I currently am running a Nginx reverse proxy in front of an Apache PHP server on Ubuntu. I have a file,
log.txt, in the same directory that I serve PHP files out of for my site. PHP writes to this log file with API activity. I can access the log file from changing the url from
log.txt when visiting in a web browser, which is completely insecure. I only want to access the log file when I'm SSHed in.
I changed the ownership of the log file to
www-data, the group that PHP is currently running on. What I wanted to have happened is for the PHP files to be able to write to this log file but not have users be able to navigate to the log file path in the web browser and have it be displayed. I think the problem is that since Nginx is also running as
www-data, by changing the log file owner to
www-data so PHP can write to it, Nginx now is able to read it.
Here are some of the ideas I was thinking but I'm not sure if they have major security flaws:
Changing the log file to be write-only for the owner of the file,
www-data. I was doing research and this seemed to be a rare approach.
Making PHP and Nginx run as separate groups, giving the PHP one rwx access and giving nginx none.
Creating a new directory outside the web root so there isn't a web URL associated with the file, but having the directory be owned by
www-data(so both PHP and Nginx). I wasn't sure if this has vulnerabilities.
Forbidding the log file access through Nginx. This feels a bit "hacky" to me.
Which would be a proper route to take?