after enabling X-PHP-Originating-Script logging, it still doesn't show what it sending the emails or location.
Can anyone help? This is really annoying my customers as no emails are being sent by the server and all contact forms are down.
Thanks,
Adam
EDIT Found a potential solution:**
I installed Sophos v9 antivirus for Linux:
https://www.sophos.com/en-us/support/downloads/endpoint-client
Enabled on-demand scanning and ran a quick scan:
It found this:
Minus the domain names in question, it found PHP/WebShell-O -- an exploit that can be used for botnets.
Since wiping all the files in question, unblocking port 25 at the network layer & watching the mail queue, I don't see any spam!
Will keep monitoring, but this might be the end of it!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您是否被感染（来自未知来源的软件正在您的计算机上运行）或者您是否运行开放中继（外部的任何人都可以通过端口 25 到达您的服务器并加载大量要发送的垃圾邮件）？
如果您被某些东西感染，唯一真正正确的解决方案是从头开始重新设置整个机器。 （这包括操作系统。）
不要忘记先进行备份，这样您就可以访问各个数据和配置文件，但从干净的源安装所有可执行文件。
这是一个非常严厉的解决方案，也是一个深度的解决方案，但如果你被感染了，你就不知道你的计算机上还发生了什么。如果您只是尝试“快速清理”，可能会安装一个后门，在一分钟内重新感染所有内容。
您还必须扫描系统是否有任何已知漏洞，因为如果您只是再次设置相同的系统，则在完成安装之前，感染可能会再次发生。
如果您“只是”运行开放中继服务器，则无需重新设置服务器。在这种情况下，您必须限制仅 localhost（通过将 postfix 配置为仅侦听 localhost 接口）或某些有限的源 IP 地址（使用防火墙配置）对 SMTP 服务器的访问，甚至最好尝试添加某种形式的身份验证SMTP 服务器。
一般来说，如今在您自己的计算机上运行功能齐全的 SMTP 服务器是一项关键任务 - 滥用的可能性非常高。我建议您为本地主机配备一个小型“转发器”，或者让应用程序使用由专业提供商运行的另一个 SMTP 服务器。
Are you infected (software from an unknown source is running on your machine) or do you run an open relay (anybody from outside can reach your server via port 25 and load off tons of spam to be sent)?
If you are infected by something, the only real proper solution is, to re-setup the whole machine from scratch. (This includes the operating system.)
Don't forget to take a backup first, so you can access individual data and configuration files, but get all executable stuff installed from a clean source.
This is a very harsh solution and a deep cut, but if you were infected, you don't know what else is going on on your computer. There could be a backdoor installed that re-infects everything within a minute, if you just try to "clean up quickly".
You also have to scan your system for any known vulnerabilities, because if you simply set up the same system again, the infection could happen again before you even finished installation.
If you "just" run an open relay server, the server re-setup is not necessary. In that case you have to limit access to your SMTP server for just localhost (by configuring postfix to just listen to localhost interface) or by some limited source IP addresses (with a firewall configuration) and even better try to add some form of authentication for the SMTP server.
In general nowadays running a full featured SMTP server on your own machine is a critical mission - potential for abuse is really high. I would recommend that you just have a tiny "forwarder" for your local host or have the applications use another SMTP server run by a professional provider.