Avatar of fredo783
fredo783

asked on 

How to secure cgi-bin under document root - or move it above document root?

Hi:

I'm migrating a site to a Hostgator shared hosting site under Linux CentOS. Security is a paramount concern.

The old website was on an Apache server that had Perl scripts in cgi-bin. The cgi-bin resided above the document root. This was excellent from a security perspective, as the cgi-bin directory is not publicly visible.

On the new server, cgi-bin lives under the document root, as in www/cgi-bin. It could be publicly visible.

I put index.html and hello_world.pl files in www/cgi-bin and changed permissions to 755. In both cases, I got an error message: Internal Server Error. This is likely Apache-generated. So perhaps the directory is already completely secure.

Support says that I could move cgi-bin above the document root, but .htaccess changes would be required and they really don't know what those changes would be. They also said that I could not move cgi-bin.  Guess the answer depends on the weather.

They also said that scripts in cgi-bin are protected by Apache and can only be accessed by the owner.

Is it reasonable to assume that the current www/cgi-bin directory is secure at this point?

Is it reasonable to move it myself to above the document root? Where might I find .htaccess rules to do so?

This thread is related to my question:
https://www.experts-exchange.com/questions/20845090/Accessing-a-cgi-bin-that-is-ABOVE-the-www-directory-from-form-action.html

Thanks very much.

Fred
Scripting LanguagesPerlApache Web Server

Avatar of undefined
Last Comment
fredo783
SOLUTION
Avatar of Jan Bacher
Jan Bacher
Flag of United States of America image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Avatar of fredo783
fredo783

ASKER

Hi, Jesper:

There is no default .htaccess on this shared hosting site. I also do not have access to httpd.conf, nor can I modify apache.
ASKER CERTIFIED SOLUTION
Avatar of Dave Baldwin
Dave Baldwin
Flag of United States of America image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
SOLUTION
Avatar of ahoffmann
ahoffmann
Flag of Germany image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
Avatar of fredo783
fredo783

ASKER

Thanks, folks. It appears that Apache is configured in this environment to protect files in the default www/cgi-bin directory.
Scripting Languages
Scripting Languages

A scripting language is a programming language that supports scripts, programs written for a special run-time environment that automate the execution of tasks that could alternatively be executed one-by-one by a human operator. Scripting languages are often interpreted (rather than compiled). Primitives are usually the elementary tasks or API calls, and the language allows them to be combined into more complex programs. Environments that can be automated through scripting include software applications, web pages within a web browser, the shells of operating systems (OS), embedded systems, as well as numerous games. A scripting language can be viewed as a domain-specific language for a particular environment; in the case of scripting an application, this is also known as an extension language.

30K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
Ask the experts
Read over 600 more reviews

TRUSTED BY

IBM logoIntel logoMicrosoft logoUbisoft logoSAP logo
Qualcomm logoCitrix Systems logoWorkday logoErnst & Young logo
High performer badgeUsers love us badge
LinkedIn logoFacebook logoX logoInstagram logoTikTok logoYouTube logo