The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

php mail() sending emails not related with domain

Discussion in 'E-mail Discussions' started by morb, Mar 22, 2011.

  1. morb

    morb Registered

    Joined:
    Mar 22, 2011
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    Hi, I had a user acount with php code injected (trought joomla).
    The code is a form to send email thought mail(), i found it sending email from a non existent domain in my server. It had as FROM system@somebank.com, how can I stop this ? Block php from sending emails from non existent domains or from sending emails not related with the domain is being executed.

    sendmail_path = "/usr/sbin/sendmail -t -i -f webmaster@{DMN_NAME}" ??? how to do this ?
     
  2. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,623
    Likes Received:
    21
    Trophy Points:
    38
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    You can remove sendmail and only allow SMTP authentication from PHP scripts. sendmail doesn't have the capabilities of exim for configuration and it's neigh impossible to prevent spoofing and spamming using it. Joomla specifically has the option to use SMTP authentication to send emails in the configuration settings.

    Yes, some users would have to modify their scripts who have not set them to use SMTP authentication if sendmail is no longer on the system, but that's the price to pay for increased security.

    Now, if you do enable SMTP authentication only and want to prevent spoofing using it, you can put the following ACL into the exim configuration:

    Code:
    acl_check_data:
    deny
     authenticated	 = *
     condition = ${if or {{ !eqi{$authenticated_id} {$sender_address} }\
      { !eqi{$authenticated_id} {${address:$header_From:}} }\
     }\
     }
     message	 = Your FROM must be as the account you have authenticated with, your email is not delivered.
    This would go into the box where it has begin acl directly about it (the second box in the WHM > Exim Configuration > Advanced Editor area) and should prevent spoofing via webmail and anyone authenticating with SMTP.

    I actually mention the above rule along with some other tips to help with tracking spammers in this forum post:

    http://forums.cpanel.net/f43/open-relay-170798-p2.html#post777302
     
Loading...

Share This Page