Web Site Activity Not Logged

...but bandwidth proves it happened

[Storyman]

Recently, a web site in transition saw a sharp increase in bandwidth usage. The usage traces back to a folder with 777 permission--so it appears. At least the web hosting company came to the same conclusion that somehow the folder was used to send spam.

AWSTATS' logs do not show activity for that folder.

My question is if it is possible for a spammer to use the folder with 777 permission and not be logged?

I'd like users to be able to upload images, which requires 777 permission on a folder. Is there another way to do this without leaving the folder open to spammers?

[larryn]

Storyman,

Did you check the raw logs? AWSTATS might hide certain activity. Also if you want to protect the directory, how will you discern 'real' uploads from spam? Did you consider FTP - its a bit more difficult, but might be OK in your case. You also might want to consider passwords, or having an approval process so that uploaded files are not available right away. Most spammers don't want to deal with a any delay, so that might give you what you need.

Larry

[Storyman]

Larry,

Good ideas. Unfortunately, the raw logs are downloaded into the log folder at the end of the month, so I'll have to wait until next week.

I was wondering if it is a good idea to place the temp_upload folder in the root so it is at the same level as public_html. Would that add to security?

[geotopolis]

Temp upload directory should exist outside of DOCUMENT_ROOT directory. So they can't be accessed through a URL.

/tmp will often work

-Matt