-2

I have a simple home web server set up with Apache, but I would rather not have to install and use PHP. I was looking into scripting to deal with the basic dynamic portions of my website. However, I've heard it can be inefficient/unsafe to use bash/shell scripts in the cgi-bin directory for these purposes.

What security risks will I face using bash scripts to process POST data from an input field? What other attacks might I face if I decide to use shell scripts for my website? How can I mitigate these risks?

Is there a better way to safely and efficiently build a dynamic website? Should I not use the cgi-bin directory, and if not, what are the benefits/risks of the alternatives?

5
  • 5
    "... using bash scripts to process POST data ..." ... There is not enough snark in the world... Feb 16, 2012 at 3:08
  • 3
    Can you elaborate on why you'd rather do something horridly ill-advised rather than just spending 5 minutes setting up PHP?
    – ceejayoz
    Feb 16, 2012 at 3:19
  • Why not save time and post your root password on the web page. In the end it will have about the same effect. Feb 16, 2012 at 4:13
  • Haha ok I get the picture. I suspected as much. I don't know why the question was voted down though, especially as this should be a good warning to anyone thinking of trying this (which I haven't- I posted it because there didn't seem to be much material about how stupid this can be).
    – Dennis
    Feb 16, 2012 at 6:16
  • 1
    That will because home web servers are off-topic on ServerFault and some people choose to downvote rather than flag.
    – Ladadadada
    Feb 16, 2012 at 7:29

2 Answers 2

1

For a serious answer, using shell scripts to parse even the simplest web requests is ill-advised to say the least. Shell script tends to mix up running code and input in too many different ways. The performance for any non-trivial amount of traffic may become a problem, as big scripts usually spawn many subshells and programs.

Furthermore, there are no serious Bash web libraries to speak of.

I recommend using Perl or PHP for that purpose.

1
  • I can't recommend Perl these days, unless most of the solution already exists and it's just a matter of including the correct library and running one function from it. Although that doesn't necessarily mean that I'd recommend PHP in it's place. Feb 16, 2012 at 5:08
1

Actually, Openwrt project (https://openwrt.org/) uses in it's "whiterussian" branch (I don't know if it's the case in newer branches) Bash for serving dynamic content (web administration panel). Please remember though that it's firmware for embedded system (Linksys routers) so there is usually no resources (memory) to install anything more sophisticated (PHP).

Also such administration panels are (or at least should be) available only from internal network so the application isn't exposed for public (untrusted) input.

In other cases (especially in PC environment) it's really hard to justify using Bash for serving dynamic web content.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .