Forcing better logging of mail requests in PHP

Question

I provide virtual hosting for a number of websites (mainly wordpress) maintained by others. Unfortunately one of them gets compromised and used to send spam (typically from a PHP script) from time-to-time.

I would like to be able to associate sites to emails sent so I can monitor mail volumes. This can be via an injected header or a log file or something similar.

PHP has an option "mail.add_x_header" which allows it to inject the name of the script being run to generate an email, but this appears to be an on/off option only, and only includes the relative path and filename being called.

Is there any way to extend PHP's functionality in a similar vain to include in the email header the name of the virtualhost or full path to the calling script, or otherwise provide some kind of log I can use to better control email sent through the server without having to make changes at the application level ?

Answer 1

Yes you can.

First: Set "auto_prepend_file" value in php.ini. For example auto_prepend_file=/usr/include/myownmailfunctions.php Don't forget to this file must be readable but don't writable.

Second: in this file you must change mail() function's name (runkit_function_rename) for this you must enable runkit extension. For example

//change mail func name to mail_original
runkit_function_rename("mail", "mail_original");
//define our mail function and users will use this after this time.
function mail() {
    //log here
    file_put_contents("/var/log/mail.log", json_encode(func_get_args()));
    // now call original mail function with parameters
    call_user_func("mail_original", func_get_args());
}

This is first way in my mind. Of course this isn't unbreakable solution but at least you can find spammers until people understand this trick.