Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

A little background:

I'm in charge of a fairly old (10.04) web server that hosts lots of outdated, under-maintained sites running on out-of-date versions of platforms like WordPress, Drupal, and Joomla. For various reasons, most of these sites won't see security updates in the near future. My task is to minimize the damage that happens when a site gets compromised (which happens often).

The environment is set up such that different sites can't touch each other's files, and this protection appears to be working; once infected, a site has never been able to infect a neighboring site on the server. The main issue we're having is email spam. There's no SMTP daemon running on the server, and PHP's mail function is disabled, but infected sites are still managing to send mail directly using SMTP. There are legitimate sites on the server that need to send emails via SMTP, so simply shutting off port 25 in the firewall isn't an option.

My question:

I can use the following command to sniff out emails sent over SMTP as they happen:

tcpdump -i eth2 port 25 -X -A -s0

Using the output of this command, I can hunt down the site sending spam, find the script sending it, and clean it out. I'd like to have something like this running in the background 24/7 to watch for symptoms of new infections.

Should I simply run this command within a screen session and have it output to a logfile? Is there a bater way to run tcpdump in the background? Is there some other tool that is better suited to monitoring SMTP traffic?

Again, re-infections are almost guaranteed to occur, and for policy reasons out of my control there's not much I can do about it. Some months down the road this server is probably going to be decommissioned altogether, but in the meantime it would be nice to keep our IP out of the blacklists. A simple, temporary band-aid is all I'm looking for here.

share|improve this question
1  
Can you disable (firewall out) outgoing SMTP by default and enable it for a few selected hosts (if they do not support port 587)? –  Andrzej A. Filip Jul 24 at 20:12
    
I've already proposed that, but it may not happen for a while. Adding simple rules to the firewall is a whole "thing" here. –  Dan Jul 24 at 21:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.