security question

Hello,

This may not be the best place to ask, but I know all readers of this list have security experience (we have no other choice).

We have many Freebsd servers with apache/php/mysql.
Recently, some of these have been sending out large amounts of emails. We know the servers are secure in the sense they are fully patched. But we also know that the most secure shared server can be abused by a badly written php script.

So my question is this:
Is there a way to identify vulenrable php scripts?
It's very difficult to pinpoint when the server starts sending out emails. We just notice that they do, without any identifyable correlation to anything on the logs.

A related question:
Can we audit which php script is calling sendmail?

Any advice will be greatly appreciated.

Arie Kachler
Systems Administrator
Telcom.Net



_______________________________________________
freebsd-isp@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-isp
To unsubscribe, send any mail to "freebsd-isp-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: [PHP] Memory limit of 8 MB not enough
    ... I have a PHP script that resizes an image. ... Allowed memory size of 8388608 bytes ... I set the server-wide setting on most of my servers to 64MB. ... but monitoring ...
    (php.general)
  • Identifying a Remote Machine.
    ... I have several servers, each with hundreds of IPs on them. ... I am attempting to write a php script that will connect to each ip and identify the 'hostname' as set in rc.conf. ...
    (freebsd-questions)
  • Re: [PHP] $_REQUEST non populated
    ... > I've made a php script that works fine on many servers, ... > cookies, and not GET or POST vars! ...
    (php.general)
  • unable to open socket connections on select ports?
    ... I wrote a PHP script that needs to connect to port 53 on UDP and on ... some servers it doesn't seem to be working. ...
    (comp.lang.php)