Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a headless server on Ubuntu 10.x. I am running Apache 2.2.

I am writing a fastcgi application for deployment on the server. I remember reading a while back (I could be wrong) that running CGI (and by implication fastcgi) on a server, can provide 'backdoors' for potential attackers - or at the very least, could compromise the server if certain security measurements are not taken.

My questions are:

  • what are the security 'gotcha's that I have to be aware of if I am enabling mod_fastcgi on my Apache server?
  • I want to run the fastcgi as a specific user (with restricted access) how do I do this?
share|improve this question

migrated from superuser.com Jan 3 '11 at 11:50

This question came from our site for computer enthusiasts and power users.

1 Answer 1

Each cgi application needs to be secured in and of itself. The security of Apache with regard to Apache is fine. The 'security problem' of CGI's is that it's extra untested code that runs natively on the host outside of Apache.

What you probably want is peer review of your application.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.