Should apache ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ line be removed in production?

Question

Here is the part of my current apache config that refers to cgi-bin stuff. This info was included in the default configuration in debian. Should this be removed on a live/production machine?

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

Answer 1

If you're not running any CGI from /usr/lib/cgi-bin/, then it's unnecessary. That said, it's a production machine, so tread carefully.

Answer 2

Personally I always remove the default vhost that comes with debian from the sites-enabled directory. I also replace the apache.conf with something that is sensible for our environment.

Those a are config files and dpkg (backend to apt-get) should expect them to be changed. Tools like puppet run apt-get in a way that will keep the "old config" in case a package updates it's configuration, and if you run apt-get interactively it will ask you what to do if it detects a change in the configuration files.

That is any change not just a conflict that can't be merged automagically. After all even if it could be merged it could yield some configuration you don't really want in your system.

To break of a flamewar (sorry, that should really be discussed elsewhere but I just need to say it): My opinion is that even upon installing a daemon it must not be started automatically. For any decent site the default config is almost always wrong. (Yes I know that I can set dpkg options so that it won't be started, I'd rather like it to be the default)