Does the public_html/error_log file pose any security issues?

wert

• May 12, 2016 06:55

I've been monitoring website for file changes and frequently, i've seen public_html/error_log file changing. I have found out that it's the web server that generates it. Since it's in public web space, is it security risk to be there? I read somewhere that file inclusion impact varying based on the exploitation and the read permission of the web server user, can make an attacker to harvest useful information from log files. According to my observation, majority of log files unrelated to the website such as it's CMS, are commonly found in other directories out of the public_html directory, and I imagine there is much more security in non public web space directories and files since accessing those areas is impossible even in a web browser right? Thanks in advance for your help.

• 

  ElviCities

  • May 12, 2016 12:15

  With a standard installation, you shouldn't be generating any error_log in your public_html directory. Something else must have been installed, such as a CMS, that is generating application specific error logs. Otherwise your logs should be in either /var/logs or /usr/local/apache/logs

  0
• 

  quizknows

  • May 16, 2016 19:12

  PHP itself will frequently make error_log files in whatever directory the script is in. That said, a standard httpd.conf on a cPanel system should already contain this entry to block public disclosure of those files. You should not need to add this yourself.
  Order allow,deny Deny from all Satisfy All
  As long as you get denied by Apache when trying to load site.com/error_log then you are OK. If someone malicious has already gained enough access to read the error_log file through another means, the error_log files are the least of your worries.

  0
• 

  Richardbt71

  • May 17, 2016 03:17

  The error_log located there, and sub-directory, is where PHP logs errors. Just because it is in public directory, does not mean everyone can access it. Try it. When I do it, I get an 403,

  0
• 

  cPanelMichael

  • May 27, 2016 19:59

  Hello, Yes, as mentioned, there's an entry in the Apache configuration file by default to block requests to that file name:
  Order allow,deny Deny from all Satisfy All
  Thank you.

  0

Please sign in to leave a comment.