Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

First, I can't believe that that isn't the default behavior. Second, yikes! I don't know how long my code's been hanging out there, with all sort of cool secret stuff, just waiting for some hacker who knows Apache better than I do.

share|improve this question
    
You have non-executable source code files in your ExecCGI directory why? –  Chris S Feb 7 '11 at 20:16
    
More info needed. What OS are you running on? How was apache installed/configured (straight from a repo with apt/yum/similar, or downloaded and installed by other means). Is the content visible via the web server or just to local users (are people able to see it with a http:// URL in a browser or with an ls command? –  David Spillett Feb 7 '11 at 20:17

2 Answers 2

You should add -Indexes to disallow showing your CGI directory index:

Options +ExecCGI -Indexes

share|improve this answer
1  
+1 We use Options None +ExecCGI, but yours works too for denying directory listing. –  Chris S Feb 7 '11 at 20:19

To make this useful for future viewers (since @Community bumped it anyhow), I'll answer with the relevant bits of what OP (who hasn't been here since January 20th) edited into the question.


Here's what happened:

We had some Python scripts available to the web, at /aux/file.py, which were not surprisingly at /var/www/http/aux . Separately, we were running an app server and Apache proxies through at /servlets/. A contractor had constructed the WAR file by bundling up all the generated files including the Python files (which are in a directory also called aux, not surprisingly), so if you typed in /servlets/aux/file.py, the web-server would ask the app-server for it and the app-server would just supply the file. It was the latter URL that this morning I happened to type in by accident and lo, the source appeared.

Until I realized the shear unlikelihood of what I had done, the situation was rating about 8.3 on the sphincter scale. After a tense half-hour or so I realized that it had nothing to do with the CGI (and that serving files that were also executable would be not only foolish but also impossible), and was able to address the real problems.


share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.