Hacking threat - and my idea for solution:

tazosmr

Registered
Jan 24, 2013
2
0
1
cPanel Access Level
Website Owner
if technical support noticed one security issue:

when someone enters ftp, then the LOG file records all activity on ftp (IP ADDRESSES who have logged and etc..)

but there is possible to open/modify the log file itself (i.e. remove some part from it).
so,if a hacker can enters ftp, he can modify/delete his backtrace logs from LOG file.

so, it is a good idea:
there could be only one action allowed (from cpanel) - to DELETE the LOG file fully and start from BLANK completely, and no option to "modify" it partially(and nothing can be modified from FTP, nor from "FILE MANAGER"). so, a client will choose to continue life with current LOG file - or re-create and start from blank LOG file.

that is good, because hacker cant hide himself.. he will have 2 ways: first- delete the LOG file (then i can easily notice that someone deleted file) or not to touch LOG file (then i will eventually see him in LOG file).
 

quizknows

Well-Known Member
Oct 20, 2009
1,008
87
78
cPanel Access Level
DataCenter Provider
OP is probably referring to the logs in /home/user/access-logs and/or /home/user/logs that are owned by the account itself. Technically users could manipulate these, however, like you mentioned /var/log/messages exists and an unprivileged user (i.e. not root) cannot modify that file.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,226
463
Hello :)

Yes, as mentioned, the /var/log/messages log file records FTP activity. You can check this log file as "root" if you want to verify if any activity differs from the FTP access logs stored within the account.

Thank you.