0

I am storing my logs in a 'log' folder above my web directory

My directory structure looks like this:

 web/  (document root)
 log/  (log files go in here)

I have made the following change to my Apache configuration, to ensure that NONE of the files in that folder is world readable:

  <Directory  absolute_path_to/log>
    Order allow,deny
    Deny from all
    Satisfy All
  </Directory>

[Edit]

I am using the symfony framework, and a .htacess file is placed in the web folder.

The .htacess file contains the follwing section:

##Protect your site<92>s PHP error log via htaccess
# prevent access to php error log
<Files ../log/php_errors.log>
  Order allow,deny
  Deny from all
  Satisfy All
</Files>

I have modified that and changed it to limit access to the entire log folder, instead of a specific file (since I am storing other logs there).

I have been informed (Iganacio), that the server automagically blocks access to folders outside the document root. In anycase, if it dosen't hurt to do this, I'll rather still include the section in my virtual host config, just to be on the safe side.

Is that the correct way to do it, so that the log folder is completely forbidden?

2 Answers 2

1

Two things:

  1. Paths in <Directory> should be absolute.
  2. Navigating to a directory above the document root is handled by the web server and is disallowed in general.
1
  • thanks for the info. I have corrected my paths to absolute paths now. Please see my edited question
    – morpheous
    Jul 20, 2010 at 10:35
2

The easiest way is to put this in the .htaccess in the log/ directory:

deny from all

Since you want the whole directory protected, you don't need the <Files ...> directive, just the deny line that blocks everything coming into that directory. However, Ignacio is correct to say that you shouldn't need this at all because the log/ directory is outside of what Apache is serving.

Not the answer you're looking for? Browse other questions tagged .