Our hosting provider has been quite reputable with their up time, so I began to suspect that it could be the fault from my side. In this article, I will outline how I went through the process of performing simple fault-finding in the server and how I remedied the problem.  It is assumed that your server runs in Linux and you have SSH (Secure Shell) access. And Yes, I am assuming you are a Linux NEWBIE!

The first thing I did after login was to issue a 'ps' command. The command checks for all the processes running under my account.

linux ps command

After looking at the report, I noticed there were alot of sendmail and php processes running. It could be a php mailing script that was running continuously for some reason. I needed more information. So I issued the next command 'ps x'. This command let you view more detail of the processes.

view server processes running under your account

It seemed that the file contact_us.php was spawning alot of sendmail request. Someone or a robot must be spam submitting the contact_us.php form. I had a look at the source code of the file and discovered that unlike other forms, contact_us.php does not have the CAPTCHA check. That must be the loophole. I then removed the mailing script altogether from the file. The next thing to do is to kill all the sendmail processes by using the 'kill [processID]' command.

Who could have done that? Apache has an access_log that tracks anyone who visited the site at any instant and it is usually located in the '/var/log/httpd/' folder in a Linux machine. Fortunately for me, The person or robot was still spamming the site when I was investigating the problem. Theoretically, I could catch that person red handed. In the /var/log/httpd folder, I issued the command 'tail -f access_log'

view apache access_log with tail


From the display, it seemed that the naughty guy is 85.249.233.5. I then tracked the IP address to be someone located in Russia, Saint Petersburg City. After a while, I noticed more IP addresses from different parts of the world accessing the file. So, the spammer must be using a distributed network of computers. What could we do? Report to authorities? Maybe yes and maybe no.

Personally, I feel that the best cure is to have a robust server with secure scripts. Spammers are bound to be around and IP addresses can be faked easily today. Techniques like this is not new, we have already witness such techniques being used in forums and blogs, phpbb and wordpress especially. Alot of spammers are using dynamic IP addresses which disappears quickly and makes it very hard for us  to track.

So, security comes first when you are developing web applications. The next time you write the script, remember to check for loopholes, ie the possibility of someone spam submitting it. Hopefully, this short article can provide a small insight into spam form submissions and some basic server debugging techniques for Linux newbies.

About The Author
Bernard Peh is a Melbourne PHP Developer. He specialises in linux administration and web programming