I'm setting up an apache webserver (on Ubuntu 18.04) with a CGI script, but I want a clean URL without "cgi" in it.
I already have a functioning script (in Perl), which, for the purposes of this question, I'll call myscript.
1. localhost/cgi-bin/myscript (works)
If I put the script in /usr/lib/cgi-bin/myscript, it works with URL localhost/cgi-bin/myscript.
2. localhost/myscript.cgi (works)
Alternatively, I can reconfigure /var/www/ to run files with .cgi or .pl extensions as CGI:
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
+ Options +ExecCGI
+ AddHandler cgi-script .cgi .pl
</Directory>
This works IF I add a .cgi extention: myscript.cgi. Then URL localhost/myscript.cgi works.
3. localhost/myscript ???
But I don't want cgi in my URL. I just want localhost/myscript to run myscript as CGI. (And I don't want to force other files in ROOT to be CGI).
Is this possible?
You cannot do that directly. However, you could Redirect requests for specific extension-less URLs to their corresponding .cgi.
You can test these with an .htaccess file to avoid having to reload the server.
In your <VirtualHost ...> section :
<Directory /your/web/dir/>
Require all granted
AllowOverride All
</Directory>
In /your/web/dir/.htaccess :
Options +ExecCGI
AddHandler cgi-script .cgi
Redirect "/test" /test.cgi
# or
# RedirectMatch "^/(test)$" /$1.cgi
Another possibility would be to use mod_rewrite, and redirect calls to any existing executable file to a file with the same name but with a .cgi extension. The extension-less file must only exist, and can be empty.
In /your/web/dir/.htaccess :
Options +ExecCGI
AddHandler cgi-script .cgi
RewriteEngine On
# If not already .cgi and executable, redirect to .cgi
RewriteCond /your/web/dir/%{REQUEST_URI} "!\.cgi$"
RewriteCond /your/web/dir/%{REQUEST_URI} -x
RewriteRule ^(.+) /$1.cgi [R]
Of course, you can use any other extension than .cgi. For example .x if you set AddHandler cgi-script .x.
Related
Drupal html files under sites/default/files/* is downloading but executing.
Note: .htaccess file under sites/default/files/ is with default setting as below:
Turn off all options we don't need.
Options None
Options +FollowSymLinks
Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
# Override the handler again if we're run later in the evaluation list.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
php_flag engine off
</IfModule>
Fixed after adding a .htaccess file with below
ForceType text/html
Header set Content-Disposition inline
I have a newly configured Apache 2.4.7 webserver (AIX7 ). It is displaying the contents of my CGIs instead of their output.
I have this in my conf file:
LoadModule cgi_module /opt/freeware/lib64/httpd/modules/mod_cgi.so
AddHandler cgi-script .cgi .pl
ScriptAlias /cgi-bin "/var/www/cgi-bin"
<Directory "/var/www/cgi-bin">
Options +FollowSymLinks +Includes -Indexes +ExecCGI
Order allow,deny
Allow from all
</Directory>
My CGIs behave as expected if run from the CLI. They are world-readable and world-executable. The shebang line is correct. There are no relevant messages in error_log.
What ELSE can cause the server to not execute a CGI?
OK, I figured it out. I had two different conf directories. Apache was looking at a configuration in a different location which had the default values.
Lesson learned: If Apache seems to be ignoring your config file, make sure you're looking at the right file.
My server doesn't render any images under the cgi directory, I know that this is because apache is told to run every file under that directory as a cgi program.
I would like to adjust the settings to tell apache to run all the .cgi and .pl as cgi programs but run the rest of files as they should be.
