commit e4a70cf8516fc2140a2fe36e9dcbe7b0f0353c7f Author: David Fifield david@bamsoftware.com Date: Sun Dec 16 10:35:45 2012 -0800

Explicitly log to /dev/null to disable a Debian default.

I thought that omitting a CustomLog line would prevent logging of requests. But Debian has a default configuration file /etc/apache2/conf.d/other-vhosts-access-log with a default log if you don't give your own: # Define an access log for VirtualHosts that don't define their own logfile CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined --- doc/facilitator-howto.txt | 4 +--- 1 files changed, 1 insertions(+), 3 deletions(-)

diff --git a/doc/facilitator-howto.txt b/doc/facilitator-howto.txt index 1defc9c..9ea5c1f 100644 --- a/doc/facilitator-howto.txt +++ b/doc/facilitator-howto.txt @@ -126,6 +126,7 @@ these contents: ServerName tor-facilitator.bamsoftware.com DocumentRoot /dev/null ScriptAliasMatch ^(.*) /usr/local/bin/facilitator.cgi$1 + CustomLog /dev/null common ErrorLog ${APACHE_LOG_DIR}/error.log LogLevel warn SSLEngine on @@ -136,9 +137,6 @@ intermediate.pem is a possible intermediate certificate file provided by the CA; if you did not get one, then leave off the SSLCertificateChainFile line.

-We purposely do not include a CustomLog directive so as to not to log -client and proxy IP addresses. - === HTTPS setup

The HTTP server should serve only over HTTPS and not unencrypted HTTP.