GDPR and Statistical Analytics
IP addresses are considered as Personal Identifiable Information (PII) under GDPR and therefore, although there may be a legitimate reason for recording IP addresses in raw server logs to maintain security, does that mean that IP addresses stored by AWStats, Analog Stats, and Webalizer for analytics need to be anonymised by eg changing the last segment to zeroes? Is IP anonymisation an available option in this software, and if not then does that mean this software needs to be disabled in Cpanel?
-
Hello @nickwuk We have a blog post that addresses some points of GDPR compliance and how it affects cPanel, some quotes from that article that should be noted are as follows: [QUOTE]Where can I get more information about GDPR and my compliance obligations? The GDPR itself is here. A number of companies provide consulting services that help with different aspects of your compliance process. While cPanel doesn"t recommend any particular approach to GDPR compliance, your lawyer or regulatory advisor may be able to point you to resources that are helpful.
[QUOTE]How does cPanel & WHM facilitate compliance with GDPR? cPanel & WHM is intentionally a highly configurable software product. Because every customer"s determination about what is required for it to become GDPR compliant is unique, there is not a particular way that our products create compliance with GDPR, or any other law or regulation. We are committed to working with our customers and partners to understand how their compliance activities are facilitated by our products, and ways our products can help them reach compliance.
With that being said there is not any built-in feature that allows for removal or modifications of IP addresses in the statistics but I would strongly advise you to open a feature request for this here:0 -
IP addresses are considered as Personal Identifiable Information (PII) under GDPR. Is IP anonymisation an available option in this software, and if not then does that mean this software needs to be disabled in Cpanel?
You have many logs, which contain the IP. GDPR is not demanding that do not record IP addresses. You need to document everything. That is the hard work. cPanel Update and you got a new logfile somewhere. So you might have an interest in keeping the amount of saved data as low as possible. That way exposure of data is minimized. cPanel could start offering some tools or help around removing logfiles and data. And to reduce the amount of data that gets saved. Reducing apache logging accountwise could be done via CustomLogs, which are piped through a script. E.g. scripts like this Anonip | Swiss Privacy Foundation IPs could be converted into hashes (quite common option in webanalytics to be able to follow people through webpages without storing IPs longer than needed). You can find such options in Wordpress analytics addons. GDPR gives people the right, to get an export of all their data saved with you. That is a bit tricky when you got everything cluttered around in many logs and databases. When GDPR is in action and the first court-rulings are done, we might see a consolidation in the reseller space. Or more software designed around handling data in compliance with GDPR.0 -
It looks like AWStats and the like simply read IP data from the raw access logs ie no dedicated storage log, and I would hope that IP's in raw access logs are exempt from anonymising on the grounds of security (GDPR Recital 49 - I'm waiting for a response from the ICO on this question about exemption), although the requirement to minimise the length of time PII data is stored would have an impact on statistical history (unless using anonymisation as lorio mentions). If IPs in raw access logs were to be exempt then the right of access and portability I assume would not apply, however is there then still a GDPR issue with sharing those IPs with third party statistical analysis software? It will be interesting to see the response from well known Wordpress security plugins. There is obviously other software that does store IP addresses for purely for statistical analysis which as I understand will need to anonymise those IPs. 0 -