For instance, if I go to example.com/x.gif from a browser I can see the image, but if I go to example.com/cgi-bin/x.gif I can't. (being the image in both dirs, of course, and with 775)
The problem is that I don't know how to tell that to apache, this is the httpd.include
<Directory /var/www/vhosts/example.com/httpdocs>
<IfModule mod_perl.c>
<Files ~ (\.pl$)>
SetHandler perl-script
PerlHandler ModPerl::Registry
Options ExecCGI
allow from all
PerlSendHeader On
</Files> </IfModule> <IfModule mod_python.c>
<Files ~ (\.py$)>
SetHandler python-program
PythonHandler mod_python.cgihandler
</Files> </IfModule> <IfModule mod_fcgid.c>
<Files ~ (\.fcgi)>
SetHandler fcgid-script
Options +FollowSymLinks +ExecCGI
</Files> </IfModule> <IfModule mod_fcgid.c>
<Files ~ (\.php)>
SetHandler fcgid-script
FCGIWrapper /var/www/cgi-bin/cgi_wrapper/cgi_wrapper .php
Options +ExecCGI
allow from all
</Files> </IfModule>
SSLRequireSSL
Options -Includes +ExecCGI
</Directory>
I found a solution.
As I said, apache is told to run every file under that directory as a cgi program. So are needed new rules to tell apache to use a default handler for those filetypes different from .php , .pl or .cgi:
<Directory /var/www/vhosts/example.com/httpdocs/cgi-bin>
<FilesMatch "^(?!.*\.(cgi|php|pl)$).*$">
SetHandler default-handler
</FilesMatch>
</Directory>
If you can't access the httpd.conf for any reason you still can do the trick with .htaccess adding this three lines to the .htaccess file of the cgi-bin folder:
<FilesMatch "^(?!.*\.(cgi|php|pl)$).*$">
SetHandler default-handler
</FilesMatch>
I have a directory where users can upload files.
To avoid security issues (e.g. somebody uploading a malicious php script), I currently change the files' extension by appending .data for example, but then when downloading the file, they have to manually remove the .data.
Another common solution is to upload the files in a directory that is not served by Apache, and have a php script manage all downloads by calling readfile().
What I'd like to do is to simply disallow execution of any scripts (php, perl, cgi scripts, whatever I may install in the future) in the upload folder. This SO answer suggests adding the following line in a .htaccess file in that folder:
SetHandler default-handler
However, in my case this has no effect (the example php script I put in that folder is still executed). What am I doing wrong?
Apache configuration
The machine is a VPS (Virtual Private Server) running Debian GNU/Linux 6.0.7 (squeeze), and as far as I can remember (I note down all commands I run on that server, so my "memory" should be pretty accurate), I dindn't change anything in apache2 configuration, appart from running sudo apt-get install php5, and creating the the file /etc/apache2/sites-enabled/mysite.com with the following contents:
<VirtualHost *:80>
ServerAdmin webmaster#localhost
ServerName mysite.com
ServerAlias www.mysite.com
DocumentRoot /home/me/www/mysite.com/www/
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
<Directory /home/me/www/mysite.com/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from All
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
Put this in your .htaccess:
<Files *>
# #mivk mentionned in the comments that this may break
# directory indexes generated by Options +Indexes.
SetHandler default-handler
</Files>
But this has a few security holes: one can upload a .htaccess in a subdirectory, and override these settings, and they might also overwrite the .htaccess file itself!
If you're paranoid that the behaviour of the option should change in the future, put this in your /etc/apache2/sites-enabled/mysite.com
<Directory /home/me/www/upload/>
# Important for security, prevents someone from
# uploading a malicious .htaccess
AllowOverride None
SetHandler none
SetHandler default-handler
Options -ExecCGI
php_flag engine off
RemoveHandler .cgi .php .php3 .php4 .php5 .phtml .pl .py .pyc .pyo
<Files *>
AllowOverride None
SetHandler none
SetHandler default-handler
Options -ExecCGI
php_flag engine off
RemoveHandler .cgi .php .php3 .php4 .php5 .phtml .pl .py .pyc .pyo
</Files>
</Directory>
If you can't modify the apache configuration, then put the files in a .htaccess with the following directory structure:
/home/me/www/
|- myuploadscript.php
|- protected/
|- .htaccess
|- upload/
|- Uploaded files go here
That way, nobody should be able to overwrite your .../protected/.htaccess file since their uploads go in a subdirectory of .../protected, not in protected itself.
