Hacking threat - and my idea for solution:

[tazosmr]

if technical support noticed one security issue:

when someone enters ftp, then the LOG file records all activity on ftp (IP ADDRESSES who have logged and etc..)

but there is possible to open/modify the log file itself (i.e. remove some part from it).
so,if a hacker can enters ftp, he can modify/delete his backtrace logs from LOG file.

so, it is a good idea:
there could be only one action allowed (from cpanel) - to DELETE the LOG file fully and start from BLANK completely, and no option to "modify" it partially(and nothing can be modified from FTP, nor from "FILE MANAGER"). so, a client will choose to continue life with current LOG file - or re-create and start from blank LOG file.

that is good, because hacker cant hide himself.. he will have 2 ways: first- delete the LOG file (then i can easily notice that someone deleted file) or not to touch LOG file (then i will eventually see him in LOG file).

 

[ModServ]

You mean that when some account owner login into FTP, he/she can remove backtrace logs from /var/log/messages?

 

[quizknows]

OP is probably referring to the logs in /home/user/access-logs and/or /home/user/logs that are owned by the account itself. Technically users could manipulate these, however, like you mentioned /var/log/messages exists and an unprivileged user (i.e. not root) cannot modify that file.

 

[cPanelMichael]

Hello

Yes, as mentioned, the /var/log/messages log file records FTP activity. You can check this log file as "root" if you want to verify if any activity differs from the FTP access logs stored within the account.

Thank you.