Good evening ,

can someone please tell me how can I stop CGI/Perl shell scripts on my server?


Regards

For PHP shells, you can use open_basedir and restrict them to their home directories. That alone should be sufficient. Additionally, you can switch on safe mode. And lastly, if your permissions are down right, you can also run phpsuexec and limit them further.

For CGI shells, you can jailroot Apache. You must switch on suexec too, and make sure you set the right permissions.

delete perl ? :D

Thanks man , but could you please explain how to do all this? sorry but I'm a newbie:rolleyes:

For CGI shells, you can jailroot Apache. You must switch on suexec too, and make sure you set the right permissions

This is a good idea, though no simple task. Though, unfortunately, it also does not guarantee anything as it can be trivial to work around the jail.

The only real answer is to enable a CGI Wrapper (e.g. SuExec) and set your *nix directory and file permissions correctly.

If your intention is to all-out stop them, just remove mod_cgi from your apache (and any associated entries in your httpd.conf).

always search in your server for *.pl files this for perl and cgi ..
and phpshell you can stop with turn on the safe mode in php.ini

Reqards,

always search in your server for *.pl files this for perl and cgi

Will achieve little. It would be easy to hide the code in a script - you don't want to spend your whole day debugging perl scripts do you?

Originally posted by chirpy
The only real answer is to enable a CGI Wrapper (e.g. SuExec) and set your *nix directory and file permissions correctly. [/B]


SuExe already enabled, how to set the *nix directory and file permission ?

I found some server running

PHP Safe Mode OFF
No open_basedir on httpd.conf

Still can't browse through /home directory.

Hope this done through Permission settings, How i do this ?

Originally posted by chirpy
Will achieve little. It would be easy to hide the code in a script - you don't want to spend your whole day debugging perl scripts do you?

Yeah, and also they aren't necessarily .cgi or .pl, they could be anything in the cgi-bin directory that is executable.