Formmail script - how to fix.

watch for spamming

[txbakers]

We all know that matt's popular Formmail perl script is very vulnerable to spam attacks.

I found a site that gives a detailed instruction on how to fix it.

mailvalley.com/formmail/

[tedster]

Thanks for the tip. With spammers getting wilder and more desparate by the week (or so it seems to me) this kind of precaution is wise.

[john316]

Another simple way to deal with it is just change the name of the script, it won't "fix" the code, but the likliehood of a spammer finding and using it is lessened.

[jatar_k]

another good idea is to have someone write you a new one. :)

I haven't looked through the formmail script actually, I have just heard all of these problems. I guess I should really take a look.

[austtr]

Just make sure you use the latest version. 1.9 I think.

I had a customer who got hit by an email spammer and just updating the ver fixed the problem.

[keyplyr]

My FormMail script resides one directory level above my root level pages making it unavailable for any hacker that may get by other defences at my domain.

[Purple Martin]

keyplyr, this is probably a stupid question, but how do you put it one level above root?

[keyplyr]

Purple_Martin - well, actually I can't take credit for this ingenuity, my host keeps a security updated, generic copy installed there. I had a customized copy in a cgi-bin at my domain level but it was continuiously abused by spammers. My host eventually offered a shared script at the server tier level, which solved the problem.

[Birdman]

How do you know when your script has been abused? Are they using it to send mass emails?

[txbakers]

Exactly. If you look a the sendmail logs, you'll see who the emails were sent (or not sent) to. My log shows the attempt, but also shows the error message the sender received.