Apache and CGI Files

Factual Questions
1

I have two questions for Apache gurus here :slight_smile:

  1. My cgi-bin directory allows a directory listing in /cgi-bin/. Normally, this should produce a 403 error, but any file inside should execute. I can’t figure out how to produce a 403 when a directory listing is attempted, while still allowing CGI handling inside. I can either make the directory AND all files inside produce 403s, or allow a listing and execution. How can I fix this?

  2. Currently, .pl and .cgi files can be executed from any directory on my server – not just inside cgi-bin. Right now, .pl and .cgi files are BOTH being run through the PERL interpreter I installed. IIRC, .pl files should be run through the PERL interpreter, and .cgi files should just be run as-is (ie: a compiled C++ program renamed .cgi could be executed). How can I fix that?

If anyone needs to see my httpd.conf file, I can provide it.

Thanks guys!

2

You running this on Windows by any chance? Unless you’ve got .cgi directly mapped to Perl in your conf, they should be executed by whatever is in the #! line.

3

Put an blank index.html (or an index.html that says “You’re not allowed here, go away” or whatever message you want) in EVERY accessible folder that doesn’t already have an index file. This will keep the server from serving up a directory listing. I’m not sure I understand your second question, sorry.

4

.cgi was, indeed, mapped to Perl in the conf. I removed this and tried to execute a compiled C++ file renamed to .cgi, and my server just offered me the option to save it.

5

I was under the impression that there was a way to do this without using an index file, though.

6

Also, the following file named test.cgi just displayed itself in the browser, without executing.


#!c:\perl\bin
# test.cgi v1.0

printf "Content-type: text/html

<html><body>";
printf "Alright.";
printf "</body></html>
";
7

There may be, either through .htaccess or CHMOD permissions (if it’s a *NIX server), but franky, I prefer having an index. It’s just easier, IMO. Plus you can get creative with it, rather than making folks look at a dull 403 page.

8

Ugh… just noticed another problem. Sorry to inundate with the plethora of questions, but here goes.

Trying to access something like http://www.myserver.com/somedirectory/index.html works when I enter http://www.myserver.com/somedirectory/, but not http://www.myserver.com/somedirectory.

How can I configure Apache to automatically append the trailing slash or read it as a directory if there’s no file existing with that name?

9

True. Thanks for the tip.

10

Hey guys-

Managed to fix my CGI problems. The only thing I can’t figure out is appending the trailing slash to allow /somedirectory to be interpreted as /somedirectory/ and, thusly, as /somedirectory/index.html

Any ideas?

11

In your httpd.conf:



ScriptAlias /cgi-bin/ "/usr/local/www/cgi-bin/"

<Directory "/usr/local/www/cgi-bin">
    AllowOverride None
    **Options None**
    Order allow,deny
    Allow from all
</Directory>

Alternatively:
Options -Indexes

Do you have mod_dir installed? It “fixes” the missing trailing slash.

12

Well, of course you have it installed, or you wouldn’t be having the directory listing issues. mod_dir

I think this may be an issue with the indexing - try turning it off for the whole site in httpd.conf - and see if that solves the trailing slash problem.

13

Thanks guys… fixed the CGI-BIN problem (a missing ScriptAlias allowed the directory contents to show). The .cgi problem was because .cgi was also associated with the PERL interpreter in Windows, itself. Fixed that.

Also, the trailing slash problem was because I had accidently mistyped part of the ServerName. That fixed it all up.

Thanks again, guys!