Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Hacking threat - and my idea for solution:

Discussion in 'Security' started by tazosmr, Jun 24, 2015.

  1. tazosmr

    tazosmr Registered

    Joined:
    Jan 24, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    if technical support noticed one security issue:

    when someone enters ftp, then the LOG file records all activity on ftp (IP ADDRESSES who have logged and etc..)

    but there is possible to open/modify the log file itself (i.e. remove some part from it).
    so,if a hacker can enters ftp, he can modify/delete his backtrace logs from LOG file.

    so, it is a good idea:
    there could be only one action allowed (from cpanel) - to DELETE the LOG file fully and start from BLANK completely, and no option to "modify" it partially(and nothing can be modified from FTP, nor from "FILE MANAGER"). so, a client will choose to continue life with current LOG file - or re-create and start from blank LOG file.

    that is good, because hacker cant hide himself.. he will have 2 ways: first- delete the LOG file (then i can easily notice that someone deleted file) or not to touch LOG file (then i will eventually see him in LOG file).
     
    #1 tazosmr, Jun 24, 2015
  2. ModServ

    ModServ Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    332
    Likes Received:
    5
    Trophy Points:
    168
    Location:
    Egypt
    cPanel Access Level:
    Root Administrator
    You mean that when some account owner login into FTP, he/she can remove backtrace logs from /var/log/messages?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 ModServ, Jun 25, 2015
  3. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    1,008
    Likes Received:
    86
    Trophy Points:
    78
    cPanel Access Level:
    DataCenter Provider
    OP is probably referring to the logs in /home/user/access-logs and/or /home/user/logs that are owned by the account itself. Technically users could manipulate these, however, like you mentioned /var/log/messages exists and an unprivileged user (i.e. not root) cannot modify that file.
     
    #3 quizknows, Jun 25, 2015
  4. cPanelMichael

    cPanelMichael Technical Support Community Manager Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    47,009
    Likes Received:
    2,123
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello :)

    Yes, as mentioned, the /var/log/messages log file records FTP activity. You can check this log file as "root" if you want to verify if any activity differs from the FTP access logs stored within the account.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 cPanelMichael, Jul 1, 2015
(You must log in or sign up to post here.)

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice