disable .cgi on server

itdungpt · 02-26-2012, 12:18 AM

hi all

how to disable .cgi .pl on centos server apache ?
help me

lithos · 02-26-2012, 01:45 AM

Hi,

well, It can be done in many ways (htaccess, directory, global file type...)

so a quick "disable" for all could be:

# /etc/httpd/conf/httpd.conf

Code:

# COMMENT the next lines like so:

# LoadModule cgi_module modules/mod_cgi.so

# AddHandler cgi-script .cgi .pl

now # commented these lines and restarting Apache (# service httpd restart) will not execute .cgi scripts

you could also make it show like a text file with:

Code:

#add this line where other similar lines exist -> AddType text/html .shtml
AddType text/html .cgi .pl

then you have an option to disable it "per directory" with (Apache options):

Code:

<Directory "/var/www/sitedomain">
 AllowOverride None
  Options -ExecCGI
  Order allow,deny
  Allow from all
</Directory>

itdungpt · 02-26-2012, 04:28 AM

- cgi build from easyapache so have not # LoadModule cgi_module modules/mod_cgi.so
- I just create a file. htaccess is possible to disable the things you just mentioned.

AddHandler application/x-httpd-php4 .php .php4 .php3
Options +FollowSymLinks +Indexes
DirectoryIndex default.html
AddType text/html php
Options +ExecCGI
AddHandler cgi-script cgi pl xt love mrp

I think this is an impractical method.

lithos · 02-26-2012, 06:12 AM

Quote:

Originally Posted by itdungpt

- cgi build from easyapache so have not # LoadModule cgi_module modules/mod_cgi.so
- I just create a file. htaccess is possible to disable the things you just mentioned.

AddHandler application/x-httpd-php4 .php .php4 .php3
Options +FollowSymLinks +Indexes
DirectoryIndex default.html
AddType text/html php
Options +ExecCGI
AddHandler cgi-script cgi pl xt love mrp

I think this is an impractical method.

Then use these setting in httpd.conf file to make it used in the Apache server on the whole system.

Find a 'terminal window' (how-to) in cPanel and manually edit it as root user (as far as I see easyapache is just a script module for cPanel to do the settings through WHM)

wpeckham · 02-26-2012, 07:48 AM

If there is no strict requirement for Apache, you could run a different web server that allows easier control over these functions.
(I liked Xitami, but it is no longer supported. Lighttpd looks good. )

You might check out pages like this one: http://slodive.com/web-development/l...s-web-servers/

itdungpt · 02-26-2012, 08:48 AM

AllowOverride All|None|directive-type

can you tell me directive-type ?

i want disable AddHandler on .htaccess

lithos · 02-26-2012, 09:45 AM

Hi,

I'm sorry I can't tell you the exact config, but[quote]If AllowOverride is set to AllowOverride All, this tells Apache that it's okay to allow .htaccess files to over-ride previous directives. You must reload Apache before this change will have an effect[quote]

htaccess directives

Quote:

The use of .htaccess files can be disabled completely by setting the AllowOverride directive to none

See below the Server Side Includes example in above linked manual
--> CGI example