Somebody uses my server to spam

[Kelmas]

I belive somebody used my server to send spam. I see many messages in "View Relayers" to senders that I DID NOT SEND any e-mails. Account that is shown is one of my accounts and id default:

[email protected]

How can somebody spam through this? I changed my password but I don't think abusers could have accessed my cPanel's account main password.

Could somebody spam trhough some email script placed to cgi-bin by default? I deleted several from there (cgiecho, cgiemail, entropybanner.cgi, randhtml.cgi).

EDITED. I totally forgot the account is sending forum activation messages. That is why relayer is full of addresses I don't know :D

 

[jameshsi]

My server loading went to 200 and I just found someone using my cgiemail to send emails, If you got any idea to stop it, post here.

 

[Rafaelfpviana]

Here are some good tips:

1. Install PHP 5.2 and leave allow_url_include to off
2. Install ConfigServer Firewall http://configservers.com/cp/csf.html
3. Install ConfigServer Mail Queue http://configservers.com/cp/cmq.html

One thing is for sure, the firewall will help you alot, follow "Check Server Security" instructions to secure you server correctly.

 

[brianoz]

What the last poster said

Plus, run phpsuexec. Set the max emails per account per hour to something low-ish like 250 and search for 'maxemails' here for details on how to lift the limit on a per-domain basis.

Install mod_security and add a good set of rules, in particular choose some that block attempts to Bcc in scripts.

Oh yes, and remove the cgiemail script!

 

[jameshsi]

What the last poster said

Plus, run phpsuexec. Set the max emails per account per hour to something low-ish like 250 and search for 'maxemails' here for details on how to lift the limit on a per-domain basis.

Install mod_security and add a good set of rules, in particular choose some that block attempts to Bcc in scripts.

Oh yes, and remove the cgiemail script!

Hi!
If you delete the cgiemail script, will cpanel install it when you upgrade your cpanel to the latest version ?