0

I have some cgi scripts that create dynamic content that we need to password protect. However if I put apache2 authorization requirements on the cgi-bin the authorization dialog pops but behind the dialog the page loads anyway and users can just cancel the authorization dialog and access the cgi script created content. How do I prevent this behavior and force the authorization check before the script executes?

-Thanks

J

1 Answer 1

0

As far as I can tell this is a bug in apache2 module execution priorities. I worked around this by moving the cgi-bin out of the default ubuntu directory /usr/lib/cgi-bin and into the actual website directory /var/www/html/mywebsite/cgi-bin by editing apache2.conf as follows...note /var/www/html/mywebsite is symlinked to /mywebsite:

# Include list of ports to listen on
Include ports.conf


ScriptAlias "/cgi-bin/" "/var/www/html/mywebsite/cgi-bin/"


# Sets the default security model of the Apache2 HTTPD server. It does
# not allow access to the root filesystem outside of /usr/share and /var/www.
# The former is used by web applications packaged in Debian,
# the latter may be used for local directories served by the web server. If
# your system is serving content from a sub-directory in /srv you must allow
# access here, or in any related virtual host.
<Directory />
    Options FollowSymLinks
    AllowOverride None
    AuthUserFile /mywebsite/.htpasswd
        AuthType Basic
        AuthName "from root"
    Require valid-user
</Directory>

<Directory /var/www/html/>
        Options FollowSymLinks
        AllowOverride None
        AuthUserFile /mywebsite/.htpasswd
        AuthType Basic
        AuthName "from var/www/html"
        Require valid-user
</Directory>

#<Directory /usr/share>
#   AllowOverride None
#   Require all granted
#</Directory>

<Directory /var/www/html/mywebsite/cgi-bin/>
    Options Indexes FollowSymLinks ExecCGI
    #AddHandler cgi-script .cgi
    SetHandler cgi-script 
    AllowOverride None
    AuthUserFile /mywebsite/.htpasswd
    AuthType Basic
    AuthName "from cgi-bin"
    Require valid-user
</Directory>



#<Directory /srv/>
#   Options Indexes FollowSymLinks
#   AllowOverride None
#   Require all granted
#</Directory>




# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives.  See also the AllowOverride
# directive.
#
AccessFileName .htaccess

#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<FilesMatch "^\.ht">
    Require all denied
</FilesMatch>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.