topic Re: own cgi scripts and security by Apache 2 in Operating System - Linux

own cgi scripts and security by Apache 2

'chris' — Thu, 29 Apr 2004 05:54:55 GMT

hi

I have linux SuSE 8.2 with Apache 2
and I've setup many virtual server

following example:

DocumentRoot "/srv/www/htdocs"
ServerName domain.com:80
Scriptalias /cgi-bin/ "/srv/www/cgi-bin/"

how to secure cgi ?

kind regards
chris

Re: own cgi scripts and security by Apache 2

Roberto Polli — Thu, 29 Apr 2004 07:40:13 GMT

What do you meant with "secure cgi" ?

Peace, R.

Re: own cgi scripts and security by Apache 2

Steven E. Protter — Thu, 29 Apr 2004 09:40:14 GMT

Step 1:

make sure permissions on the scripts in the cgi-bin directory are as stingy as possible. chmod a+x *
chmod o-w *
chmod a+r *

that o-w statment makes sure the world outside your server can't change them. If they can change them, the spammers WILL use the scripts to send spam mail.

Step 2

Have a robots.txt file

It looks like this.

User-agent: *
Disallow: /cgi-bin
Disallow: /server-cgi
Disallow: /images

This prevents people from directly executing, your cgi scripts without running the form that is supposed to call it in a post/get.

If they try and use them directly and they will with names like hostform.cgi and form.cgi and formail.cgi it will show up in the httpd error log.

At that point you can process those logs into firewall entries and keep the spammers off your servers.

SEP

Re: own cgi scripts and security by Apache 2

Stuart Browne — Thu, 29 Apr 2004 20:40:42 GMT

You might also want to look into 'cgiwrap' to get users to be able to create/own their own..

Re: own cgi scripts and security by Apache 2

'chris' — Fri, 30 Apr 2004 18:35:29 GMT

hi Stuart

and where can I find "cgiwrap" ?

greetings
chris

Re: own cgi scripts and security by Apache 2

Stuart Browne — Sat, 01 May 2004 08:58:28 GMT

http://cgiwrap.unixtools.org/