Many email messages are sent from PHP scripts on Plesk server. How to find domains on which these scripts are running if Qmail is used?

Question

Many email messages are being sent from PHP scripts on Plesk server. How to find domains on which these scripts are running if Qmail is used?

Answer

Warning: If you do not have SSH access contact your service provider or server administrator.

Note: This article is applicable to the Qmail mail server only.
If the Postfix mail server is used, see Many email messages are sent from PHP scripts on the server. How can I find the domains on which these scripts are running if I am using Postfix?

There is a way to determine from which directory the PHP script sending mail is run.

Note: Depending on the operating system and Plesk version, the paths may differ from those listed above.

1. Create a /var/qmail/bin/sendmail-wrapper script:

   # touch /var/qmail/bin/sendmail-wrapper
   vi /var/qmail/bin/sendmail-wrapper

2. Insert the following data to the file:

   # cat <<EOT >> /var/qmail/bin/sendmail-wrapper
   #!/bin/sh
   (echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|/var/qmail/bin/sendmail-qmail “[email protected]”^C
   EOT

3. Create a log file called /var/tmp/mail.send and grant it the “a+rw” rights. Make the wrapper executable, rename the old sendmail, and link it to the new wrapper:

   # touch /var/tmp/mail.send
   chmod a+rw /var/tmp/mail.send
   chmod a+x /var/qmail/bin/sendmail-wrapper
   mv /var/qmail/bin/sendmail /var/qmail/bin/sendmail-qmail
   ln -s /var/qmail/bin/sendmail-wrapper /var/qmail/bin/sendmail

4. Wait for at least two hours, then change sendmail back:

   # rm -f /var/qmail/bin/sendmail
   mv /var/qmail/bin/sendmail-qmail /var/qmail/bin/sendmail

5. Examine the /var/tmp/mail.send file. There should be lines starting with “X-Additional-Header” pointing to the domain folders where the scripts which sent the mail are located.

   It is…