You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Chris Arnold <ca...@electrichendrix.com> on 2010/05/12 02:11:53 UTC
[users@httpd] Apache Sending Email?
Not sure if this belongs in this mailing list or not but we keep seeing:
E716037FFD7B 602 Thu May 6 15:53:52 apache@dweb57.zenutech.com
(connect to kamelot-clan.com[174.120.120.151]: Connection
refused)
nywdqwzlw88@kamelot-clan.com
In our email log. Clearly spam email but why apache@dweb57.zenutech.com?
Apache/2.2.9 (Unix)
Any ideas?
Re: [users@httpd] Apache Sending Email?
Posted by Jason Nunnelley <ja...@jasonn.com>.
> I know. Have any ideas why the email address is apache@xxx.xxx?
Apache exploit? Just trying to understand.
It's Apache. I'm guessing your web server runs as "apache" so that's why
it's sending email as "apache." It doesn't mean Apache is compromised,
but it may mean you have a publicly writable directory that has a
script. The best thing for you to do is look at the email header and see
what script generated the email. It may tell you. osCommerce, Wordpress,
Drupal, etc. all have built in email scripts that sometimes get
hijacked. Or, someone can upload a file if you have a world writable
directory that also executes scripts.
You may want to configure all directories that are writeable so folks
can upload files as no-exec directories in your Apache config.
Jason A. Nunnelley
+1 2562971652
http://www.google.com/profiles/imjasonn
[Member Tekany, LLC]
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache Sending Email?
Posted by Chris Arnold <ca...@electrichendrix.com>.
Sent from my iPhone
On May 11, 2010, at 8:51 PM, Frank Gingras
<fr...@gmail.com> wrote:
>
>
> On 05/11/2010 08:11 PM, Chris Arnold wrote:
>> Not sure if this belongs in this mailing list or not but we keep
>> seeing:
>>
>> E716037FFD7B 602 Thu May 6 15:53:52 apache@dweb57.zenutech.com
>> (connect to kamelot-clan.com[174.120.120.151]: Connection refused)
>> nywdqwzlw88@kamelot-clan.com
>>
>> In our email log. Clearly spam email but why apache@dweb57.zenutech.com
>> ?
>> Apache/2.2.9 (Unix)
>> Any ideas?
>
> Chris,
>
> Apache httpd doesn't send emails. php does. Ask the php mailing list.
>
> Frank
I know. Have any ideas why the email address is apache@xxx.xxx? Apache
exploit? Just trying to understand.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache Sending Email?
Posted by Nick Kew <ni...@webthing.com>.
On 12 May 2010, at 01:51, Frank Gingras wrote:
>> In our email log. Clearly spam email but why apache@dweb57.zenutech.com?
>> Apache/2.2.9 (Unix)
>> Any ideas?
>
> Chris,
>
> Apache httpd doesn't send emails. php does. Ask the php mailing list.
Not quite. Neither Apache nor PHP sends email, but applications built
on them do.
The "apache" could be a username, or could be a complete red herring:
anything can call itself "apache" in an email envelope or address, and
email is trivial to forge.
--
Nick Kew
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache Sending Email?
Posted by Frank Gingras <fr...@gmail.com>.
On 05/11/2010 08:11 PM, Chris Arnold wrote:
> Not sure if this belongs in this mailing list or not but we keep seeing:
>
> E716037FFD7B 602 Thu May 6 15:53:52 apache@dweb57.zenutech.com
> (connect to kamelot-clan.com[174.120.120.151]: Connection refused)
> nywdqwzlw88@kamelot-clan.com
>
> In our email log. Clearly spam email but why apache@dweb57.zenutech.com?
> Apache/2.2.9 (Unix)
> Any ideas?
Chris,
Apache httpd doesn't send emails. php does. Ask the php mailing list.
Frank
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org