Tomcat sendmail abuse

[to...@capstonecareers.org]

I have Tomcat 4.1.12 and Apache/2.0.43 mod_webapp/1.2.0-dev running on a 
Solaris 8 box.  This machine also runs sendmail on port 25 for some apps 
to send email. Sendmail only relays to localhost. Currently I have 50 
different users running applications on this machine.  Last week I began 
to notice that the mailq had several thousand SPAM emails that were sent 
by tomcat@localhost which is the user that Tomcat runs under.  So my guess 
is that somebody is sending spam using a tomcat web application and I can 
NOT find a way to figure out who this person is.  Can somebody help me?  
Is there a way to prevent web applications from sending mail.  I have some 
that need to send mail but I dont want the others to send mail.  Is there 
a way to log activity to find out what file is the culprit?
Any help would be greatly appreciated.

Thanks in advance.

Tom


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org

Re: Tomcat sendmail abuse

[Tim Funk <fu...@joedog.org>]

Access logs will help you track who is sending the spam if the spammer is 
using a webapplication. Since several thousand messages were sent, you have a 
starting point of heuristics to look for in your access logs. If you can get 
2 histograms on client IP address and requested URL, this might easily point 
out a culprit.

Most important: Never ever ever make (or allow) a generic mail servlet which 
accepts a from, to, subject, and message body as imcoming parameters. This is 
crying for you to be a spammer. At a minimum, never allow the TO field to be 
a dynamic field, make it programmtically chosen by logic on the server. That 
way only YOU or (your customer base) get spammed.

Also lock down sendmail. Its sounds like you have done that by only allowing 
it to listen on localhost.

-Tim

tom@capstonecareers.org wrote:
> I have Tomcat 4.1.12 and Apache/2.0.43 mod_webapp/1.2.0-dev running on a 
> Solaris 8 box.  This machine also runs sendmail on port 25 for some apps 
> to send email. Sendmail only relays to localhost. Currently I have 50 
> different users running applications on this machine.  Last week I began 
> to notice that the mailq had several thousand SPAM emails that were sent 
> by tomcat@localhost which is the user that Tomcat runs under.  So my guess 
> is that somebody is sending spam using a tomcat web application and I can 
> NOT find a way to figure out who this person is.  Can somebody help me?  
> Is there a way to prevent web applications from sending mail.  I have some 
> that need to send mail but I dont want the others to send mail.  Is there 
> a way to log activity to find out what file is the culprit?
> Any help would be greatly appreciated.
> 
> Thanks in advance.
> 
> Tom 


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org