Hello,

currently the httpd(8) log files are world and daemon-readable and probably they shouldn't.

Maybe the following patch will do the trick:

---
 etc/newsyslog.conf      | 4 ++--
 usr.sbin/httpd/logger.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/etc/newsyslog.conf b/etc/newsyslog.conf
index e496ab998bc..b68748a41a6 100644
--- a/etc/newsyslog.conf
+++ b/etc/newsyslog.conf
@@ -13,5 +13,5 @@
 /var/log/wtmp				644  7     *    $M1D4 B ""
 /var/log/xferlog			640  7     250  *     Z
 /var/log/pflog				600  3     250  *     ZB "pkill -HUP -u root -U root -t - -x pflogd"
-/var/www/logs/access.log		644  4     *    $W0   Z "pkill -USR1 -u root -U root -x httpd"
-/var/www/logs/error.log			644  7     250  *     Z "pkill -USR1 -u root -U root -x httpd"
+/var/www/logs/access.log		600  4     *    $W0   Z "pkill -USR1 -u root -U root -x httpd"
+/var/www/logs/error.log			600  7     250  *     Z "pkill -USR1 -u root -U root -x httpd"
diff --git a/usr.sbin/httpd/logger.c b/usr.sbin/httpd/logger.c
index c2eae70f4fd..b9c912b186d 100644
--- a/usr.sbin/httpd/logger.c
+++ b/usr.sbin/httpd/logger.c
@@ -183,7 +183,7 @@ logger_open_priv(struct imsg *imsg)
 		return (-1);
 	}
 
-	if ((fd = open(path, O_WRONLY|O_APPEND|O_CREAT, 0644)) == -1) {
+	if ((fd = open(path, O_WRONLY|O_APPEND|O_CREAT, 0600)) == -1) {
 		log_warn("failed to open %s", path);
 		return (-1);
 	}
-- 
2.53.0

Kind regards,
Piotr Durlej