Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am storing my logs in a 'log' folder above my web directory

My directory structure looks like this:

 web/  (document root)
 log/  (log files go in here)

I have made the following change to my Apache configuration, to ensure that NONE of the files in that folder is world readable:

  <Directory  absolute_path_to/log>
    Order allow,deny
    Deny from all
    Satisfy All


I am using the symfony framework, and a .htacess file is placed in the web folder.

The .htacess file contains the follwing section:

##Protect your site<92>s PHP error log via htaccess
# prevent access to php error log
<Files ../log/php_errors.log>
  Order allow,deny
  Deny from all
  Satisfy All

I have modified that and changed it to limit access to the entire log folder, instead of a specific file (since I am storing other logs there).

I have been informed (Iganacio), that the server automagically blocks access to folders outside the document root. In anycase, if it dosen't hurt to do this, I'll rather still include the section in my virtual host config, just to be on the safe side.

Is that the correct way to do it, so that the log folder is completely forbidden?

share|improve this question

closed as off topic by random Feb 24 '11 at 5:40

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

Two things:

  1. Paths in <Directory> should be absolute.
  2. Navigating to a directory above the document root is handled by the web server and is disallowed in general.
share|improve this answer
thanks for the info. I have corrected my paths to absolute paths now. Please see my edited question – morpheous Jul 20 '10 at 10:35

The easiest way is to put this in the .htaccess in the log/ directory:

deny from all

Since you want the whole directory protected, you don't need the <Files ...> directive, just the deny line that blocks everything coming into that directory. However, Ignacio is correct to say that you shouldn't need this at all because the log/ directory is outside of what Apache is serving.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged .