Answers.Body: <p>See <a href="https://civicrm.stackexchange.com/questions/7756/access-denied-errors-by-server-itself-on-uploaded-files/8292?s=1%7C0.4142#8292" title="Access denied errors by server itself on uploaded files?">Access denied errors by server itself on uploaded files</a>, which you refer to in your question. The answer there applies to the ConfigAndLog file too. Civi periodically runs tests to make sure that certain directories and files are <strong>not</strong> accessible via the web. These include:</p>
  <ul>
  <li>the current debug log file (<code>ConfigAndLog.xxxxxxxxxxxxxxxxxxxxxxxx.log</code>)</li>
  <li>the image upload directory (on your Drupal site, this is <code>sites/default/files/civicrm/upload</code>)</li>
  <li>the custom php directory (on your Drupal site, this is <code>sites/default/files/civicrm/custom</code>)</li>
  </ul>
  <p>The &quot;client denied by server configuration&quot; entries in your error.log are an indication that those directories and files are protected as they should be.</p>
  <p>As the author of the security-check function writes in a code comment:</p>
  <blockquote>
  <p>Per CiviCRM default the logfile sits in a folder which is web-accessible, and is protected by a default .htaccess configuration. If server config causes the .htaccess not to function as intended, there may be information disclosure.</p>
  <p>The debug log may be jam-packed with sensitive data, we don't want that.</p>
  </blockquote>
  <p>In other words, it's good that the debug log is not accessible via the web.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-31T00:20:00.177Z
Answers.LastActivityDate: 2017-05-31T00:20:00.177Z
Answers.LastEditDate: 2020-06-17T09:00:50.810Z
Answers.UserDisplayName: Noah Miller
Body: <p>looking in my Apache error logs I get a lot of these errors:</p>
  
  <pre><code>17:52:59    client denied by server configuration: /path/to/drupal/sites/default/files/civicrm/custom/delete-this-hLW0uQKV0o    error   
  17:52:59    client denied by server configuration: /path/to/drupal/sites/default/files/civicrm/upload/delete-this-2oysK1uZ8L    error   
  17:52:58    client denied by server configuration: /path/to/drupal/sites/default/files/civicrm/ConfigAndLog/CiviCRM.3de7c305138430bacabc11877313657f.log    error
  </code></pre>
  
  <p>The directory permissions for sites/default/files/civicrm and all its subdirectories are 775</p>
  
  <pre><code>drwxrwxr-x  45 web  www   140B 19 Mai 10:45 ..
  drwxrwxr-x   2 web  www   369B 19 Mai 09:29 custom
  drwxrwxr-x   2 web  www     4B 19 Mai 09:29 upload
  drwxrwxr-x   2 web  www    10B  1 Mai 05:15 ConfigAndLog
  drwxrwxr-x   3 web  www     4B  3 Dez 23:26 persist
  drwxrwxr-x   4 web  www     4B  3 Dez 23:22 templates_c
  drwxrwxr-x   7 web  www     7B  3 Dez 23:22 .
  </code></pre>
  
  <p>and are owned by the apache user</p>
  
  <pre><code>uid=1001(web) gid=1000(www) groups=1000(www)
  </code></pre>
  
  <p>so in principle even 755 should be enough. </p>
  
  <p>I don't think it is related to any <a href="https://wiki.apache.org/httpd/ClientDeniedByServerConfiguration" rel="nofollow noreferrer">apache</a> setting (using 2.4), since my folder with drupal inside is inside a directory which already has a Require all granted directive, and my other web projects (and drupal itself) do not throw such kind of errors.</p>
  
  <p>Understanding <a href="https://civicrm.stackexchange.com/questions/7756/access-denied-errors-by-server-itself-on-uploaded-files">this</a> post right it is kind of "normal" that the "delete-this" files through an error?
  Even if, why this also happens for the log file? Looking into the folder ConfigAndLog I have observed that each month a new file is created. But each month I have to chmod the newly created file in order that the apache user can write into it. </p>
  
  <p>How can I fix this?</p>
  
Tags: <drupal><permissions><logs>
Title: HowTo fix: client denied by server configuration?
ThreadText: # HowTo fix: client denied by server configuration?
  
  (Asked by: username_0 on 2016-05-19)
  
  looking in my Apache error logs I get a lot of these errors:
  
  ```
  17:52:59    client denied by server configuration: /path/to/drupal/sites/default/files/civicrm/custom/delete-this-hLW0uQKV0o    error   
  17:52:59    client denied by server configuration: /path/to/drupal/sites/default/files/civicrm/upload/delete-this-2oysK1uZ8L    error   
  17:52:58    client denied by server configuration: /path/to/drupal/sites/default/files/civicrm/ConfigAndLog/CiviCRM.3de7c305138430bacabc11877313657f.log    error
  
  ```
  
  The directory permissions for sites/default/files/civicrm and all its subdirectories are 775
  
  ```
  drwxrwxr-x  45 web  www   140B 19 Mai 10:45 ..
  drwxrwxr-x   2 web  www   369B 19 Mai 09:29 custom
  drwxrwxr-x   2 web  www     4B 19 Mai 09:29 upload
  drwxrwxr-x   2 web  www    10B  1 Mai 05:15 ConfigAndLog
  drwxrwxr-x   3 web  www     4B  3 Dez 23:26 persist
  drwxrwxr-x   4 web  www     4B  3 Dez 23:22 templates_c
  drwxrwxr-x   7 web  www     7B  3 Dez 23:22 .
  
  ```
  
  and are owned by the apache user
  
  ```
  uid=1001(web) gid=1000(www) groups=1000(www)
  
  ```
  
  so in principle even 755 should be enough.
  
  I don't think it is related to any [apache](https://wiki.apache.org/httpd/ClientDeniedByServerConfiguration) setting (using 2.4), since my folder with drupal inside is inside a directory which already has a Require all granted directive, and my other web projects (and drupal itself) do not throw such kind of errors.
  
  Understanding [this](https://civicrm.stackexchange.com/questions/7756/access-denied-errors-by-server-itself-on-uploaded-files) post right it is kind of "normal" that the "delete-this" files through an error?
  Even if, why this also happens for the log file? Looking into the folder ConfigAndLog I have observed that each month a new file is created. But each month I have to chmod the newly created file in order that the apache user can write into it.
  
  How can I fix this?
  
  **Tags:** drupal, permissions, logs
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-05-31. Score: 2
  
  See [Access denied errors by server itself on uploaded files](https://civicrm.stackexchange.com/questions/7756/access-denied-errors-by-server-itself-on-uploaded-files/8292?s=1%7C0.4142#8292 "Access denied errors by server itself on uploaded files?"), which you refer to in your question. The answer there applies to the ConfigAndLog file too. Civi periodically runs tests to make sure that certain directories and files are **not** accessible via the web. These include:
  
  * the current debug log file (`ConfigAndLog.xxxxxxxxxxxxxxxxxxxxxxxx.log`)
  * the image upload directory (on your Drupal site, this is `sites/default/files/civicrm/upload`)
  * the custom php directory (on your Drupal site, this is `sites/default/files/civicrm/custom`)
  
  The "client denied by server configuration" entries in your error.log are an indication that those directories and files are protected as they should be.
  
  As the author of the security-check function writes in a code comment:
  
  > Per CiviCRM default the logfile sits in a folder which is web-accessible, and is protected by a default .htaccess configuration. If server config causes the .htaccess not to function as intended, there may be information disclosure.
  >
  > The debug log may be jam-packed with sensitive data, we don't want that.
  
  In other words, it's good that the debug log is not accessible via the web.
  
  
  ---
  
  