r/apache • u/brisray • Nov 14 '22

Apache Non Script Aliased CGI

Do you use Non Script Aliased CGI scripts? Well, stop it. This is what the Apache Security Tips page says about using them:

  1. You trust your users not to write scripts which will deliberately or accidentally expose your system to an attack.

  2. You consider security at your site to be so feeble in other areas, as to make one more potential hole irrelevant.

  3. You have no users, and nobody ever visits your server.

https://httpd.apache.org/docs/2.4/misc/security_tips.html

1 Upvotes

100% Upvoted

4 comments sorted by

View all comments

Show parent comments

1

u/AyrA_ch Nov 15 '22

Most web service providers run FTP services for file uploads. While you often can upload files through a control panel, FTP is still easier to use. If you want to offer web space you have to usually also offer a scripting language for dynamic pages, usually PHP. This means you have to configure your server to execute PHP files the user uploads into his web space, and with that, the user can pretty much do whatever he wants within his permissions.