Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

php mail() sending emails not related with domain

Discussion in 'E-mail Discussion' started by morb, Mar 22, 2011.

  1. morb

    morb Registered

    Mar 22, 2011
    Likes Received:
    Trophy Points:
    Hi, I had a user acount with php code injected (trought joomla).
    The code is a form to send email thought mail(), i found it sending email from a non existent domain in my server. It had as FROM, how can I stop this ? Block php from sending emails from non existent domains or from sending emails not related with the domain is being executed.

    sendmail_path = "/usr/sbin/sendmail -t -i -f webmaster@{DMN_NAME}" ??? how to do this ?
  2. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Oct 2, 2010
    Likes Received:
    Trophy Points:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    You can remove sendmail and only allow SMTP authentication from PHP scripts. sendmail doesn't have the capabilities of exim for configuration and it's neigh impossible to prevent spoofing and spamming using it. Joomla specifically has the option to use SMTP authentication to send emails in the configuration settings.

    Yes, some users would have to modify their scripts who have not set them to use SMTP authentication if sendmail is no longer on the system, but that's the price to pay for increased security.

    Now, if you do enable SMTP authentication only and want to prevent spoofing using it, you can put the following ACL into the exim configuration:

     authenticated	 = *
     condition = ${if or {{ !eqi{$authenticated_id} {$sender_address} }\
      { !eqi{$authenticated_id} {${address:$header_From:}} }\
     message	 = Your FROM must be as the account you have authenticated with, your email is not delivered.
    This would go into the box where it has begin acl directly about it (the second box in the WHM > Exim Configuration > Advanced Editor area) and should prevent spoofing via webmail and anyone authenticating with SMTP.

    I actually mention the above rule along with some other tips to help with tracking spammers in this forum post:
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice