Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a headless server on Ubuntu 10.x. I am running Apache 2.2.

I am writing a fastcgi application for deployment on the server. I remember reading a while back (I could be wrong) that running CGI (and by implication fastcgi) on a server, can provide 'backdoors' for potential attackers - or at the very least, could compromise the server if certain security measurements are not taken.

My questions are:

  • what are the security 'gotcha's that I have to be aware of if I am enabling mod_fastcgi on my Apache server?
  • I want to run the fastcgi as a specific user (with restricted access) how do I do this?
share|improve this question

migrated from Jan 3 '11 at 11:50

This question came from our site for computer enthusiasts and power users.

Each cgi application needs to be secured in and of itself. The security of Apache with regard to Apache is fine. The 'security problem' of CGI's is that it's extra untested code that runs natively on the host outside of Apache.

What you probably want is peer review of your application.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.