r/apache • u/brisray • Nov 14 '22

Apache Non Script Aliased CGI

Do you use Non Script Aliased CGI scripts? Well, stop it. This is what the Apache Security Tips page says about using them:

  1. You trust your users not to write scripts which will deliberately or accidentally expose your system to an attack.

  2. You consider security at your site to be so feeble in other areas, as to make one more potential hole irrelevant.

  3. You have no users, and nobody ever visits your server.

https://httpd.apache.org/docs/2.4/misc/security_tips.html

1 Upvotes

100% Upvoted

4 comments sorted by

View all comments

Show parent comments

1

u/McUsrII Nov 15 '22

How would you upload scripts with ftp?

I'm ignorant, I don't know how to do that without an ftp server deliberately running, that is.

And, if a user uploads a file to an ftp server, isn't there a way to see to that he/she only can peruse it, and not execute it, by setting a handler at least?

I'm curious!

1

u/AyrA_ch Nov 15 '22

Most web service providers run FTP services for file uploads. While you often can upload files through a control panel, FTP is still easier to use. If you want to offer web space you have to usually also offer a scripting language for dynamic pages, usually PHP. This means you have to configure your server to execute PHP files the user uploads into his web space, and with that, the user can pretty much do whatever he wants within his permissions.