automatically deleted public_html ?

selectsplat

Registered
Jun 3, 2007
2
0
151
Greetings,

I'm new here, so I apologize if this is the wrong thread.

I'm a web developer for about 5 years, and professional database programmer for over 10. I've long used cpanel, and I know and understand most features.

Recently, I signed up with a new host, on a VPS package, and I moved about 12 addon domains into a single cpanel account. After I changed the nameservers on all my domains, and moved all my files over, tested all sites to make sure they were working in the new environment, I checked all of the domains to see if they had propogated yet. Some had, others had not, and I went to bed.

This morning I woke up, and my entire public_html directory has been deleted, including all addon domain subdirectories. I'm 100% positive that it wasn't me, and my host says it wasn't them, and I believe them.

Obviously, having your public_html deleted is a pretty major thing, especially after having moved 10 addon domains over, so I want to understand why it was deleted.

My host believes that it has something to do with an email script that might not have been as secure as it could have been. It did have captcha on it, but it did not have a delay in between emails. He thinks that it's possible the script was abused, and somehow the security of the server perhaps automatically kicked in and deleted the public_html file.

That almost sounds feasible, but I seriously doubt this was the case. If this were the case, I can't help but to think that this would have happened to more people, and I would have found someone complaining about it. I've search all throughout Google, and I can't find a single occurance of this ever happening to anyone before.

Someone else indicated that this might be an issue with the new cpanel 11, as thye had something very similar happen, but they weren't able to give an explaination that satisfied me.

Now, obviously I can restore from backup, but I'm insanely curious aobut why it happened in the first place, and I admit to being a little nervous about the possibility of my public_html file being delted at any time.


Any help anyone can provide would be greatly appreciated.
 

jayh38

Well-Known Member
Mar 3, 2006
1,212
0
166
Check your logs and creation dates. Check to see if logs contain information about the accounts created.

Check to see how long your server has been online. It is quite possible your account may have been recreated or the provider may have restored a backup hoping no one would notice.

Either way, dates, timestamps, log entries will reveal this mystery for you.

If your server uptime is only the hours between your work sessions, I would be very suspicious of the host.
 

selectsplat

Registered
Jun 3, 2007
2
0
151
I thought of that, however, all of the databases, and addon domains remain intact. If they had restored my account, wouldn't it have affected those as well?

Looking through the WHM account (bear with me as this is my first VPS) I don't see any logfiles other than raw logs, and I'm sure that wouldn't help. It doens't look like I'm provided with logs that keep track of changes to the account.
 

jayh38

Well-Known Member
Mar 3, 2006
1,212
0
166
The logs would be easily access vis ssh or sftp. Since you are not familiar with the shell environment, use sftp as this would give you access to the entire vps with a ftp client.

Client of choice currently is winscp.org

Your logs of interest are
/var/logs
/usr/local/apache/logs
/usr/local/apache/domlogs