I am storing my logs in a 'log' folder above my web directory
My directory structure looks like this:
web/ (document root)
log/ (log files go in here)
I have made the following change to my Apache configuration, to ensure that NONE of the files in that folder is world readable:
<Directory absolute_path_to/log>
Order allow,deny
Deny from all
Satisfy All
</Directory>
[Edit]
I am using the symfony framework, and a .htacess file is placed in the web folder.
The .htacess file contains the follwing section:
##Protect your site<92>s PHP error log via htaccess
# prevent access to php error log
<Files ../log/php_errors.log>
Order allow,deny
Deny from all
Satisfy All
</Files>
I have modified that and changed it to limit access to the entire log folder, instead of a specific file (since I am storing other logs there).
I have been informed (Iganacio), that the server automagically blocks access to folders outside the document root. In anycase, if it dosen't hurt to do this, I'll rather still include the section in my virtual host config, just to be on the safe side.
Is that the correct way to do it, so that the log folder is completely forbidden?