Yesterday Apache failed. The sys. adm. at the data center said that user 'username' was erroring the config. He took out the entry in the httpd.conf and Apache were up again.

I checked to see if there were any user (human being) with that 'username' but there weren't. I then asked if it were a human being or a software process that did this change to httpd.conf but he didn't know.

So now I'm asking here. Does anyone know how this change to httpd.conf might have happened? The entry looked the same as all the other entries. All he did was to comment it out.

I'm a bit worried if a person I don't know have gained access to the server. Hoping for some input.

Thanks
John

cPanel/WHM box? We've encountered it a couple of times because the account removal process did not remove all the parked or pointed domains on a removed account. Not an issue with someone gaining unauthorized access to the server in the cases we've seen.

Yes, it is a CPanel/WHM box. Thanks Annette - so it were not a human being :).

John

Can you tell me how to find out if there are parked or pointed domains left for a removed account? - I can't see anything in WHM except the parked domains for currently active accounts.

John

Unfortunately, that's the problem behind this issue: sometimes, the parked or pointed domains simply don't show in WHM. In addition, since the DNSx= notation is kept in /var/cpanel/users/username and username is deleted when the main account is deleted, you can see the problem with trying to find the user this way. The best way to verify if your problem was related to this is to examine the commented portion of the httpd.conf to see if it is related to an account that was removed. This is one of those live and learn type things - an attempted restart of apache from the command line would have generated the unknown user for you, which could then be quickly removed or commented out and the restart done again.

Thanks Annette.

John