Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

blank email

Discussion in 'E-mail Discussion' started by netnameus, Jan 31, 2006.

  1. netnameus

    netnameus Well-Known Member

    Joined:
    Mar 7, 2004
    Messages:
    131
    Likes Received:
    0
    Trophy Points:
    166
    I keep recieving a blank email, with no From address. How can I research this further by the header:

    I'm have no idea what to look for to research this.... any direction would help!

    Thanks in advanced
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,460
    Likes Received:
    21
    Trophy Points:
    463
    Location:
    Go on, have a guess
    Since it's a local delivery and from nobody it's going to have come from a php script.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. netnameus

    netnameus Well-Known Member

    Joined:
    Mar 7, 2004
    Messages:
    131
    Likes Received:
    0
    Trophy Points:
    166
    Thanks.... Are there any logs I can look at which will tell me what script?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. dgbaker

    dgbaker Well-Known Member
    PartnerNOC

    Joined:
    Sep 20, 2002
    Messages:
    2,574
    Likes Received:
    3
    Trophy Points:
    343
    Location:
    Toronto, Ontario Canada
    cPanel Access Level:
    DataCenter Provider
    There is one way to find any and all php files that have mail in them, try this command out.

    Code:
    for i in `locate .php|grep home`;do grep mail $i;done 
    That will list all php files under /home that have the word mail in them. You can then scan the list and bypass common ones, like some forum and fantastico files.

    That would be a least a start. :)


    update: May need some tuning to get simplier results.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. dalem

    dalem Well-Known Member
    PartnerNOC

    Joined:
    Oct 24, 2003
    Messages:
    2,679
    Likes Received:
    71
    Trophy Points:
    203
    Location:
    SLC
    cPanel Access Level:
    DataCenter Provider
    put

    log_selector = +all

    in the top box of the Exim Configuration Editor

    and tail your mail logs

    or grep them later
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. netnameus

    netnameus Well-Known Member

    Joined:
    Mar 7, 2004
    Messages:
    131
    Likes Received:
    0
    Trophy Points:
    166
    Appreciate your help!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. netnameus

    netnameus Well-Known Member

    Joined:
    Mar 7, 2004
    Messages:
    131
    Likes Received:
    0
    Trophy Points:
    166
    Still having the issue, and haven't been able to track it down... maybe someone can decipher this for me and tell me where to look?

     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,460
    Likes Received:
    21
    Trophy Points:
    463
    Location:
    Go on, have a guess
    This line:

    suggests that you have a script in /tmp sending out the emails.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. netnameus

    netnameus Well-Known Member

    Joined:
    Mar 7, 2004
    Messages:
    131
    Likes Received:
    0
    Trophy Points:
    166
    Thanks Chripy...

    Here's the contents of that folder, I know the session info is stored there, but what are these files?

    Anything I should be worried about? Can I just delete everything in this folder (except the mysql.sock)

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,460
    Likes Received:
    21
    Trophy Points:
    463
    Location:
    Go on, have a guess
    Looks fine, it's possible it's a self-deleting script. Just incase, try the following:

    lsof | grep /tmp

    It may show up in that as a (deleted) file, but otherwise it looks like it may be more tricky to track down.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. netnameus

    netnameus Well-Known Member

    Joined:
    Mar 7, 2004
    Messages:
    131
    Likes Received:
    0
    Trophy Points:
    166
    I was afraid of that... :D

    The lsof didn't turn up anything unusual. I will keep investigating.

    Thanks
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. msquall

    msquall Member

    Joined:
    Jul 22, 2003
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    151
    Hi,

    You can try "PHP mail() header patch" (works well for me) : http://www.lancs.ac.uk/~steveb/php-mail-header-patch/
    As you will see, it will add a line in the header like :
    Code:
    X-PHP-Script: www.domain.com/myscript/mail.php for 111.222.333.444
    This will make your research more easy, no ?


    And if you want, you can find a patch for CPanel at the bottom of this page : http://choon.net/php-mail-header.php
    With this patch, you just have to recompile php with easyapache.

    Mike
     
  13. altomarketing2

    altomarketing2 Well-Known Member

    Joined:
    Oct 8, 2004
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    SouthAmerica
    do you know how to uninstall chown

    since i installed php is not sending any emails.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  14. altomarketing2

    altomarketing2 Well-Known Member

    Joined:
    Oct 8, 2004
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    SouthAmerica
    i did it

    Just recompiling php and apache from whm, it removes choon script. Thanks
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice