Skip to content

ispconfig (rotated) logfiles world readable

Summary

ispconfig (rotated) logfiles world readable (there are sensitive infos in this files like mysql root password if debug is enabled) With mod_python/mod_php or exec() this files would maybe be readable from (hacked) websites

Steps to reproduce

ls -l /var/log/ispconfig/

-rw-------  1 root      root       833384 May 22 09:27 ispconfig.log
-rw-r--r--  1 root      root        37399 Apr 25 00:05 ispconfig.log.1.gz
-rw-r--r--  1 root      root        37325 Apr 24 00:05 ispconfig.log.2.gz
-rw-r--r--  1 root      root        37413 Apr 23 00:05 ispconfig.log.3.gz
-rw-r--r--  1 root      root        37318 Apr 22 00:05 ispconfig.log.4.gz

Correct behaviour

gz files should be 600 too

Environment

Ubuntu Noble - ispconfig 3.3

Proposed fix

This workaround should work i think (ispconfig interface writes into auth.log so ispconfig group needs write permission)

chmod 710 /var/log/ispconfig/ 
chown root:ispconfig /var/log/ispconfig/ 

Better solution maybe to do a chmod 600 in the php logrotate code or maybe move the logrotate from php code to an /etc/logrotate.d/ script.

Edited by Hannes