How to log all PHP based E-mails for abuse

Step #1 - Create Wrapper Script

vi /usr/local/bin/phpsendmail

#!/usr/bin/php
<?php

//changed by realtechtalk.com to make the log readable
/**
  This script is a sendmail wrapper for php to log calls of the php mail() function.
  Author: Till Brehm, www.ispconfig.org
  (Hopefully) secured by David Goodwin <david @ _palepurple_.co.uk>
*/

$sendmail_bin = '/usr/sbin/sendmail';
$logfile = '/tmp/mail_php.log';

//* Get the email content
$logline = '';
$pointer = fopen('php://stdin', 'r');

while ($line = fgets($pointer)) {
        if(preg_match('/^to:/i', $line) || preg_match('/^from:/i', $line)) {
                $logline .= trim($line).' ';
        }
        $mail .= $line;
}

//* compose the sendmail command
$command = 'echo ' . escapeshellarg($mail) . ' | '.$sendmail_bin.' -t -i';
for ($i = 1; $i < $_SERVER['argc']; $i++) {
        $command .= escapeshellarg($_SERVER['argv'][$i]).' ';
}



//* Write the log
//file_put_contents($logfile, date('Y-m-d H:i:s') . ' ' . $_ENV['PWD'] . ' ' . $logline, FILE_APPEND);

//changed by realtechtalk.com to make the log readable
file_put_contents($logfile, date('Y-m-d H:i:s') . ' ' . $_ENV['PWD'] . ' ' . $logline . PHP_EOL, FILE_APPEND);
//* Execute the command
return shell_exec($command);
?>

Make it executable:

chmod +x /usr/local/bin/phpsendmail

Create Log File (on Centos the log does not get created or written to unless you do it manually)

touch /tmp/mail_php.log; chmod 777 /tmp/mail_php.log;chown apache.apache /tmp/mail_php.log

Step 2 - Backup & Modify php.ini

cp /etc/php.ini /etc/php.ini-bk

(Your php.ini may be in a different location depending on your OS/control panel).

Edit  /etc/php.ini

Find the part that starts with "sendmail" and make it like my example below:

sendmail_path = /usr/local/bin/phpsendmail

; For Win32 only.
;sendmail_from = me@example.com

; For Unix only.  You may supply arguments as well (default: "sendmail -t -i").
;sendmail_path = /usr/sbin/sendmail -t -i
sendmail_path = /usr/local/bin/phpsendmail

Restart httpd:

service httpd restart

After this you should find entries in /tmp/mail_php.log
 


Tags:

php, mails, abusestep, wrapper, vi, usr, bin, phpsendmail, realtechtalk, readable, sendmail, author, brehm, www, ispconfig, org, secured, goodwin, _palepurple_, uk, sendmail_bin, sbin, logfile, tmp, mail_php, email, content, logline, pointer, fopen, stdin, fgets, preg_match, trim, compose, echo, escapeshellarg, _server, argc, argv, file_put_contents, _env, pwd, file_append, php_eol, execute, shell_exec, executable, chmod, centos, manually, chown, apache, modify, ini, cp, etc, bk, depending, os, panel, edit, quot, sendmail_path, sendmail_from, unix, arguments, default, restart, httpd, entries,

Latest Articles

  • How to combine .txt ACLs without breaking things
  • How to ping all of Googlebot's IPs script
  • 'virtio0' uses a qcow2 feature which is not supported by this qemu version: QCOW version 3
  • Linux bash script to get the IP of a list of hostnames
  • How To Use Camera Webcam in Docker for OBS Studio etc...
  • Computer Server Won't Post Boot Or Enter BIOS Setup After Installing RAID SAS or GPU Card etc..
  • How To Test PHP Scripts from CLI with GET variables/query string
  • apt-cache how to see all available versions of a package in Debian Ubuntu Mint
  • Virtualbox VBox Guest-utils drag and drop files stops working with Windows VMs
  • How To Remove Ubuntu Netplan and Go Back to /etc/network/interfaces
  • How To Force Flash an AMD Instinct GPU To Another Model Using Debian Ubuntu Mint Linux
  • How To compile ollama from source to use unsupported AMD GPU with rocm in Ubuntu Debian
  • QEMU KVM Virtio GPU Windows Cannot Select 1080P
  • Linux Gnome Desktop Ubuntu Mint Debian Gets Slower After Weeks
  • Firefox How to Save Full Page As Screenshot/PDF
  • Nvidia Datacenter Driver Tesla Slow nvidia-smi response and high utilization with 0 usage
  • ffmpeg how to normalize / increase the volume of your audio
  • kdenlive audio blips pops cracks artifacts solution fix
  • haproxy / nginx certbot SSL issues
  • nginx how to see the real IP when behind a CDN