AFAICT, you should be pretty safe with that.
My Godaddy setup wont allow me to edit the httpd.conf files, and the php_flag command doesn't work due to how they've implemented php for me.
I was able to use this in my .htaccess file:
SetHandler default-handler
AddType text/plain php
I put this in the directory above where my FTP user is allowed to access, which forces all PHP files in that directory, as well as all sub-directories to show php as plain text.
This will work for other file types as well. All you need to do is add another line with whatever extension of file you want to be forced to display in plain text. AddType text/plain cgi for example
Until recently, an internal Bugzilla install was working fine. Now, all requests to pages inside the http://example.com/bugzilla directory return 403/Forbidden. Pages outside that directory, for instance at http://example.com/test.html or http://example.com/test/index.html work as expected. This is the .htaccess file for the bugzilla directory, which is unchanged from the original:
# Don't allow people to retrieve non-cgi executable files or our private data
<FilesMatch (\.pm|\.pl|\.tmpl|localconfig.*)$>
deny from all
</FilesMatch>
<IfModule mod_expires.c>
<IfModule mod_headers.c>
<IfModule mod_env.c>
<FilesMatch (\.js|\.css)$>
ExpiresActive On
# According to RFC 2616, "1 year in the future" means "never expire".
# We change the name of the file's URL whenever its modification date
# changes, so browsers can cache any individual JS or CSS URL forever.
# However, since all JS and CSS URLs involve a ? in them (for the changing
# name) we have to explicitly set an Expires header or browsers won't
# *ever* cache them.
ExpiresDefault "now plus 1 years"
Header append Cache-Control "public"
</FilesMatch>
# This lets Bugzilla know that we are properly sending Cache-Control
# and Expires headers for CSS and JS files.
SetEnv BZ_CACHE_CONTROL 1
</IfModule>
</IfModule>
</IfModule>
AddHandler cgi-script .cgi .pl
DirectoryIndex index.cgi
This is the .htaccess file for the directory above the bugzilla directory. This is the public_html web root:
DirectoryIndex index.html
This is the Apache configuration file for the site:
<VirtualHost *:80>
ServerAdmin webmaster#localhost
DocumentRoot /var/www/default/public_html
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/default/public_html>
DirectoryIndex index.cgi
AllowOverride Limit FileInfo Indexes
AddHandler cgi-script .cgi
Options Indexes FollowSymLinks MultiViews +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
allow from all
</Directory>
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
AllowOverride None
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
Options Indexes MultiViews FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>
</VirtualHost>
Note that even non-Bugzilla static HTML files in that directory are affected. For instance, I create /bugzilla/test.html in VIM, then I try to access it in the browser and see that it is also returning 403/Forbidden. All files, both in and outside that directory, have the same user ubuntu and the same permissions 644. The bugzilla directory itself has permissions 755, as does its parent public_html.
No 'control panels' such as Plesk are installed on the server, all configuration is done in Apache config files. Why might Apache have decided that I may not be authorized to view the bugzilla directory? This is on a public webserver hosted in Amazon Web Services, on Ubuntu Server 12.04 LTS.
Check the error_log file, it usually has very detailed information about why it returns a 403 Forbidden.
(It looks like a debian server? If you post questions like this, always mention the OS.)
I suspect it to be a rights issue - wrong owner. For debian/ubuntu, the given folder and its files should be owned by user "www-data". For Centos/Redhat I believe it should be "nobody". Check it, change it if necessary.
sudo chown -R www-data:www-data test
NB: If you're unsure about changing rights, make a copy first. Change the owner of the copy, as copying in itself probably changes the owner. Or use rsync to make a copy of the folder, as rsync preserves owner and rights.