Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Apache, CentOS 5.5, cPanel.

I want to block the error_log files from being accessed from the web, as it shows errors that might give away data that I don't want given away.

How can I do this?

share|improve this question

closed as off-topic by Jenny D, Ladadadada, Scott Pack, Iain, Michael Hampton Jun 28 '13 at 20:09

  • This question does not appear to be about professional server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

4  
This question appears to be off-topic because it concerns the use of shared web hosting by end users or resellers, rather than the administration of web hosting. –  Jenny D Jun 28 '13 at 9:22

1 Answer 1

up vote 1 down vote accepted

The answer to this is your server error_log file is not stored in the same directory tree as your webserver content files. For example, your webserver typically serves files from somewhere like /var/www, while it writes logfiles in /var/log/httpd. The configuration of the webserver is such that it could never access the logfiles and make them available on the web.

EDIT: responding to comment that logs may be accessible for the webserver to send to clients. In reviewing httpd.conf, this is certainly technically possible. If your DocumentRoot and ServerRoot point to the same filesystem tree, I suppose that you could end up being able to serve error_log to clients. Also if you use an absolute path for ErrorLog you could place it in under your DocumentRoot and again make it accessible to clients.

In either of those cases, you could then protect your error_log with a .htaccess file in the same directory, with contents like this:

<files error_log>
   order allow,deny
   deny from all
</files>

then any client that requested that file woud be denied.

share|improve this answer
1  
The configuration of the web server should be such, but it is not necessarily. It may be that in the questioner's hosted configuration, the logs are in fact web-accessible. –  mattdm Jan 16 '11 at 21:27
    
mattdm see my edit, hopefully that addresses your concern. –  Phil Hollenback Jan 16 '11 at 22:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.