Disable CGI from users to run CGI Scripts

[iomega]

Hi.
I installed a direct admin on my server and there is a lot of httpd config file !
I changed the .cgi extension and users couldn't run .cgi file, but they can use this .htaccess code to run cgi with .php extension:

AddHandler cgi-script .php

Anyways, I want to disable cgi from users to running cgi scripts (even like this with .htaccess file) on their hosts.
Please guide me if you have a suggestion.
Thanks a lot guys.
regards.

 

[zEitEr]

Hello,

You probably need to built apache without cgi_module (http://help.directadmin.com/item.php?id=191)

http://httpd.apache.org/docs/current/mod/mod_cgi.html

 

[nobaloney]

When I create a new package I can turn off CGI access. When I set up a new user from a package that has CGI enabled I can still modify the user so CGI is disabled.

Doesn't this work for you?

Jeff

 

[iomega]

Hi

When I create a new package I can turn off CGI access. When I set up a new user from a package that has CGI enabled I can still modify the user so CGI is disabled.

Doesn't this work for you?

Jeff

Thanks for your answer.
But what did you do for disable CGI?
Can you explain it completely for me?
I disabled the cgi-module , but unfortunately It's working !

 

[Mehdi Tamaddon]

Thanks for your answer.
But what did you do for disable CGI?
Can you explain it completely for me?
I disabled the cgi-module , but unfortunately It's working !

HI,
Modify that account and you will see "CGI Access" turn it off (you can set it when you are creating a package too)

 

[iomega]

Hi

HI,
Modify that account and you will see "CGI Access" turn it off (you can set it when you are creating a package too)

Thanks dude.
But where/how can I turn the "CGI Access" off?

 

[Mehdi Tamaddon]

Thanks dude.
But where/how can I turn the "CGI Access" off?

As I said: in "modify user" 'CMD_MODIFY_USER?user=username"

 

[iomega]

Hi

As I said: in "modify user" 'CMD_MODIFY_USER?user=username"

Dear Mehdi,
As I told you I can run CGI-Script with this code in .htaccess file :

AddHandler cgi-script .php

And with doing "disable CGI Access" It wouldn't be disabled.
I want to disable CGI-Access completely for every users and they couldn't run any CGI-Script with something like that code I mentioned above in .htaccess file.
Thanks for your cooperation.
Regards.

 

[Richard G]

Did you try the very first answer you got from Zeiter?

 

[iomega]

bi

Did you try the very first answer you got from Zeiter?

dear Richard.
I rebuilt apache with disable cgi-module like his answer.
But still user can run CGI script with that .htaccess code .
Whats your opinion about this issue?
Thanks again.

 

[Petertjuh360]

Dear Mehdi,
As I told you I can run CGI-Script with this code in .htaccess file :

AddHandler cgi-script .php

And with doing "disable CGI Access" It wouldn't be disabled.
I want to disable CGI-Access completely for every users and they couldn't run any CGI-Script with something like that code I mentioned above in .htaccess file.
Thanks for your cooperation.
Regards.

Why wouldn't it be disabled?

 

[iomega]

Hi

Why wouldn't it be disabled?

Dear guy,
Because of this code in .htaccess file :

AddHandler cgi-script .php

And users can call cgi-handler for running CGI scripts.

 

[zEitEr]

Hello,

Here is what I've tested:


User userbob with disabled CGI:

# grep cgi /usr/local/directadmin/data/users/userbob/user.conf
cgi=OFF

However I'd try to run a cgi script I get either this:

Options ExecCGI is off in this directory: ...

or

... .htaccess: Option ExecCGI not allowed here

So what do I miss?

 

[Petertjuh360]

Dear guy,
Because of this code in .htaccess file :

AddHandler cgi-script .php

And users can call cgi-handler for running CGI scripts.

The server will not let the user execute the CGI script because you disabled it. It will not run even if you add the code to the .htaccess file. Test it yourself.

 

[Richard G]

But still user can run CGI script with that .htaccess code.
Whats your opinion about this issue?

My opinion would be that something must went wrong, I can't reproduce it. I get the same result as Zeiter and Petertjuh.