Re: httpd(8) log files are world and daemon-readable

On Thu, Aug 27, 2026 at 08:33:29PM -0400, Brian Brombacher wrote:
> What stops your malicious local users from running netstat -an in a
> tight loop and recording every connection timestamp and IP address?
> There goes your “GDPR Compliance” out the window.

On one shared system I force untrusted users into a different rdomain(4)
via SSH config, the intent isn't to hide netstat output but it is a side
effect. Obviously things like cron escape the SSH rdomain configuration,
so you then have to consider those cases and handle them somehow too.

> Your threat model is fundamentally flawed.  Don’t mix candied apples
> with anchovies and expect something edible.

Don't expect it to work out of the box but I wouldn't say fundamentally
flawed. Many things are configurable.