How to log all PHP based E-mails for abuse

Step #1 - Create Wrapper Script

vi /usr/local/bin/phpsendmail

#!/usr/bin/php
<?php

//changed by realtechtalk.com to make the log readable
/**
  This script is a sendmail wrapper for php to log calls of the php mail() function.
  Author: Till Brehm, www.ispconfig.org
  (Hopefully) secured by David Goodwin <david @ _palepurple_.co.uk>
*/

$sendmail_bin = '/usr/sbin/sendmail';
$logfile = '/tmp/mail_php.log';

//* Get the email content
$logline = '';
$pointer = fopen('php://stdin', 'r');

while ($line = fgets($pointer)) {
        if(preg_match('/^to:/i', $line) || preg_match('/^from:/i', $line)) {
                $logline .= trim($line).' ';
        }
        $mail .= $line;
}

//* compose the sendmail command
$command = 'echo ' . escapeshellarg($mail) . ' | '.$sendmail_bin.' -t -i';
for ($i = 1; $i < $_SERVER['argc']; $i++) {
        $command .= escapeshellarg($_SERVER['argv'][$i]).' ';
}



//* Write the log
//file_put_contents($logfile, date('Y-m-d H:i:s') . ' ' . $_ENV['PWD'] . ' ' . $logline, FILE_APPEND);

//changed by realtechtalk.com to make the log readable
file_put_contents($logfile, date('Y-m-d H:i:s') . ' ' . $_ENV['PWD'] . ' ' . $logline . PHP_EOL, FILE_APPEND);
//* Execute the command
return shell_exec($command);
?>

Make it executable:

chmod +x /usr/local/bin/phpsendmail

Create Log File (on Centos the log does not get created or written to unless you do it manually)

touch /tmp/mail_php.log; chmod 777 /tmp/mail_php.log;chown apache.apache /tmp/mail_php.log

Step 2 - Backup & Modify php.ini

cp /etc/php.ini /etc/php.ini-bk

(Your php.ini may be in a different location depending on your OS/control panel).

Edit  /etc/php.ini

Find the part that starts with "sendmail" and make it like my example below:

sendmail_path = /usr/local/bin/phpsendmail

; For Win32 only.
;sendmail_from = me@example.com

; For Unix only.  You may supply arguments as well (default: "sendmail -t -i").
;sendmail_path = /usr/sbin/sendmail -t -i
sendmail_path = /usr/local/bin/phpsendmail

Restart httpd:

service httpd restart

After this you should find entries in /tmp/mail_php.log
 


Tags:

php, mails, abusestep, wrapper, vi, usr, bin, phpsendmail, realtechtalk, readable, sendmail, author, brehm, www, ispconfig, org, secured, goodwin, _palepurple_, uk, sendmail_bin, sbin, logfile, tmp, mail_php, email, content, logline, pointer, fopen, stdin, fgets, preg_match, trim, compose, echo, escapeshellarg, _server, argc, argv, file_put_contents, _env, pwd, file_append, php_eol, execute, shell_exec, executable, chmod, centos, manually, chown, apache, modify, ini, cp, etc, bk, depending, os, panel, edit, quot, sendmail_path, sendmail_from, unix, arguments, default, restart, httpd, entries,

Latest Articles

  • CentOS 7 / 8 cannot boot with with mdadm RAID array solution
  • How To Add Default Gateway in Linux using the ip route command routing
  • Error: Failed to download metadata for repo 'appstream': Cannot prepare internal mirrorlist: No URLs in mirrorlist Solution for Centos8 yum package install error
  • md mdadm array inactive how to start and activate the RAID array
  • Loaded: masked (Reason: Unit hostapd.service is masked.) Solution in Linux Debian Mint Ubuntu
  • Linux Mint Ubuntu Ubiquity Installer Bug EFI Installed To Wrong Partition Solution
  • Libreoffice Impress How To Change The Color of Links
  • ecryptfs How To Backup / Migrate Linux Mint Ubuntu Debian system ecryptfs properly and restore access
  • i915 nouveau Nvidia GPU not starting lightdm Xorg failing solution for Could not determine valid watermarks for inherited state
  • br0: received packet on bond0 with own address as source address Linux Solution Mint Debian Redhat CentOS bridge bridging
  • Debian Mint Ubuntu Howto Disable Network Manager
  • AMD GPU Xorg Won't Start [3576284.324] (EE) Segmentation fault at address 0x0 [3576284.325] (EE) Fatal server error: [3576284.325] (EE) Caught signal 11 (Segmentation fault). Server aborting
  • symbol 'grub_calloc' not found grub boot error solution / fix
  • /var/log/journal huge/too large solution in Debian Mint Ubuntu Linux Howot Fix
  • Libreoffice Calc Opens CSV Spreadsheet File as Asian Language/Chinese Characters Solution Fix
  • RTL8821AU Setup Configure Wifi Realtek 8821 in Linux Debian Mint Ubuntu Howto
  • How To Tell Which Repository a Package Comes From Debian Mint Ubuntu
  • How To Reload All Kernel Modules And List Required Moduels for Each Device - Linux Mint Debian Ubuntu Troubleshooting
  • Debian Ubuntu Mint How To Change Default Display Manager
  • Ubuntu Mint Debian Howto Execute Command / Script / Program Upon Wakeup From Sleep