Question Firewall logs?

[lilbiscuit]

Server operating system version

CentOS 7

Plesk version and microupdate number

Version 18.0.52 Update #3

Is there a way to see when firewall rules were added/edited? My plesk install was hacked somehow and two new firewall rules were added for chinese ip address blocks.

I'd like to know:

1. is there a way to see when this happened (when the rules were added) via log files or other?
2. Is there a way this could happen without someone accessing the admin control panel via username and password?

 

[Peter Debik]

1. is there a way to see when this happened (when the rules were added) via log files or other?

I don't think there is.

2. Is there a way this could happen without someone accessing the admin control panel via username and password?

Yes, through iptables from the console. That can be executed by a script if the script has root privileges, too.