The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Hacking threat - and my idea for solution:

Discussion in 'Security' started by tazosmr, Jun 24, 2015.

  1. tazosmr

    tazosmr Registered

    Joined:
    Jan 24, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    if technical support noticed one security issue:

    when someone enters ftp, then the LOG file records all activity on ftp (IP ADDRESSES who have logged and etc..)

    but there is possible to open/modify the log file itself (i.e. remove some part from it).
    so,if a hacker can enters ftp, he can modify/delete his backtrace logs from LOG file.

    so, it is a good idea:
    there could be only one action allowed (from cpanel) - to DELETE the LOG file fully and start from BLANK completely, and no option to "modify" it partially(and nothing can be modified from FTP, nor from "FILE MANAGER"). so, a client will choose to continue life with current LOG file - or re-create and start from blank LOG file.

    that is good, because hacker cant hide himself.. he will have 2 ways: first- delete the LOG file (then i can easily notice that someone deleted file) or not to touch LOG file (then i will eventually see him in LOG file).
     
  2. ModServ

    ModServ Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    332
    Likes Received:
    5
    Trophy Points:
    18
    Location:
    Egypt
    cPanel Access Level:
    Root Administrator
    You mean that when some account owner login into FTP, he/she can remove backtrace logs from /var/log/messages?
     
  3. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    942
    Likes Received:
    57
    Trophy Points:
    28
    cPanel Access Level:
    DataCenter Provider
    OP is probably referring to the logs in /home/user/access-logs and/or /home/user/logs that are owned by the account itself. Technically users could manipulate these, however, like you mentioned /var/log/messages exists and an unprivileged user (i.e. not root) cannot modify that file.
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Yes, as mentioned, the /var/log/messages log file records FTP activity. You can check this log file as "root" if you want to verify if any activity differs from the FTP access logs stored within the account.

    Thank you.
     

Share This Page