Re: httpd(8) log files are world and daemon-readable

On Thu, Aug 27, 2026 at 08:33:29PM -0400, Brian Brombacher wrote:
> If you have multiple unprivileged, and more importantly, UNTRUSTED users logging into your production EU web server handling GDPR-eligible traffic, you have a lot more to worry about than a permission bit on a log file.
> 
> What stops your malicious local users from running netstat -an in a tight loop and recording every connection timestamp and IP address?  There goes your “GDPR Compliance” out the window.
> 
> Your threat model is fundamentally flawed.  Don’t mix candied apples with anchovies and expect something edible.
> 
> -Brian

First, the hostile messages I mentioned come from external clients, not local users.

Second, your netstat example will only reveal IP addresses and port numbers, not the actual HTTP requests. On a server behind a reverse proxy, netstat will only show the IP address of the proxy, not the external clients.

That is exactly why secure-by-default and least privilege matter: HTTP logs contain data and content originating from untrusted external sources. An IP address of a reverse proxy is usually not considered personal data.

Kind regards,
Piotr Durlej