own cgi scripts and security by Apache 2

['chris']

hi

I have linux SuSE 8.2 with Apache 2
and I've setup many virtual server

following example:


DocumentRoot "/srv/www/htdocs"
ServerName domain.com:80
Scriptalias /cgi-bin/ "/srv/www/cgi-bin/"


how to secure cgi ?

kind regards
chris

[Roberto Polli]

What do you meant with "secure cgi" ?

Peace, R.

[Steven E. Protter · Accepted solution]

Step 1:

make sure permissions on the scripts in the cgi-bin directory are as stingy as possible. chmod a+x *
chmod o-w *
chmod a+r *

that o-w statment makes sure the world outside your server can't change them. If they can change them, the spammers WILL use the scripts to send spam mail.

Step 2

Have a robots.txt file

It looks like this.

User-agent: *
Disallow: /cgi-bin
Disallow: /server-cgi
Disallow: /images

This prevents people from directly executing, your cgi scripts without running the form that is supposed to call it in a post/get.

If they try and use them directly and they will with names like hostform.cgi and form.cgi and formail.cgi it will show up in the httpd error log.

At that point you can process those logs into firewall entries and keep the spammers off your servers.

SEP

[Stuart Browne]

You might also want to look into 'cgiwrap' to get users to be able to create/own their own..

['chris']

hi Stuart

and where can I find "cgiwrap" ?

greetings
chris

[Stuart Browne]

http://cgiwrap.unixtools.org/