Running CGI scripts under the remstats tree
You also may need to tell your web-server that xxx.cgi
means that this
file is a CGI script and needs to be run, instead of just displayed. With
the apache web-server, you could add the following
lines to the httpd.conf
file:
<Directory /var/lib/remstats/cgi>
Options FollowSymlinks ExecCGI
AddHandler cgi-script .cgi
</Directory>
and
ScriptAlias /remstats/static /var/lib/remstats/cgi-static
<Directory /var/lib/remstats/cgi-static>
Options FollowSymlinks ExecCGI
</Directory>
Restricting access to CGI scripts
[You should also look at the access config-file.]
There are a few things you should do before telling others about remstats.
Remstats comes with a few CGI scripts which you probably don't want to make
publicly available and two that you certainly don't. ping.cgi
,
traceroute.cgi
and whois.cgi
should probably be restricted to your
own organization, unless you don't mind letting anyone on the Internet run
pings, traceroutes and whois queries from your domain. Rectricted to your
domain, you only have to worry about your own people.
However, alert.cgi
and log-event.cgi
are a different kettle of fish.
They will permit anyone who can run it to quench alerts and log comments
about them. You will probably want to be a bit more restrictive about
who you let run this.
Using the apache web-server, you can restrict
the use of these CGIs using a .htaccess
file something like this:
# Note that this example uses the private network 192.168.0.0.
# Stuff to make Apache expire the files to get them refreshed
ExpiresActive on
# images every 5 minutes, when the data gets updated
ExpiresByType image/gif M300
ExpiresByType image/png M300
# html every day
ExpiresByType text/html M300
# What to allow
Options ExecCGI FollowSymlinks Indexes
<Files "^(whois.cgi|traceroute.cgi|ping.cgi)$">
order deny,allow
deny from all
allow from 192.168. 127.0.0.1
</Files>
<Files "^(alert.cgi|log-event.cgi)$">
order deny,allow
deny from all
allow from 192.168.20.1 192.168.23.3
</Files>
# How they're allowed in
order deny,allow
allow from all
I won't claim the IP#-based access-control is completely safe, but it's
easy and keeps out casual browsers. If you really need to keep
this information safe, use a secure web-server, say apache with mod_ssl.
If that's not good enough, you ought to consider whether this stuff
really belongs on a network at all.
[