Very Computer

How in Apache do I restrict access to cgi scripts?

I had assumed the system was the same as for HTML...ie use Limit and deny
access for everyone to that directory, then enable access for the domains
who should be able to get in...

However, it seems that cgi in those directories can still be
executed...can anyone help?

I'm sure the answer is simple, but i've looked in the horse book and thats
made things no clearer...

thanks

pls email replies

<Directory /usr/local/etc/httpd/cgi-bin>
Options FollowSymLinks
AuthName Optix
AuthType Basic
AuthUserFile /usr/local/etc/optix/conf/passwd
AuthGroupFile /usr/local/etc/optix/conf/groups
require valid-user
</Directory>

Now a user will have to have a valid username and password in
/usr/local/etc/optix/conf/passwd to run a CGI in
/usr/local/etc/httpd/cgi-bin

See the man pages for this directive as well as the Auth stuff and the
require directive.  It's really very easy and can be used with HTML, too.

---------------------------------------------------------------------
Thad Humphries                   "Who is this that darkens my counsel
Software Engineer (aka, Nerd)     With words without knowledge?"
Phone: 540/675-3015, ext. 225                         - Job 38:1, NIV

If you put your access control directives inside of a, for example,
Limit GET, then you would still be allowing POST requests to go
through. This may cause what you are seeing.

Yes, there are specific instances where Limit is needed. In the
general case it is not what you want.
--
XCOMM Kevin P. Neal, Junior, Comp. Sci.     -   House of Retrocomputing


XCOMM "Good grief, I've just noticed I've typed in a rant. Sorry chaps!"