0

My website has several cgi's (executable binaries compiled from C source, in case that matters) that work fine when run from a browser as, e.g.,
      http://mydomain.com/cgi-bin/myprog.cgi
But if I put a symlink to myprog.cgi in cgi-bin/ like
      cd   cgi-bin/
      ln   -s   myprog.cgi   proglink.cgi
then trying to run
      http://mydomain.com/cgi-bin/proglink.cgi
from a browser generates a 500 error.

My .htaccess has
      AddHandler cgi-script .cgi
      Options +ExecCGI +FollowSymLinks -Indexes
(and I'd also tried +SymLinksIfOwnerMatch, both with and without +FollowSymLinks alongside it), but that doesn't seem to work.

Edit I should mention (thanks to @slm's suggestion in comments below) that the site already has symlinks to .php scripts, which have been working fine for years. (Those php scripts do a $_SERVER['PHP_SELF'], returning the name of the symlink, and that all works without any problem.) But now the symlink to an executable image .cgi fails as described above.
      I probably also should mention that this site is on a shared host (cheap dreamhost.com shared hosting).

Googling the problem seems to suggest nothing will work, and that apache simply won't execute a cgi pointed to by a symlink. Is that googling right, or is there some way to run cgi's following a symlink? If it is right, and I can't do that no-way/no-how, let me describe below why I want to do it, and then hopefully you can suggest an alternative strategy that works and that accomplishes the same overall purpose...


...So this is where the security Tag below comes in. Some of those cgi's had been the target of ddos attacks to my site (though God knows, or maybe He doesn't, why anybody would bother with my site, which has absolutely nothing of any value). So I added some code to each cgi (pretty much the same code to each) to validate its ?query_string, and assign it a "likelihood-of-attack" score. With a small score the cgi just ignores the request, and with a larger score the user's ipaddr=getenv("REMOTE_ADDR"), is automatically appended to .htaccess with a "deny from". And also various in-between actions, like emailing me about the situation.

So this has become lots of lines of code. And rather than individually compiling it into each cgi, I wanted (and still want) to write a front-end query-validation that does it once-and-for-all. Then, if everything's okay, it issues a system() call to run the requested cgi. So I wrote a short little test program that just indirectly runs a cgi by issuing a system() call, and that indeed works okay.

The symlink issue now comes in because, in the general case, that front end has to be able to run many different cgi's, and therefore needs to know which cgi to run. And by symlink'ing each cgi name to that front-end cgi, it could parse out getenv("SCRIPT_NAME"), which would give it the symlink name, thereby identifying the particular cgi issuing the request. Kind of like php $_SERVER['PHP_SELF']. So symlinks seem like the neatest and easiest solution. But if that's not feasible with apache/.htaccess, then can you suggest some other method to accomplish the same purpose?

  • I haven't used it myself, but maybe you could try ModSecurity. It's intended to allow you to log or deny suspicious looking traffic. Here's a repository full of existing rules. – Nick ODell Jul 14 '18 at 16:53
  • @slm Thanks, the directory's already chmod 755, and stuff in it can already be accessed from a browser without any problem. So I'd think access/permissions are already okay, but I don't really know enough about apache, etc, to be sure. Are you suggesting some additional lines in the main directory's .htaccess, a separate .htaccess in the subdirectory, or something else? Thanks. – John Forkosh Jul 14 '18 at 17:04
  • @NickODell Thanks, I took a look at your github link. Looks to me like that modsecurity stuff has to be installed. I probably should have mentioned I'm on a shared host (cheap dreamhost.com shared hosting). So I don't think modsecurity's an option in my case (and it wasn't entirely clear to me whether or not it would solve the problem). – John Forkosh Jul 14 '18 at 17:08
  • Do you allow overrides? superuser.com/q/244245/20568 – slm Jul 14 '18 at 17:09
  • Also is SELinux enabled or disabled? serverfault.com/q/773263/2518 – slm Jul 14 '18 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.