Find spamming website on shared server

Problem:
Your shared server is misused for spamming using some php script. Since there are hundreds of websites or domains on your server it is not easy to find out which domain or which script the culprit is.


Solution:
Write a wrapper script:

Find the active sendmail “path” in php.ini:

grep sendmail_path /etc/php.ini

This is usually something like:

sendmail_path = /usr/sbin/sendmail -t -i

Write a new shell script /usr/local/sbin/sendmail_php.sh:

#!/bin/bash
logger php_mail: dir=${PWD}
/usr/sbin/sendmail -t -i $*

Change /etc/php.ini accordingly:

sendmail_path = /usr/local/sbin/sendmail_php.sh

Restart your webserver.

Now when some php form is using mail() you will see following entry in your server logs:

May 3 11:29:58 www42 logger: php_mail: dir=/var/www/vhosts/example.com/httpdocs/guestbook

How to test if mod_rewrite is enabled and working

Problem:
Many CMS and Blogs need mod_rewrite. However the usual user is not able to debug the problem if the pre-configured .htaccess is not working as expected.


Solution:
Write a simple .htaccess to find out if mod_rewrite is even working for your root webdirectory: Create a file .htaccess with followig content:

RewriteEngine On
RewriteRule ^i1.html$ /i2.html

Create two more testfiles:
echo "1" >i1.html
echo "2" >i2.html

If you fire up your browser with
http://yourdomain/i1.html
and you see “1” mod_rewrite is not working. If you see “2” then mod_rewrite is working fine and you do not have to bugger your hoster to check if mod_rewrite ist doing its job 😉