Changes to .htaccess file concerns

[Elizabeta]

Hello,

I have a cPanel&WHM version 78.0.20 . I have noticed in home directory of one my user in command line file .htaccess which has changed but there is no logs /usr/local/cpanel/logs/access log that that user was not connected at this time.



Also on other user on cPanel I have noticed same date i time when .htaccess has changed.



Which causes the change of time .htaccess file?


I suspect that there was malicious intrusions... Please, could you a

 

[Elizabeta]

Hello,

I have noticed that when I update version of cPanel, then date and time of file .htaccess will be changed. Is that correct?

Br,
Elizabeta

 

[thowden]

Hi

The .htaccess file is edited by the scripts for controlling apache and php settings in EasyApache.

Depending on which scripts were run then yes, the file may have been edited by the update you installed.

I had run updates on my servers this morning, and from what see none of the .htaccess files were changed.

What is the content of the .htaccess file that you think might be compromised ?

 

[Elizabeta]

Hello,

The content of .htaccess file is normal, it seeems to be ok. I have noticed in backup before one month ago that that file was the same. Probably, everything is ok.


Thank you very much!

BR,
Elizabeta

 

[cPanelMichael]

Hello @Elizabeta,

You can browse through /var/log/yum.log to see if any EA4 RPMs were updated at the same time as the .htaccess file was modified.

Note the EA4 change log does show April 9th (the date of the file in your attached image) as the most recent update:

EasyApache 4 Change Log 2019 - EasyApache 4 - cPanel Documentation

Thank you.