Hacking threat - and my idea for solution:

tazosmr

• June 24, 2015 16:59

if technical support noticed one security issue: when someone enters ftp, then the LOG file records all activity on ftp (IP ADDRESSES who have logged and etc..) but there is possible to open/modify the log file itself (i.e. remove some part from it). so,if a hacker can enters ftp, he can modify/delete his backtrace logs from LOG file. so, it is a good idea: there could be only one action allowed (from cpanel) - to DELETE the LOG file fully and start from BLANK completely, and no option to "modify" it partially(and nothing can be modified from FTP, nor from "FILE MANAGER"). so, a client will choose to continue life with current LOG file - or re-create and start from blank LOG file. that is good, because hacker cant hide himself.. he will have 2 ways: first- delete the LOG file (then i can easily notice that someone deleted file) or not to touch LOG file (then i will eventually see him in LOG file).

• 

  ModServ

  • June 25, 2015 08:27

  You mean that when some account owner login into FTP, he/she can remove backtrace logs from /var/log/messages?

  0
• 

  quizknows

  • June 25, 2015 15:14

  OP is probably referring to the logs in /home/user/access-logs and/or /home/user/logs that are owned by the account itself. Technically users could manipulate these, however, like you mentioned /var/log/messages exists and an unprivileged user (i.e. not root) cannot modify that file.

  0
• 

  cPanelMichael

  • July 01, 2015 17:37

  Hello :) Yes, as mentioned, the /var/log/messages log file records FTP activity. You can check this log file as "root" if you want to verify if any activity differs from the FTP access logs stored within the account. Thank you.

  0

Please sign in to leave a comment.