Why is cgi-bin in the apache root directory?

skyrant

• March 18, 2020 08:00

Is there any good reason why cgi-bin is in the domains apache root? Is it possible to move this to somewhere more appropriate like [USER_HOME]/cgi-bin ?

• 

  cPanelLauren

  • March 18, 2020 15:06

  It's automatically created in /home/$user/public_html and is more legacy than anything. See the following threads:

  0
• 

  skyrant

  • March 18, 2020 17:17

  I am aware that i can disable it, but if a user requests it then i have to enable it which in turn leaves him with an exposed cgi-bin in the apache root and me with possible problems when a malicious third party accepts this invitation. I have not seen any sysadm worth it's salt doing this since 1990. Is there a way for me to move this to a different directory outside the apache root?

  0
• 

  cPanelLauren

  • March 19, 2020 14:02

  Hello, I double-checked with our development on this to ensure I wasn't missing something. Here's what they said: There's no mechanism to customize the location of where a domain's default /cgi-bin/
  goes. One workaround might be to do the following:

  • Disable /cgi-bin/
    in the interface
  • When a customer wants it, do the following:
    • Create two Include files (e.g., at /etc/apache2/conf.d/userdata/[ssl|std]/2_4//DOMAIN/custom_cgi-bin.conf
      ) with the ServerAlias
      you want
    • Rebuild the apache configuration (/scripts/rebuildhttpdconf
      )
    • Restart Apache (/scripts/restartsrv_httpd
      )

  Furthermore, as far as security concerns go they said the following: [QUOTE]wherever it is it will have the same restriction or lack thereof to traverse the file system (or not). CGI (or PHP or whatever tech) running as the user instead of root or a generic user like nobody is far more crucial to limiting the effects of dangerous code the opposite is bad though, like having tomcat handle a docroot path, then the .htaccess restrictions are sidestepped.
  

  0
• 

  skyrant

  • March 20, 2020 07:28

  Thank you for following up. I appreciate it. This looks like a solution that i can live with. I will give this a try and if i run into problems or have more questions i post here

  0

Please sign in to leave a comment.