Log File Directory LAMP

Question

I'm a developer working for a company and, for better or worse, their IT Dept. handles the server that my current web application exists on. It's a LAMP server and, right now, the access log file sits one folder outside the scope of the server directory, which is to say that I can't access it through scripts on the server.

I wrote a simple RegEx parser in JS but because the file is just outside of the server directory I have to go into the file and manually copy it's contents to another file on the server.

If my question is basic, I apologize, but I have never worked with configuring an Apache server and I don't have rights to test anything. Google searches haven't turned up what I was looking for.

My question: On a LAMP stack is it possible to move the access log file onto the server directly? If it is, is there a reason that I shouldn't request that this be done? Keep in mind the site only faces internally and I only need read permissions on the file.

Answer 1

I'm presuming your JS is executed in a browser-session, and not on the server itself. If that isn't the case, let me know.

Yes, it is possible to move logs under DocumentRoot. However, it is considered a pretty major security vulnerability to put the access-logs in that location. This is because it is very easy for attackers to place custom text in a location that is considered within the DOM, which in turn makes exploits a lot easier. Worse: one site's bad behavior can screw up the whole server.

Because of this, requests to put the access-logs in a location under DocumentRoot are viewed with deep suspicion; especially on shared servers. There are ways to make it safer, but on a shared system they're not likely to be done.

Getting access to the logs from the site can be done. Products like cpanel do so. I believe it is generally done through CGI, Passenger, or another server-side executable that has access to directories outside of DocumentRoot. These methods can be safer than direct access, as it restricts what javascript can get to.

Answer 2

Exposing log files within the document root creates a massive vulnerability on a LAMP server - without sophisticated controls it allows anyone to deploy and run code on the server.

As a developer you should know why this is, and have a better grasp of the terminology. That the logs sit outside the document root has nothing to do with whether you can access them using scripts on the server.

As a developer you should have a basic understanding of how your target systems work.

You should also be talking to the people who manage the system about how it is configured and how to solve your problem - there are many solutions, most of which do not completely undermine the security of the system