Hi @nickwuk If you do get a response from the ICO on the question could you post it here? It may be useful for other members in the future. I also want to note if the issue is the length of storage time you can control the length of time you keep logs. Speaking specifically of the domlogs (domain access logs or raw access logs) you can modify the amount of time you keep them directly from WHM in Tweak Settings under Stats and Logs there are a few options: - Delete each domain"s access logs after statistics are gathered This setting will force the system to delete all access logs after each run. The Metrics data will be present but the actual log files will be removed - Archive logs in the user's home directory at the end of each stats run unless configured by the user. This option will only be used if the user does not configure their log archiving preferences in cPanel and will archive their logs in /home/$user/logs/ - Remove the previous month's archived logs from the user's home directory at the end of each month unless configured by the user. This option will only be used if the user does not configure their log archiving preferences in cPanel. cPanel also has some logs it rotates which can be modified as well such as ModSecurity,UPCP etc. You can also modify logrotate to modify any log files at specific intervals of your choosing 0 -
If IPs in raw access logs were to be exempt then the right of access and portability I assume would not apply
If you think about certain countries with data retention laws, you might are not allowed to delete data for a certain time-span. Every country can overrule parts of GDPR (mostly tax related) You're correct, that the Stattools offered via cPanel are accessing the logfiles. There is no other source. That makes is easier than using e.g. Google Analytics but IPs are stored. In e.g. Germany there are websites, which log 127.0.0.1 for every webaccess. This is stated in the data-protection information on these website. Some use thirdparty tools to tweak the storage behavior github.com/webfactory/mod_log_ipmask Many wordpress plugins with analytics or security functionality are offering tools to delete or change IP addresses in logfiles since years. Nothing new beside you now have a generic label "GDPR" to make it more easy to find such functions. Eg. Deleting and shorting IP: blog.nintechnet.com/ninjafirewall-general-data-protection-regulation-compliance/ E.g Hashing IP: wp-statistics.com/2017/05/26/settings-page/ The core of wordpress seems to get GDPR functionality as well.0 -
Hi, since I think it adds to this discussion, I add it here... I followed cP's instructions and in WHM set the logging times etc... but I still wonder about tools like ie. cpHUlk, or the csf firewall or the blacklist ... how long is that IP data stored? Even hackers have in the eyes of Brussels a right of privacy and to be "forgotten" And do these tools transmit any data from my server, ie. to check with spam blacklist What about SpamAssassin? Does it transfer personal (ie. IP) data off my server? Any tool I have not mentioned yet? Thx a million to you all Dan 0 -
Hi @Dan70 but I still wonder about tools like ie. cpHUlk, or the csf firewall or the blacklist ... how long is that IP data stored? Even hackers have in the eyes of Brussels a right of privacy and to be "forgotten"
As far as cPHulk is concerned the amount of time you store logged data on your server is completely up to you, the logs can be set to be rotated out on a timed basis. For CSF the logs for IP's blocked or seen via CSF are logged to /var/log/messages this would depend on your logrotate settings. For IP's in the blacklist, whitelist and ignore list they would remain there indefinitely unless removed as far as I understand it, you may want to check with CSF for more specifics on that though.And do these tools transmit any data from my server, ie. to check with spam blacklist What about SpamAssassin? Does it transfer personal (ie. IP) data off my server?
I know that the server does DNS lookups but they do not transfer actual data off the server. SpamAssassin does pass data through to DNSBL's to check if an IP is on a blacklist but that information isn't stored remotely.0 -
HI Lauren, thank you... the logrotation, is that the same I set in WHM (2 tabs with logging)? Thx a million Dan 0 -
excellent thank you...will look into this!! 0 -
HI, found the next thing I don't know.. in cPanel under Raw Logs, i find many old " Archived Raw Logs" am not aware I ever archived them...how can i (auto) remove all ? Thx Dan 0 -
Hi @Dan70 If you go to WHM>>Server Configuration>>Tweak Settings you can disable Raw Access log Archiving: [QUOTE]Archive logs in the user's home directory at the end of each stats run unless configured by the user.
[QUOTE]Remove the previous month's archived logs from the user's home directory at the end of each month unless configured by the user.
