1019290 - Add instructions to remove query strings from Apache log

Status: RESOLVED FIXED

(Bugzilla :: Documentation, enhancement)

Description

[Simon Green]

With REST calls being part of Bugzilla 5.0, I think it is important to make a note in the installations guide (and release notes?) to configure Apache not to write the query string in its log files.

If this is not done, then login, passwords and tokens are all up for grabs with get calls

e.g. https://bugzilla.site/rest/bug/1000?Bugzilla_login=[e-mail]&Bugzilla_password=baz
http://bugzilla.site/rest/bug/1000?Bugzilla_token=213-XC5eghER

While some big sites (like bmo) have tight access to their log files, a lot of smaller companies will have many staff members to have access to the machine that hosts their Bugzilla installation, or even worse, are on shared hosting.

Comment 1

[Simon Green]

Sample instructions:
http://stackoverflow.com/questions/14144133/disable-query-strings-in-access-log

Comment 2

[Vishant Gautam]

Attachment: apache2.patch

Comment 3

[Simon Green]

Comment on attachment 8448849 [details] [diff] [review]
apache2.patch

The only change required it to the config file is to the ErrorLog lines. There is no need to add things like Include conf.d/ and sites-enabled/ (both which are usually done in the parent apache2.conf or httpd.conf file).

Admin note: When submitting a patch, please set the review flag and make one of the suggested reviewers a requestee.

Comment 4

[Vishant Gautam]

Attachment: apache2.patch

Comment 5

[Simon Green]

Comment on attachment 8449454 [details] [diff] [review]
apache2.patch

Review of attachment 8449454 [details] [diff] [review]:
-----------------------------------------------------------------

Two points:
1) Instead of removing \"%r\", it should be replaced with \"%m %U\", which gives the same information, just without the query params.

2) This patch does not seem to match any existing file in the upstream Bugzilla installation. The suggestion in comment #0 is to update the documentation, which lives in docs/en/rst/installation.rst

Comment 6

[Vishant Gautam]

(In reply to Simon Green from comment #5)
> Comment on attachment 8449454 [details] [diff] [review]
> apache2.patch
> 
> Review of attachment 8449454 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> Two points:
> 1) Instead of removing \"%r\", it should be replaced with \"%m %U\", which
> gives the same information, just without the query params.
> 
> 2) This patch does not seem to match any existing file in the upstream
> Bugzilla installation. The suggestion in comment #0 is to update the
> documentation, which lives in docs/en/rst/installation.rst

I have bugzilla 4.4.4 installed on ubuntu 14.04 but i was unable to find 'docs/en/rst/installation.rst';

Comment 7

[Simon Green]

(In reply to Vishant Gautam from comment #6)
> I have bugzilla 4.4.4 installed on ubuntu 14.04 but i was unable to find
> 'docs/en/rst/installation.rst';


The Bugzilla project moved from DocType to RST for documentation between 4.4 and the current master branch (which will become Bugzilla 5.0). Usually, patches need to be against the current master branch to be considered for review. The exception to this rule is fixing bugs in specific previous versions.

  -- simon

Comment 8

[Vishant Gautam]

Attachment: installation.rst.patch

Comment 9

[Simon Green]

Comment on attachment 8454979 [details] [diff] [review]
installation.rst.patch

+#. Replace \"%r\" with \"%m	%U\".

Extra spaces betweem m and %, and a few trailing whitespaces, can be fixed on commit.

Comment 10

[:glob ✱]

Comment on attachment 8454979 [details] [diff] [review]
installation.rst.patch

Review of attachment 8454979 [details] [diff] [review]:
-----------------------------------------------------------------

i'd like to see a new patch prior to approving this.

::: installation.rst
@@ +751,5 @@
> +Apache *httpd * log files with bugzilla
> +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> +
> +Some configuration is required to prevent Apache from logging
> +query strings

this change isn't _required_ for bugzilla to work.

it needs to be phrased as a recommendation, and needs to state why we recommend this.

for example:

"When some external systems interact with Bugzilla via its web services (REST/XMLRPC/JSONRPC) they include the user's credentials as part of the URL (query-string).  For security reasons we recommend configuring Apache to not include the query-string in its log files to avoid storing passwords in clear text on the server."

it also needs to end with a period.

@@ +754,5 @@
> +Some configuration is required to prevent Apache from logging
> +query strings
> +
> +#. Load :file:`httpd.conf` or :file:`apache2.conf` in your editor.
> +	 In most of the distros this file is found in :folder:`/etc/httpd/httpd.conf` 

"distros" should say "Linux distributions".  "distros" is slang and should be avoid in documentation.

Comment 11

[Vishant Gautam]

Attachment: installation.rst.patch

Comment 12

[Simon Green]

Comment on attachment 8455150 [details] [diff] [review]
installation.rst.patch

Review of attachment 8455150 [details] [diff] [review]:
-----------------------------------------------------------------

The typos that need to be fixed. It would also be good if you can remove the trailing whitespace, although this can be fixed on commit.

::: installation.rst
@@ +750,5 @@
>  
> +Apache *httpd * log files with bugzilla
> +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> +
> +For security reasons some configuration is recommended to prevent Apache from logging

replace "some configuration" with "it"

@@ +754,5 @@
> +For security reasons some configuration is recommended to prevent Apache from logging
> +query strings.
> +
> +For example:
> +When exterenal systems interact with Bugzilla via it webservices (REST/XMLRPC/JSONRPC)

remove "it"

@@ +760,5 @@
> +reasons we recommend configuring Apache to not include the query-string in its log
> +files to avoid storing passwords in clear text on the server.
> +
> +#. Load :file:`httpd.conf` or :file:`apache2.conf` in your editor.
> +	 In most of the Linux distributions this file is found in :folder:`/etc/httpd/httpd.conf` 

/etc/httpd/conf/httpd.conf

Comment 13

[Vishant Gautam]

Attachment: installation.rst.patch

Comment 14

[:glob ✱]

> +When exterenal systems interact with Bugzilla via webservices (REST/XMLRPC/JSONRPC)
typo: "external"

sgreen: please fix this and remove all trailing whitespace when committing.

Comment 15

[Simon Green]

Thanks for the patch.

To ssh://[e-mail]/bugzilla/bugzilla.git
   7e1bdaa..b672916  master -> master