Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here is the part of my current apache config that refers to cgi-bin stuff. This info was included in the default configuration in debian. Should this be removed on a live/production machine?

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
share|improve this question

2 Answers 2

If you're not running any CGI from /usr/lib/cgi-bin/, then it's unnecessary. That said, it's a production machine, so tread carefully.

share|improve this answer

Personally I always remove the default vhost that comes with debian from the sites-enabled directory. I also replace the apache.conf with something that is sensible for our environment.

Those a are config files and dpkg (backend to apt-get) should expect them to be changed. Tools like puppet run apt-get in a way that will keep the "old config" in case a package updates it's configuration, and if you run apt-get interactively it will ask you what to do if it detects a change in the configuration files.

That is any change not just a conflict that can't be merged automagically. After all even if it could be merged it could yield some configuration you don't really want in your system.

To break of a flamewar (sorry, that should really be discussed elsewhere but I just need to say it): My opinion is that even upon installing a daemon it must not be started automatically. For any decent site the default config is almost always wrong. (Yes I know that I can set dpkg options so that it won't be started, I'd rather like it to be the default)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.