Both of these are on by default so you should only have one previous month's logs but if you don't want to archive any logs you can disable the first option.0 -
Hi, thx... will try...but I see logs from 2017... can I delete these somehow? Thx Dan 0 -
The only way to do this is to login via SSH or use the file manager to remove them manually 0 -
HI Lauren, thank you... can you hint me to which folder I will have to look for to delete them? Thx again Dan 0 -
Hi Dan, Sorry about that! They will be located at /home/$user/logs/ Thanks! 0 -
Sorry to dig up an older thread, but this comes up 2nd when googling and it's still open. I'm finding the answers here insufficient. Could a cpanel rep answer this: "Delete each domain"s access logs after statistics are gathered" - What's contained in them? Is this the "Raw Access" section in Cpanel for each domain? "Archive logs in the user's home directory at the end of each stats run unless configured by the user." - Where do we configure that? Not related to GDPR, but: "Include password in the raw log download link in cPanel (via FTP)." - Erm what, store the password? This can't be good for anyone's security? 0 -
Hello @naughtysquid Could a cpanel rep answer this: "Delete each domain"s access logs after statistics are gathered" - What's contained in them? Is this the "Raw Access" section in Cpanel for each domain?
cPanel access logs contain GET and POST requests for traffic to the site. They are the contents of "Raw Access Logs".Archive logs in the user's home directory at the end of each stats run unless configured by the user." - Where do we configure that?
In cPanel>>Metrics>>Raw Access there are two checkboxes at the top: [QUOTE]Archive logs in your home directory at the end of each stats run every 24 hours. Remove the previous month"s archived logs from your home directory at the end of each month.
Include password in the raw log download link in cPanel (via FTP)." - Erm what, store the password? This can't be good for anyone's security?
Actually, this appears to serve no useful purpose and we do have an open case to have it removed CPANEL-20514 - the actual logs it's referencing aren't present. It looks like the case is set to be resolved for v74 of cPanel but until then you can disregard the setting. Thanks!0 -
Okay thanks. In regards to AWSTATS, does it keep a record of users IP? Need to make sure our logs are cleaned of stuff like that, as I imagine once AWSTATS has done it's thing, it doesn't actually need the log files it uses? Can't find anything about dealing with the logs for that. 0 -
Hi @naughtysquid Awstats displays IP's in the UI - all awstats data is gathered from the domain logs (domlogs or access logs) 0 -
Oh hell, that's going to be a huge issue for GDPR. Is there a way to wipe the IP list for this and leave it around for the last 30 days or something? 0 -
HI @naughtysquid There are quite a few things you can do: -Customize the data that is logged in the access logs but modifying the CustomLog entry in the apache config (not directly through the apache config but through the VirtualHost template) - documentation on this can be found here: Custom Templates - EasyApache - cPanel Documentation -you can choose to disable stats - statistics configuration information can be found here: Statistics Software Configuration - Version 68 Documentation - cPanel Documentation -you can remove stat data after a specific amount of time from /home/$user/tmp/awstats (or one of the other statistic software programs) -There are also a number of configuration modifications you can make per account to the statistics conf in /home/$user/tmp/awstats Thanks! 0 -
hmm... I still saw that awstats is looging the IP in: "Hosts (Top 25)" So where does the get the Data from? I mean what does generate the Data? 0 -
Disclaimer: I am not a lawyer - please respect that these opinions are only my personal thoughts and observations on the subject. I think that there is some misconception surrounding the collection of IPs for statistical purposes, and the ruling of the GDPR The Court of Justice of the European Union has held that IP addresses are "personal data" in certain circumstances. The last three words are important. The GDPR states that the test for whether a person is "identifiable" depends upon "all the means reasonably likely to be used" to identify that person. If a visitor to your website also supplied any other personally identifiable details (eg Name, address, email etc) that could then be linked back to an IP collected as part of your visitor statistics, then there may be a case for defining the IP as a personal data. Unless you are also an ISP or have access to the customer databases of an ISP that can trace an IP back to a client at any point in time, it is unlikely that the IP of a visitor to your website who leaves no further data would be considered as personally identifiable. The GDPR will doubtless undergo many changes, refinements and clarification, as and when cases are ruled on by the CJEU and advice given by the associated working parties. All the latest news is available from 0
Please sign in to leave a comment.
Comments
24 comments