Home / server / Questions / 721061
In Process
ThaKidd KG5ORD
Asked: 2015-09-09 19:31:49 +0800 CST

How To Only Restrict PHP5/Apache to Send Mail Only To Local Users

  • 772

I need some help. I am running lastest stable Ubuntu which hosts Apache/PHP5 and also delivers email. I host some WordPress sites for other users and have been waging a war for months now combatting attackers who find bad permissions on directories and use that to upload php scripts to send spam through the server.

I of course am taking steps to automate security of WordPress but would also like to knock out PHP5/Apache's ability to send mail to any address not locally deliverable.

I am configuring a new server to do this on. I will be running the latest version of MailScanner with a choice of Sendmail or Postfix. This would specifically be directed at locking down the wwwdata user to only send locally.

I have already setup PHP5 mail logging but need to take this a step further because my hosting provider goes draconian when spam starts flowing. So far I have not had any luck finding answers via Google. Only thing I have found so far involves either disabling PHP's mail function or to log, review, firewall out IPs and delete offending scripts. Any help is appreciated.

ubuntu

1 Answers

  1. This answer assumes postfix mta.

    In php.ini add:

    mail.add_x_header = 1

    In /etc/main.cf add:

    header_checks = pcre:/etc/postfix/header_checks.pcre

    Content of /etc/postfix/header_checks.pcre

    if /X-PHP-Originating-Script.*/
!/To:[a-zA-Z0-9._%+-]+(@(localdomain1.com|localdomain2.com))?$/ REJECT PHP Mail is only allowed to submit mail for local delivery.
endif

    The regex used here covers commonly used characters in the local part of email addresses, but does not cover every valid character as per RFC, YMMV.

    • 0