Solved

Denying access to cgi-bin dir through Apache

Posted on 2000-05-06
5
168 Views
Last Modified: 2013-11-18
Hey all.

Say I have a directory called cgi, which houses scripts called by .shtml pages.  Of course, those scripts are run by the Apache server itself.

For security reasons, I do not want any user to be able to go to www.mywebsite.com/cgi and see all my scripts.

If I password protect the directory, then the server cannot execute any of my SSId CGI files in that directory.

How can I prevent users from going to that directory, while at the same time getting my server to execute those server-side-includes?  

I'd like a better answer than "just put an index.html file in that directory," as I'm sure that isn't the most secure thing to do.
0
Comment
Question by:htrosxlmn
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 40

Expert Comment

by:jlevie
ID: 2785723
As far as the web server is concerned, just don't include an "indexes" directive for the cgi-bin directory.
0
 

Author Comment

by:htrosxlmn
ID: 2785839
How do I do that?  I am not the admin, but the admin will do whatever I ask him to.  

Walk me through it and you got the points. ;)
0
 
LVL 40

Accepted Solution

by:
jlevie earned 150 total points
ID: 2786232
I'll try to, but whether I can or not depends on what web server is in use. If it is Apache, or another that uses a similar type of config file you'd want to change the definition of the cgi-bin directory from:

<Directory "/opt/Apache/cgi-bin">
   AllowOverride None
   Options Indexes ExecCGI
   Order allow,deny
   Allow from all
</Directory>
 
to:

<Directory "/opt/Apache/cgi-bin">
   AllowOverride None
   Options ExecCGI
   Order allow,deny
   Allow from all
</Directory>
0
 

Author Comment

by:htrosxlmn
ID: 2789428
Someone outside of this site suggested I put an .htaccess file in that directory that said

Options -Indexes

That's it!  That did the trick.  I'm giving you the points anyway, but I wanted you to know how I did it.
0
 
LVL 40

Expert Comment

by:jlevie
ID: 2789968
Yeah, that would work also. Generally you'd like to be able to do it at the server level as those files are typically owned by root and ordinary users can't get in & change the settings.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Unix process listing into CSV format 3 52
Form submit issue 11 89
How to check the PVU´s on AIX TSM servers? 3 120
Run a Radio Station (Streaming media) with web interface 10 52
Preface In the first article: A Better Website Login System (http://www.experts-exchange.com/A_2902.html) I introduced the EE Collaborative Login System and its intended purpose. In this article I will discuss some of the design consideratio…
SASS allows you to treat your CSS code in a more OOP way. Let's have a look on how you can structure your code in order for it to be easily maintained and reused.
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question