Yes, it should be removed on a production system - unless (of course) you are actually using it. If you're not sure, it probably means that you're not using it.
Here is why: With this configuration, cgi-bin/
points to /usr/lib/cgi-bin
and whatever is in there can be executed. It's a system directory, so what's in there usually depends on what you've installed using the system's package management system. Any software with a web interface (like some sort of monitoring or management software) might have a cgi script file there. This means that simply installing such a program is enough so that ANYONE who has access to this web server (in the case of a public web server: everyone) can access that web interface.
Suppose you've just installed some sort of system management software which has a web interface, in the shape of a cgi file in /usr/lib/cgi-bin
and it has something like "1234" as default password. To make things worse, this is on a public web server. Now, everyone can open http://www.yourserver.com/cgi-bin/foowebadmin
, log in using "1234" and change the system configuration of your PRODUCTION server.
Of course, if you're using this feature on purpose, you will have taken care of proper security/authentication and so on, everything will be fine.