HowTo fix: client denied by server configuration?

Question

looking in my Apache error logs I get a lot of these errors:

17:52:59    client denied by server configuration: /path/to/drupal/sites/default/files/civicrm/custom/delete-this-hLW0uQKV0o    error   
17:52:59    client denied by server configuration: /path/to/drupal/sites/default/files/civicrm/upload/delete-this-2oysK1uZ8L    error   
17:52:58    client denied by server configuration: /path/to/drupal/sites/default/files/civicrm/ConfigAndLog/CiviCRM.3de7c305138430bacabc11877313657f.log    error

The directory permissions for sites/default/files/civicrm and all its subdirectories are 775

drwxrwxr-x  45 web  www   140B 19 Mai 10:45 ..
drwxrwxr-x   2 web  www   369B 19 Mai 09:29 custom
drwxrwxr-x   2 web  www     4B 19 Mai 09:29 upload
drwxrwxr-x   2 web  www    10B  1 Mai 05:15 ConfigAndLog
drwxrwxr-x   3 web  www     4B  3 Dez 23:26 persist
drwxrwxr-x   4 web  www     4B  3 Dez 23:22 templates_c
drwxrwxr-x   7 web  www     7B  3 Dez 23:22 .

and are owned by the apache user

uid=1001(web) gid=1000(www) groups=1000(www)

so in principle even 755 should be enough.

I don't think it is related to any apache setting (using 2.4), since my folder with drupal inside is inside a directory which already has a Require all granted directive, and my other web projects (and drupal itself) do not throw such kind of errors.

Understanding this post right it is kind of "normal" that the "delete-this" files through an error? Even if, why this also happens for the log file? Looking into the folder ConfigAndLog I have observed that each month a new file is created. But each month I have to chmod the newly created file in order that the apache user can write into it.

How can I fix this?

Answer 1

See Access denied errors by server itself on uploaded files, which you refer to in your question. The answer there applies to the ConfigAndLog file too. Civi periodically runs tests to make sure that certain directories and files are not accessible via the web. These include:

• the current debug log file (ConfigAndLog.xxxxxxxxxxxxxxxxxxxxxxxx.log)
• the image upload directory (on your Drupal site, this is sites/default/files/civicrm/upload)
• the custom php directory (on your Drupal site, this is sites/default/files/civicrm/custom)

The "client denied by server configuration" entries in your error.log are an indication that those directories and files are protected as they should be.

As the author of the security-check function writes in a code comment:

Per CiviCRM default the logfile sits in a folder which is web-accessible, and is protected by a default .htaccess configuration. If server config causes the .htaccess not to function as intended, there may be information disclosure.

The debug log may be jam-packed with sensitive data, we don't want that.

In other words, it's good that the debug log is not accessible via the web.