CGI -PERL Problem!!!

lewkh · 05-09-2005, 02:58 AM

Hi everybody,
I am using Fedora Core 3 and Apache version 2.0.52 release 3. I am trying to test the cgi perl script as following:

#!/usr/bin/perl -w
use strict;
print "Content-type: text/html\n\n";
my $list=`ls`;
print "<HTML>";
print "<HEAD>";
print "<TITLE>LISTING</TITLE>";
print "</HEAD>";
print "<BODY>";
print "<H1> $list</H1>";
print "</BODY>";
print "</HEAD>";
print "</HTML>";

While I run this script at Firefox browser, it prompts 500 Internal Server Error and the /var/log/http/error_log show like
Use of uninitialized value in concatenation (.) or string at <script _line no>
But when I put the same script and run it at RedHat Linux 9 (Apache 2.0.40), there is runable without any problem. Thus I wonder know is there a security issue I need to configure at Apache 2.0.52 version?

Please advise....... Thanks

WhatsHisName · 05-09-2005, 11:18 AM

As I understand it, the stock Apache 2.0 httpd.conf setup in FC3 limits cgi execution to /var/www/cgi-bin/:

ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

To execute cgi script elsewhere, you need to add:

Options ExecCGI
and
AddHandler cgi-script .cgi

Here is an example I pulled from one of my systems using virtual hosts to allow cgi execution in /var/www/html/:

#Using AddHandler:

<VirtualHost *:80 *:8080>
DocumentRoot /var/www/html
Server Admin root@localhost
ServerName 192.168.1.202
AddHandler cgi-script .cgi
ServerSignature email
Directorylndex index.html index.htm index.shtml
</VirtualHost>

#Note: You may need to add to the DirectoryIndex list depending on how you making the call.

#This is the standard allow:

<Directory "/var/www/cgi-bin">
Options ExecCGI
AllowOverride None
Allow from all
Order allow,deny
</Directory>

#This allows execution in /var/www/html/:

<Directory"/var/www/html">
Options ExecCGI
AllowOverride None
Allow from all
Order allow,deny
</Directory>

lewkh · 05-09-2005, 11:49 PM

Hi WhatsHisName,
The script is runnable, but the problem only occur on the system command unreadable ( Pass null to $list)

#!/usr/bin/perl -w
use strict;
print "Content-type: text/html\n\n";
my $list=`ls`; #If I change to my $list=`/bin/date`; the client browser will display the current date.
print "<HTML>"; #but like ls command it won't display. Once I put the script on RedHat 9, the ls
print "<HEAD>"; #command can be parsed to variable $list.
print "<TITLE>LISTING</TITLE>";
print "</HEAD>";
print "<BODY>";
print "<H1> $list</H1>";
print "</BODY>";
print "</HEAD>";
print "</HTML>";

I have configured the directory to let cgi runnable but I only do not know why the system command unable to be parsed?
Is there any else I have to configure ?

WhatsHisName · 05-10-2005, 12:19 AM

If you enabled SELinux during the initial security setup, try either disabling it or setting it to “warn” and retesting execution. In essence, the purpose of SELinux is to interrupt processes and the passing of data that are not specifically approved.

If you want to get a severe headache, you can read the RHEL4 SELinux manual (http://www.redhat.com/docs/manuals/e...el-selg-en.pdf) for more details.