A little background:
I'm in charge of a fairly old (10.04) web server that hosts lots of outdated, under-maintained sites running on out-of-date versions of platforms like WordPress, Drupal, and Joomla. For various reasons, most of these sites won't see security updates in the near future. My task is to minimize the damage that happens when a site gets compromised (which happens often).
The environment is set up such that different sites can't touch each other's files, and this protection appears to be working; once infected, a site has never been able to infect a neighboring site on the server. The main issue we're having is email spam. There's no SMTP daemon running on the server, and PHP's
I can use the following command to sniff out emails sent over SMTP as they happen:
tcpdump -i eth2 port 25 -X -A -s0
Using the output of this command, I can hunt down the site sending spam, find the script sending it, and clean it out. I'd like to have something like this running in the background 24/7 to watch for symptoms of new infections.
Should I simply run this command within a
screen session and have it output to a logfile? Is there a bater way to run
tcpdump in the background? Is there some other tool that is better suited to monitoring SMTP traffic?
Again, re-infections are almost guaranteed to occur, and for policy reasons out of my control there's not much I can do about it. Some months down the road this server is probably going to be decommissioned altogether, but in the meantime it would be nice to keep our IP out of the blacklists. A simple, temporary band-aid is all I'm looking for here.