Concerns Over VPS Error and Access Logs

[Ticiba]

Hi all,

Well just had another issue with my VPS server that meant digging through the server error and access logs to track down the issue causing a 500 Internal Server Error (the issue is fixed now) but...
While going through the logs I've noticed entries dating back to Feb 2011 long before I received the VPS server.

Upon finding these dates listed I decided to go through the server looking over everything and found a SSL cert relating to a diifferent hostname (not a nocdirect one either).

This now has me very concerned over the security and integrity of the server itself, is it normal to have entries in the error log and access log dating back to before I received the server?
Some of the errors in the log are file does not exist ones while others are notices about SUexec and other errors + notices.

Any advice is very welcomed.

Tom

[JPC-Katrina]

Hi Tom,

Please open a ticket with our support desk about your concerns so they can look into this issue for you.

[Ticiba]

Thanks Katrina, have submitted ticket to the support desk.

Hopefully it's nothing I have to worry about but I just want to check it out since I don't remember seeing entries like that before with other VPS servers I had.

[Ron]

That's very odd!

Please let us know what you find out.

[Ticiba]

That's what I thought too Ron, if the logs I saw just had a single day/date in them I would of just thought it was part of the VPS/OS template that JaguarPC use, but some of the logs I've looked at have dates from February 2011 up until September then just stop until the day I received the server.

Got a ticket in the system, just waiting to hear back from support now, hopefully it's me just being over cautious.

[Ron]

Oh. At first from the way you said it I also thought it was just that date -- maybe their image had a few entries in the log, but continuing entries until just before you got it is very odd.

I guess it sounds like it was someone else's VPS and it was never reloaded/re-imaged/however they usually do it?

I think I'd be looking for a reload.

[Ticiba]

That's what I got to thinking Ron that I just got handed someone else's VPS but just woke up to be told by support that the logs I need to view are located in a different folder on my server so that puzzles me even more now.

Also had an email from CSF waiting for me too, alerting to someone logging in from an IP address out in India, kind of wondering whether to just cancel the VPS server now.

[Ron]

Support here is done from many countries around the globe including USA, Canada, India, Pakistan maybe more.

In my opinion for security and accountability all support should be handled via SSH tunnel into the US data center, then the tech could log into customer's accounts from their own private JPC IP.

[Ticiba]

In the past couple of weeks whenever one of the techs has needed to log in my account it never gives an IP, which I've seen with other hosting providers.
I agree with you though Ron that it should be handled via SSH tunneling so it shows a JPC IP and although I said I am kind of wondering about cancelling my VPS account I should of also that it was only for the time being since I am due to go away on holiday in less than 24hours and can't see getting this issue resolved before then now.

Sorry I missed that bit off last time and didn't want to double post.

[Ron]

I agree with you though Ron that it should be handled via SSH tunneling so it shows a JPC IP

Not just for the peace of mind, but also accountability; which tech logged into your server -- and anonymity for the tech themselves; homeland, location and/or ISP is disclosed when you look at your ticket, see which tech is working on your ticket and then see their (or their company's) IP address.

Also it is for security; this scheme would ENFORCE access through secure means, and prevent password and other sensitive data disclosure from occurring as data flows around the world through sometimes less-than-hospitable and even less-than-friendly territories.

[D9Dan]

Not just for the peace of mind, but also accountability; which tech logged into your server -- and anonymity for the tech themselves; homeland, location and/or ISP is disclosed when you look at your ticket, see which tech is working on your ticket and then see their (or their company's) IP address.

Also it is for security; this scheme would ENFORCE access through secure means, and prevent password and other sensitive data disclosure from occurring as data flows around the world through sometimes less-than-hospitable and even less-than-friendly territories.

I completely agree, we only manage around 50 servers but we use a central SSH gateway that logs all tech logins, as well as every keystroke they make:

https://www.ezeelogin.com/

It also means that clients only ever see the IP of the SSH gateway server, rather than the IP of the tech working on their ticket.

[Ron]

Yup, that's a similar approach that probably has pluses and minuses and deserves to be part of the discussion but though I've mentioned this in private and in public, I haven't received a single solitary comment back about it from JAG.

[Ron]

Q. E. D.

[Ticiba]

Thought I better update this topic since I am now back from holiday and also finally got a proper clear answer regarding the server logs and SSL certificate, they are actually part of the original OS template that JaguarPC uses.

I am very pleased that I didn't have to cancel my VPS server and that JaguarPC could just disabled all access to it, that has saved a lot of time with having to setup the server, especially since finding out that the software I use for my sites has gone through some major updates while I was away on holiday so have to deal with some errors that the updates are causing but they seem minor and easy to fix.

Overall I must say that even though I have been frustrated with the time it takes support to reply to tickets, the service is still excellent and when compared to my previous host is 1000 times better.

[JPC-Sabrina]

It is good to hear that you have your problems are under control Ticiba. We are pleased that you decided to stay with us and that overall you are happy with the services that we are providing to you. Sometimes an issue takes extra time to trouble shoot and then resolve. Our support manager is moving towards faster response times from our technical support services. We appreciate your vote of confidence when you compare us to your other hosting experiences. Thanks for updating the thread and we hope you will continue to share and comment here on our forums.