How to handle Nginx and PHP ownership of log files?

Question

I currently am running a Nginx reverse proxy in front of an Apache PHP server on Ubuntu. I have a file, log.txt, in the same directory that I serve PHP files out of for my site. PHP writes to this log file with API activity. I can access the log file from changing the url from lookup.php to log.txt when visiting in a web browser, which is completely insecure. I only want to access the log file when I'm SSHed in.

I changed the ownership of the log file to www-data, the group that PHP is currently running on. What I wanted to have happened is for the PHP files to be able to write to this log file but not have users be able to navigate to the log file path in the web browser and have it be displayed. I think the problem is that since Nginx is also running as www-data, by changing the log file owner to www-data so PHP can write to it, Nginx now is able to read it.

Here are some of the ideas I was thinking but I'm not sure if they have major security flaws:

• Changing the log file to be write-only for the owner of the file, www-data. I was doing research and this seemed to be a rare approach.

• Making PHP and Nginx run as separate groups, giving the PHP one rwx access and giving nginx none.

• Creating a new directory outside the web root so there isn't a web URL associated with the file, but having the directory be owned by www-data (so both PHP and Nginx). I wasn't sure if this has vulnerabilities.

• Forbidding the log file access through Nginx. This feels a bit "hacky" to me.

Which would be a proper route to take?

Answer 1

I tend to run nginx for my web servers and proxies, so please forgive the Apache ignorance, but I typically don't use file permissions for this. Instead, I prefer to tell my web server not to serve certain files. Here is a method for doing this from server fault.

Creating a separate directory for logging is fine as well, and the directory can simply be forbidden by Apache if it still sits in a location that a URL can access it. Or, the /var/log/ location can be used, but this is typically reserved for services running on the operating system.

It shouldn't feel hacky to use the web server to deny access as this functionality is partially there for sensitive files. Also, the root directory of a web server assumes that all files underneath are meant for the web unless explicitly denied (as described above). This is the route that I take with my web servers when necessary.