Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Stop cpanelusername@hostname.tld from sending mail ?

Discussion in 'E-mail Discussion' started by nisamudeen97, Apr 4, 2015.

  1. nisamudeen97

    nisamudeen97 Well-Known Member

    Joined:
    Jul 7, 2010
    Messages:
    49
    Likes Received:
    5
    Trophy Points:
    58
    Location:
    Cochin
    cPanel Access Level:
    Root Administrator
    My server is used for hosting CMS like wordpress and joomla, as most of the clients are using plugins and themes which are not being downloaded from authorized websites lots of spam mails are found being generated from self triggered spam bot scripts. I have managed to enable detailed exim log and I am able to find the exact script which has caused the issue each time. Meanwhile is it possible to stop these malicious scripts only from spamming

    What I want to do is stop mails which are being of the form "cpanelusername@hostname.tld" ? ie stop mailing from the scripts that are not using proper authentication to sent mails
    Is it possible with out disabling php mail () ?

    I am not supposed to use any kind of third party spam detection software’s. I have done all recommended things by cpanel to prevent email abuse

    url https://documentation.cpanel.net/display/CKB/How+to+Prevent+Email+Abuse

    I need some mechanism in exim to stop this. Is it possible ?
     
    #1 nisamudeen97, Apr 4, 2015
  2. 24x7server

    24x7server Well-Known Member

    Joined:
    Apr 17, 2013
    Messages:
    1,834
    Likes Received:
    85
    Trophy Points:
    78
    Location:
    India
    cPanel Access Level:
    Root Administrator
    Hello,

    You can disable your php mail function through with the disable function in php.ini file. Also please give a try with the following command. You will get the directory list which are sending the mails from your server.

    Code:
    awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 24x7server, Apr 5, 2015
    madmanmachines likes this.
  3. nisamudeen97

    nisamudeen97 Well-Known Member

    Joined:
    Jul 7, 2010
    Messages:
    49
    Likes Received:
    5
    Trophy Points:
    58
    Location:
    Cochin
    cPanel Access Level:
    Root Administrator
    Hi,

    Thanks for the update. I have already done your suggestions and I am aware about all these. I have already disabled mail function in the server meanwhile what i need is to stop mails which are being of the form "cpanelusername@hostname.tld" most probably the mails which are being sent via php scripts in a "suphp" server.
     
    #3 nisamudeen97, Apr 7, 2015
  4. 24x7server

    24x7server Well-Known Member

    Joined:
    Apr 17, 2013
    Messages:
    1,834
    Likes Received:
    85
    Trophy Points:
    78
    Location:
    India
    cPanel Access Level:
    Root Administrator
    Hello,

    It's default behavior of Exim mail server is to use the cPanel username and hostname of the server, If the From: field is not formatted correctly, empty or the email address does not exist in the cPanel, the From: address will be changed to cpanelusername@hostname.tld

    If you want to stop this, You will have to use SMTP authentication instead of php mail in your script to send mail from your server
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 24x7server, Apr 7, 2015
  5. nisamudeen97

    nisamudeen97 Well-Known Member

    Joined:
    Jul 7, 2010
    Messages:
    49
    Likes Received:
    5
    Trophy Points:
    58
    Location:
    Cochin
    cPanel Access Level:
    Root Administrator
    What I want to do is stop mails which are being of the form "cpanelusername@hostname.tld" ? ie stop mailing from the scripts that are not using proper authentication to sent mails.


    Is there any mechanism in exim ? While researching in this topic , I met with the below update.

    Go to the location WHM >> Service Configuration >> Exim Configuration Manager

    Under the section filer, you'll see the file used by exim for filtering. Open that file from the backend of your server and add the below piece of code in the end.


    if first_delivery
    and ( (“$h_from:” contains “emailtoblock@domainname.com”)
    )
    then fail
    endif


    Restart exim


    Is it possible to modify the above if con and prevent all users from sending mail via php script ?
     
    #5 nisamudeen97, Apr 7, 2015
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,344
    Likes Received:
    1,852
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Are you sure that you have already disabled the mail function of PHP? Users should not be able to send out email through PHP if you have disabled that function.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #6 cPanelMichael, Apr 10, 2015
  7. nisamudeen97

    nisamudeen97 Well-Known Member

    Joined:
    Jul 7, 2010
    Messages:
    49
    Likes Received:
    5
    Trophy Points:
    58
    Location:
    Cochin
    cPanel Access Level:
    Root Administrator
    Hi Michael,

    As I have stopped mail function no mails are being sent from the server meanwhile I would like to know if there is some other way to disable "cpanelusername@hostname.tld" from sending mails with out disabling php mail () in the server.
     
    #7 nisamudeen97, Apr 11, 2015
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,344
    Likes Received:
    1,852
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #8 cPanelMichael, Apr 14, 2015
  9. nisamudeen97

    nisamudeen97 Well-Known Member

    Joined:
    Jul 7, 2010
    Messages:
    49
    Likes Received:
    5
    Trophy Points:
    58
    Location:
    Cochin
    cPanel Access Level:
    Root Administrator
    Hi Michael,

    Thanks for the update, the below post contains answers for my questions.

    https://forums.cpanel.net/threads/how-do-i-block-one-domain-from-sending-email-from-my-server.223731/#post920912

    I am unable to find answer for my main question. I am not supposed to disable mail sending for a single domain. I just wanted to disable mails being sent using php scripts which are of the form
    cpanelusername@hostname.tld. All other mails of the account sent using authentication via webmail, thunderbird must work fine. Is there any solution for this ?
     
    #9 nisamudeen97, Apr 19, 2015
    Last edited by a moderator: Apr 19, 2015
  10. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,344
    Likes Received:
    1,852
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    There's no other way I am aware of to stop PHP scripts from sending mails other than by disabling the mail function of PHP in the php.ini file.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #10 cPanelMichael, Apr 21, 2015
(You must log in or sign up to post here.)
Loading...
Similar Threads - Stop cpanelusername@hostname sending
  1. CrazySerb

    SOLVED Cron jobs stopped working after cPanel to cPanel transfer to a new server

    CrazySerb, Aug 14, 2018 at 3:05 AM, in forum: General Discussion
    Replies:
    3
    Views:
    49
    CrazySerb
    Aug 15, 2018 at 11:40 AM
  2. Volkinson

    admin-ajax.php stopped working on all WP sites after update

    Volkinson, Aug 9, 2018, in forum: General Discussion
    Replies:
    6
    Views:
    107
    Volkinson
    Aug 16, 2018 at 1:42 PM
  3. verdon

    SOLVED Stop PHP Error Notices and Warnings from being logged?

    verdon, Jul 31, 2018, in forum: EasyApache
    Replies:
    10
    Views:
    81
    cPanelMichael
    Aug 1, 2018
  4. David_spm

    Unable to stop large xmlrpc spam attack

    David_spm, Jul 24, 2018, in forum: Security
    Replies:
    6
    Views:
    162
    cPanelMichael
    Jul 27, 2018
  5. willke

    Stop AutoSSL notification emails - "The SSL certificate expires on ..."

    willke, Jul 4, 2018, in forum: Security
    Replies:
    7
    Views:
    173
    willke
    Jul 24, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice