7

While Googling for a few rare user agent strings and URL paths, I stumbled upon a few websites that have their webserver logs publicly accessible.

Investigating further, I found that this is not an uncommon problem, as Googling for "inurl:log intext:Mozilla/5.0" will demonstrate.

My question is: what kind of misconfiguration may allow for logs to be publicly accessible? These logs are usually stored in a different directory, and I can't seem to find a reason why logs would be made accessible in this manner.

  • Why do you assume that it is by mistake? For a blackbox hosting service, this provides an easy mechanism for consumers to get access to the logs. – symcbean Dec 23 '15 at 9:43
  • This is true, but even then, most of the black box hosting providers I've seen have enforced some kind of authentication before allowing access to log files - even if it's just a HTTP basic auth dialog to access the folder. – Matthew Dec 23 '15 at 9:45
7

There are quite a few possibilities:

  • Someone has changed the log storage directory through a .htaccess or similar configuration file, and the new location is unintentionally within the web root (e.g. they put var/log/apache instead of /var/log/apache as the target)
  • The system has been set up like this with the intention of an IP block preventing access to the folder, and the IP block has been forgotten or disabled
  • An alias has been put in place, in a similar way to the /manual default alias in Apache HTTPd (see Google for many examples)
  • There is an automated log analysis program running which exposes the log data in some way, and no protection has been implemented for this

Essentially, people are endlessly creative when it comes to making mistakes, and log file access is no exception to that!

1

@Matthew already listed great points. I could think of one more, which I think is quite common:

Some applications but the logs inside their main directory or a subdirectory of it (probably because it's easiest; they know that that location exists and that they probably have read and write rights there) which is often supposed to be public.

They then restrict access to the logs and various other files via htaccess.

The problem here is that the server may ignore those htaccess files, either because it's not an Apache webserver, or because it's configured to not parse htaccess files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.