Disallowing apache to use cgi and perl

cannus · 12-20-2002, 11:57 AM

I'm having a hard time with my apache serve and formmail scripts being abused by spammers, so I would like to disable cgi and perl for use by apache...
can anyone give me a hand?

stickman · 12-20-2002, 12:10 PM

You could always remove or fix the scripts that are being abused.

cannus · 12-20-2002, 12:16 PM

i thought about that, but then my users could simply just replace them. There's way too many scripts to patch also.. this is why I'm looking for a blanket fix

shaggz · 12-20-2002, 12:33 PM

hehehe I replied to this on another post.

Simply chmod 000 /usr/bin/perl

This will disable perl and also make it very easy to reenable it once you inform them of the patches.

cannus · 12-20-2002, 12:43 PM

that would work, but we need other users aside from apache to be able to use perl.

SlickWilly · 12-20-2002, 12:59 PM

Find the following line in your httpd.conf and comment it out :

AddHandler cgi-script .cgi .pl

cannus · 12-20-2002, 01:05 PM

unfortunately, I've already done that also...

SlickWilly · 12-20-2002, 01:36 PM

Okay...

Look in your <virtual host> and or <directory> options and make sure there are no ExecCGI directives in there..

Failing that, simply move the cgi's, pl's and whatever else is executing to a new directory, look at the error log, and figure out where it's being called from.

Slick.

robgo777 · 12-21-2002, 05:51 PM

All you have to do is open your httpd.conf file and comment out the following:

ScriptAlias /cgi-bin/ "/path/to/your/cgi-bin/"

In case you don't know, your httpd.conf file is probably located in:
/etc/httpd/conf/

Have fun