Logs as the First Responder

An access log is a line per request the daemon chose to record: time, source address as the clerk saw it, method, path, status, sometimes size and a user-agent string. On a server YOU run, that line answers “did anyone ask for /backup.zip” and “are we serving 404 storms.” Python’s http.server prints a short access-style line to the terminal by default — enough literacy for this module. Production Apache/nginx/IIS write files. You need the name so Lesson 4’s terminal output is not a mystery. You do not need a parser that hunts other people’s CDNs. Status 200 versus 403 versus 404 is hygiene language you already used in Module 10’s 429 demo: the number is the clerk’s answer, not a loot code.

What access logs are not: permission to replay the paths against a second host; a wordlist mined from a stranger’s leaked log; a reason to keep listing on so “the log looks busy.” If you see GET / from 127.0.0.1 in Lesson 4, write that. If you see a listing request because you forgot index.html, that is YOUR misconfig in the log — then you add the index. Do not “enrich” the lab by pointing a scanner at school.edu so the access log of a stranger fills. Their log is not your worksheet.

sudo apt install curl
sudo apt install python3

brew install python3

curl -sS -m 2 -o /dev/null -w "method_GET status=%{http_code}
" "http://127.0.0.1:8000/"

An error log is the clerk talking to itself: missing files it tried to open, TLS handshake failures on a real daemon, permission denied on a path the worker UID cannot read, crashed modules. On a stack you run, error lines are tickets: fix the path, fix the permission, patch the module (Lesson 2), do not chmod 777 the whole tree to silence the line. Module 6’s least-privilege warning still holds: a worker that can write the document root can often write a web shell if the app is sloppy — this course still will not teach that implant. The error log’s job is to show YOU the denied open, not to hand a stranger a map.

You will not grep a neighbor’s error_log. You will not buy “log dumps” as a homework pack. You will not paste production errors that contain session tokens or paths to customer files into a public gist. If Lesson 4’s handler returns 403 for directory listing, that is an error/status you caused as the author — record it in ceh-webserver-lab.txt, not as a screenshot of someone else’s host. Empty ethics lines fail. Notes that contain other people’s log excerpts fail even if Python printed OK.

sudo apt install curl

curl -sS -m 2 -o /dev/null -w "missing_path status=%{http_code}
" "http://127.0.0.1:8000/no-such-cyberlium"

A log that lives only on the same disk a ransomware event or a hostile admin can reach can die with the disk. Off-box copies — another host you own, a cloud audit store the endpoint cannot erase, even rotating a file off the demo laptop — are how defenders keep memory. Module 6 already wrote that sentence for system audit. Web access/error logs are the same control with HTTP columns. You do not need a SIEM brand to write: copies the clerk cannot delete. Local terminal scrollback from python http.server is enough for Lesson 4’s demo and is gone when you close the window — which is why you copy the lines you need into locked notes.

Covering tracks on someone else’s web server — truncating access_log, deleting error_log, disabling CustomLog — is unauthorized modification and often evidence tampering. This course will not give you the wipe commands. It will give you the rule: you never hide tracks on someone else’s box; you never practice wiping Event Logs or nginx logs on a campus PC; you never disable logging on a family site “to see if they notice.” On a machine YOU own, turning audit off to mimic an attacker is still a bad defender habit. Restore logging. Do not publish a wipe script.

cat >> "$NOTES" << 'EOF'
off_box: copy/rotate to a place that survives a wipe
refuse: wiping other people logs
EOF

A server-logs note is a ticket template. Date (UTC). Access log: what one line means (time, source as seen, method, path, status) on a server YOU run. Error log: denied work and bugs, not a trophy. Off-box: yes/no and a revisit date if not yet. Ethics: never read, steal, or wipe someone else’s logs; never directory-brute strangers to “generate” log lines; audit a stack YOU run. Legal line: original Cyberlium teaching mapped to the CEH v13 web-servers domain — not official EC-Council training, not a cert, not exam dumps. File: $HOME/cyberlium-lab/server-logs-notes.txt, chmod 600.

Do not fill the “server” row with school.edu. Do not add a section titled “how I would clear logs after a test.” Next lesson implements a local clerk so the access line is a request you caused as the client and the author, then you stop the process. Until then, locked definitions are complete. World-writable 777 fails. Gists of other people’s log paths fail.

On a computer you own, create cyberlium-lab if needed. Fill every ethics blank. Optionally note where a real daemon you administer would write access/error (path you are allowed to read) — observation only. Do not clear logs. Do not add a stranger hostname. chmod 600.

sudo apt install gobuster

brew install gobuster

go install github.com/OJ/gobuster/v3@latest

cd "$HOME/cyberlium-lab"

{

You now treat access and error logs as the first responder on a server YOU run — completed asks versus denied work — and you treat stealing, wiping, and covering tracks on someone else’s clerk as out of this course. Off-box copies survive a hostile disk. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 web-servers domain — not official EC-Council training, not a cert, not exam dumps. Next — Lab — Harden a Local Static Server — HOST hardcoded 127.0.0.1, no directory-listing homework on strangers, ceh-webserver-lab.txt chmod 600, then stop the server.