0

I've created a link like this:

/var/log/httpd/access_log -> /var/www/html/mylog.txt

with the command:

ln -s /var/log/httpd/access_log /var/www/html/mylog.txt

I have made sure that the following files/directories can be read (0666):

/var/
/var/log/
/var/log/httpd/
/var/log/httpd/access_log
/var/www
/var/www/html
/var/www/html/mylog.txt

But even so, when I try to access mylog.txt I get a 403:

Forbidden

You don't have permission to access /mylog.txt on this server.

I've tried other methods like:

readfile("/var/log/httpd/access_log");
echo file_get_contents("/var/log/httpd/access_log");

However, within PHP, they both return false.

I'm sure I got all the permissions right though. What am I doing wrong?

1 Answer 1

1

By default, www-data is a user, same as anyone who isn't root. As you probably know, only root can read the httpd access logs, meaning that www-data will get access denied. You could either use a cronjob to copy the log to /var/www/html or (not recommended) run httpd as root.

9
  • I don't feel comfortable running httpd as root, so I guess the next best option would be to chown the logs to www-data. Still not the best option in my opinion but it'll have to do.
    – Dave Chen
    Jul 12, 2015 at 3:47
  • @DaveChen as I said, the best option is to have a cronjob periodically copy the logs to /var/www/html
    – td512
    Jul 12, 2015 at 3:48
  • @DaveChen NEVER chown logs to www-data as that poses a security risk, as www-data should never be able to open those protected logs
    – td512
    Jul 12, 2015 at 3:49
  • I think running httpd as root is more of a security risk. Since, any PHP scripts (if exploited), could rm -rf / where as chown to some silly logs that are authentication only under PHP (readfile/file_get_contents).
    – Dave Chen
    Jul 12, 2015 at 3:53
  • If the logs are readonly, how is this different from apache accessing them, versus a cronjob copying them and then apache reading them? Aside from being more synchronized, and more efficient, I can't see a difference.
    – Dave Chen
    Jul 12, 2015 at 3:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .