How to identify spam source on Plesk for Linux Server

Connect to the server via SSH.

Create a /usr/sbin/sendmail.postfix-wrapper script with the following content:

CONFIG_TEXT: #!/bin/sh
(echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|/usr/sbin/sendmail.postfix-bin "$@"

Create /var/tmp/mail.send log file and set a+rw permissions. Make the wrapper executable, rename the old sendmail.postfix file, and link it to the new wrapper:

# touch /var/tmp/mail.send
# chmod a+rw /var/tmp/mail.send
# chmod a+x /usr/sbin/sendmail.postfix-wrapper
# mv /usr/sbin/sendmail.postfix /usr/sbin/sendmail.postfix-bin
# ln -s /usr/sbin/sendmail.postfix-wrapper /usr/sbin/sendmail.postfix

Wait for a while to collect data: 30 -60 min.

Rename sendmail.postfix-bin back to /usr/sbin/sendmail.postfix:

# mv /usr/sbin/sendmail.postfix /root/backup__sendmail.postfix
# mv /usr/sbin/sendmail.postfix-bin /usr/sbin/sendmail.postfix

Note: File /var/tmp/mail.send is not rotated automatically and it is not recommended to leave it for a long period of time as it could consume a server disk space. Delete and create a new file /var/tmp/mail.send after every check up.

Check /var/tmp/mail.send file. There should be lines starting with "X-Additional-Header" pointing to the domain folders where the scripts that sent the mail are located.

The directories, from which mail PHP scripts are run, can be seen using the following command:

# grep X-Additional /var/tmp/mail.send | grep `cat /etc/psa/psa.conf | grep HTTPD_VHOSTS_D | sed -e 's/HTTPD_VHOSTS_D//' `

Note: If no output is shown from the command above, it means no mail was sent using the PHP mail function from the Plesk virtual host's directory.

Usually, that means one of the mail accounts has been compromised. Check the login attempt count:

# zgrep -c 'sasl_method=LOGIN' /var/log/maillog*
/var/log/maillog:221000
/var/log/maillog.processed:362327
/var/log/maillog.processed.1.gz:308956

If an unusually high number of login attempts is shown, it is very likely accounts were compromised. Try identifying these accounts in the following way:

# zgrep -h 'sasl_method' /var/log/maillog* | cut -d' ' -f9 | cut -d= -f2 | sort | uniq -c | sort -nr
891574 sasl_username=admin@example.com

To stop spam from being sent, change passwords for the compromised accounts and restart the Postfix service.

Also, check Administrator's Guide

Connect to the server via SSH.

Create a /usr/sbin/sendmail-wrapper script with the following content:

CONFIG_TEXT: #!/bin/sh
(echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|/usr/sbin/sendmail-bin "$@"

Create /var/tmp/mail.send log file and set a+rw permissions. Make the wrapper executable, rename the old sendmail file, and link it to the new wrapper:

# touch /var/tmp/mail.send
# chmod a+rw /var/tmp/mail.send
# chmod a+x /usr/sbin/sendmail-wrapper
# mv /usr/sbin/sendmail /usr/sbin/sendmail-bin
# ln -s /usr/sbin/sendmail-wrapper /usr/sbin/sendmail

Wait for a while to collect data: 30-60 min.

Rename sendmail-bin back to /usr/sbin/sendmail:

# mv /usr/sbin/sendmail /root/backup__sendmail
# mv /usr/sbin/sendmail-bin /usr/sbin/sendmail

Note: File /var/tmp/mail.send is not rotated automatically and it is not recommended to leave it for a long period of time as it could consume a server disk space. Delete and create a new file /var/tmp/mail.send after every check up.

Check /var/tmp/mail.send file. There should be lines starting with "X-Additional-Header" pointing to the domain folders where the scripts that sent the mail are located.

The directories, from which mail PHP scripts are run, can be seen using the following command:

# grep X-Additional /var/tmp/mail.send | grep `cat /etc/psa/psa.conf | grep HTTPD_VHOSTS_D | sed -e 's/HTTPD_VHOSTS_D//' `

Note: If no output is shown from the command above, it means no mail was sent using the PHP mail function from the Plesk virtual host's directory.

Usually, that means one of the mail accounts has been compromised. Check the login attempt count:

# zgrep -c 'sasl_method=LOGIN' /var/log/maillog*
/var/log/maillog:221000
/var/log/maillog.processed:362327
/var/log/maillog.processed.1.gz:308956

If an unusually high number of login attempts is shown, it is very likely accounts were compromised. Try identifying these accounts in the following way:

# zgrep -h 'sasl_method' /var/log/maillog* | cut -d' ' -f9 | cut -d= -f2 | sort | uniq -c | sort -nr
891574 sasl_username=admin@example.com

To stop spam from being sent, change passwords for the compromised accounts and restart the Postfix service.

Also, check Administrator's Guide