How to log all PHP based E-mails for abuse

Step #1 - Create Wrapper Script

vi /usr/local/bin/phpsendmail

#!/usr/bin/php
<?php

//changed by realtechtalk.com to make the log readable
/**
  This script is a sendmail wrapper for php to log calls of the php mail() function.
  Author: Till Brehm, www.ispconfig.org
  (Hopefully) secured by David Goodwin <david @ _palepurple_.co.uk>
*/

$sendmail_bin = '/usr/sbin/sendmail';
$logfile = '/tmp/mail_php.log';

//* Get the email content
$logline = '';
$pointer = fopen('php://stdin', 'r');

while ($line = fgets($pointer)) {
        if(preg_match('/^to:/i', $line) || preg_match('/^from:/i', $line)) {
                $logline .= trim($line).' ';
        }
        $mail .= $line;
}

//* compose the sendmail command
$command = 'echo ' . escapeshellarg($mail) . ' | '.$sendmail_bin.' -t -i';
for ($i = 1; $i < $_SERVER['argc']; $i++) {
        $command .= escapeshellarg($_SERVER['argv'][$i]).' ';
}



//* Write the log
//file_put_contents($logfile, date('Y-m-d H:i:s') . ' ' . $_ENV['PWD'] . ' ' . $logline, FILE_APPEND);

//changed by realtechtalk.com to make the log readable
file_put_contents($logfile, date('Y-m-d H:i:s') . ' ' . $_ENV['PWD'] . ' ' . $logline . PHP_EOL, FILE_APPEND);
//* Execute the command
return shell_exec($command);
?>

Make it executable:

chmod +x /usr/local/bin/phpsendmail

Create Log File (on Centos the log does not get created or written to unless you do it manually)

touch /tmp/mail_php.log; chmod 777 /tmp/mail_php.log;chown apache.apache /tmp/mail_php.log

Step 2 - Backup & Modify php.ini

cp /etc/php.ini /etc/php.ini-bk

(Your php.ini may be in a different location depending on your OS/control panel).

Edit  /etc/php.ini

Find the part that starts with "sendmail" and make it like my example below:

sendmail_path = /usr/local/bin/phpsendmail

; For Win32 only.
;sendmail_from = me@example.com

; For Unix only.  You may supply arguments as well (default: "sendmail -t -i").
;sendmail_path = /usr/sbin/sendmail -t -i
sendmail_path = /usr/local/bin/phpsendmail

Restart httpd:

service httpd restart

After this you should find entries in /tmp/mail_php.log
 


Tags:

php, mails, abusestep, wrapper, vi, usr, bin, phpsendmail, realtechtalk, readable, sendmail, author, brehm, www, ispconfig, org, secured, goodwin, _palepurple_, uk, sendmail_bin, sbin, logfile, tmp, mail_php, email, content, logline, pointer, fopen, stdin, fgets, preg_match, trim, compose, echo, escapeshellarg, _server, argc, argv, file_put_contents, _env, pwd, file_append, php_eol, execute, shell_exec, executable, chmod, centos, manually, chown, apache, modify, ini, cp, etc, bk, depending, os, panel, edit, quot, sendmail_path, sendmail_from, unix, arguments, default, restart, httpd, entries,

Latest Articles

  • How To Stop DNSMasq from listening on all IPs/Interfaces and allow only localhost
  • du - VAS Billing Subscriptions Hack/Scam MLPremiumSub Invascom Astromart Issues Complaint
  • Docker Swarm vs Kubernetes Comparison Guide
  • When is it time to leave your VPS/VDS Cloud Hosting Provider?
  • 2024 Buyer's Guide: How to Choose and Buy the Best VPS/VDS for Your Needs - Tips and Strategies
  • Postfix / sendmail config for DKIM, SPF and DMARC Tutorial Guide E-mail Delivery for Hotmail.com Gmail.com and More HowTo
  • Install Grafana on Linux Debian Ubuntu Tutorial Guide
  • How To Completely Disable ufw in Linux Ubuntu Mint Debian
  • System has not been booted with systemd as init system (PID 1). Can't operate. Failed to talk to init daemon. Ubuntu Debian Linux Solution Cannot reboot
  • Mint Ubuntu Linux Gnome Showing Home Directory on Desktop instead of Desktop Directory
  • vi vim not doing code highlighting E319: Sorry, the command is not available in this version solution
  • Proxmox How To Rename Node Hostname Fix Solution
  • Linux how to get list of all timezones on system Ubuntu
  • Proxmox install issue cannot see the buttons or install wrong / bad resolution cannot see the entire screen problem solution
  • configure.ac:75: error: possibly undefined macro: AC_PROG_LIBTOOL If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. solution
  • Can't exec "aclocal": No such file or directory at /usr/share/autoconf/Autom4te/FileUtils.pm line 326. autoreconf: failed to run aclocal: No such file or directory solution
  • /bin/sh: autoreconf: command not found solution
  • glib-2.0 required to compile QEMU solution
  • How To Upgrade Debian 8,9,10 to Debian 12 Bookworm
  • Linux dhcp dhclient Mint Redhat Ubuntu Debian How To Use Local Domain DNS Server Instead of ISPs