   Stopping spamming via user cgi scripts?
  Hi,This question is really for anyone who has any experience in running & administering shared webservers, hopefully there is someone here with that experience who might be able to help meBasically I'm wandering whether anyone can tell me or point me to some resources regarding stopping spamming via cgi scripts on shared webservers.What I mean is for an ISP with servers which have websites for many different customers hosted on 1 machine, and who also allows customers up upload their own CGI scripts how do you go about detecting/avoiding/stopping spamming via vulnerable scripts which a customer is using on their website?Any resources/ideas would be great thanks.   
  Pretty simple really if you control the server. You can monitor SMTP traffic on a site basis and if anyone is sending out too much then raise a flag and check it out. Also, if you'd give more information on the server setup it would be easier to find links relevent to your current problem.   ;Quote:Original post by tstrimpPretty simple really if you control the server. You can monitor SMTP traffic on a site basis and if anyone is sending out too much then raise a flag and check it out. Also, if you'd give more information on the server setup it would be easier to find links relevent to your current problem.Thanks for your reply. Right now I'm kindof talking about redhat systems running sendmail although it looks as though it might be changing to qmail (which I know absolutely nothing about), webserver is apache, PHP scripts are run via mod PHP so scripts are run as the Apache user (PHP has been modded to attach some tracking info to the mail headers), CGI scripts are suexec'ed to the site owners uid.To be honest, right now I'm not really looking for a specific answer to fix a specific problem on a specific machine, but more trying to find what method people use and are available. Thanks again.   ;  I think PHP has some configuration options that let you disable its mail function; other languages should probably have a similar thing. I dunno what you can do about CGI written in C.qmail/sendmail probably has some option to limit the number of emails you can send in a period; set that to like three per minute and you should be able to figure out spammers a long time before they can do any damage.   ;Quote:Original post by RavuyaI think PHP has some configuration options that let you disable its mail function; other languages should probably have a similar thing. I dunno what you can do about CGI written in C.Thing is you do want to disable the mail function, it's one the to most useful things to customers, what you want to try and do is avoid abuse of the mail system but some how tracking when it is being hammered.Quote:Original post by Ravuyaqmail/sendmail probably has some option to limit the number of emails you can send in a period; set that to like three per minute and you should be able to figure out spammers a long time before they can do any damage.I reckon you are probably right however it would be much more prefeable if it is/was possible to do it by number of messages send by a specific user then when the threshold is met you refuse to send and alert admin...HOWEVER, this may catch a mass mailout to forum members or something which I feel is valid and should be aloud.   ;  I wouldn't disable it or put a cap on the amount of emails they can send. What if it is a legitimate use for sending out a large number of emails? Maybe they have a  newsletter that people have subscribed to? It should be fairly easy to parse /var/log/maillog based on the domain name to get a rough idea of how much mail is being sent out by a particular domain. I would set a limit that it warns  you about. So depending on the kind of clients you have, if they send over 1000 emails in a day you would flag their account and then get in contact with them about the quantity of emails.   ;  Isn't it possible to turn on SpamAssassin for outbound mail?   ;  Yes it is, but that isn't addressing the root of the issue. It would be better to stop the problem at the source then to rely on some filtering methods.   ;Quote:Original post by tstrimpI wouldn't disable it or put a cap on the amount of emails they can send. What if it is a legitimate use for sending out a large number of emails? Maybe they have a  newsletter that people have subscribed to? It should be fairly easy to parse /var/log/maillog based on the domain name to get a rough idea of how much mail is being sent out by a particular domain. I would set a limit that it warns  you about. So depending on the kind of clients you have, if they send over 1000 emails in a day you would flag their account and then get in contact with them about the quantity of emails.Yeah, this was kindof my thinking, seems to be the most flexable solution, I'm gonna look into it more. Thanks!   