Re: httpd(8) log files are world and daemon-readable

Sounds like you have a good reason to change from the defaults then.

-- 
  Sent from a phone, apologies for poor formatting.

On 27 August 2026 13:52:14 Piotr Durlej <[email protected]> wrote:

> On Thu, Aug 27, 2026 at 07:19:52PM +1000, jslee wrote:
>> On Thu, 27 Aug 2026, at 05:09, Piotr Durlej wrote:
>> > currently the httpd(8) log files are world and daemon-readable and
>> > probably they shouldn't.
>>
>> What specific risk are you trying to mitigate here?
>>
>> If it’s “there might be sensitive stuff in request URLs”, I suggest to you 
>> that you are focusing on the wrong problem here. Such things do not belong 
>> in URLs.
>>
>> If it’s not that, perhaps you could explain your reasons?
>>
>> John
>>
>
> On multi-user systems, world-readable HTTP logs expose IPs, request URIs 
> and timestamps to all local users. In the EU these are usually considered 
> personal data under GDPR, and the current defaults do not seem to follow 
> the privacy by default principle. From a secure by default and least 
> privilege perspective, it seems safer to restrict access by default and let 
> administrators explicitly grant access to users or tools that need it.
>
> HTTP logs may also contain unsolicited or abusive content originating from 
> external clients. This is not just a theoretical concern. On one of my web 
> servers, I am currently dealing with hostile and intimidating messages 
> being repeatedly inserted into access.log via external requests, and 
> world-readable permissions make such content visible to all local users.
>
> Kind regards,
> Piotr Durlej