Restricting access to CGI scripts
There are a few things you should do before telling others about remstats.
Remstats comes with a few CGI scripts which you probably don't want to make
publicly available and two that you certainly don't. ping.cgi
,
traceroute.cgi
and whois.cgi
should probably be restricted to your
own organization, unless you don't mind letting anyone on the Internet run
pings, traceroutes and whois queries from your domain. Rectricted to your
domain, you only have to worry about your own people.
However, alert.cgi
and log-event.cgi
are a different kettle of fish.
They will permit anyone who can run it to quench alerts and log comments
about them. You will probably want to be a bit more restrictive about
who you let run this.
Using the apache web-server, you can restrict
the use of these CGIs using a .htaccess
file something like this:
# Note that this example uses the private network 192.168.0.0.
# Stuff to make Apache expire the files to get them refreshed
ExpiresActive on
# images every 5 minutes, when the data gets updated
ExpiresByType image/gif M300
ExpiresByType image/png M300
# html every day
ExpiresByType text/html M300
# What to allow
Options ExecCGI FollowSymlinks Indexes
<Files "^(whois.cgi|traceroute.cgi|ping.cgi)$">
order deny,allow
deny from all
allow from 192.168. 127.0.0.1
</Files>
<Files "^(alert.cgi|log-event.cgi)$">
order deny,allow
deny from all
allow from 192.168.20.1 192.168.23.3
</Files>
# How they're allowed in
order deny,allow
allow from all
I won't claim the IP#-based access-control is completely safe, but it's
easy and keeps out casual browsers. If you really need to keep
this information safe, use a secure web-server, say apache with mod_ssl.
If that's not good enough, you ought to consider whether this stuff
really belongs on a network at all.
Last updated Thu Mar 17 16:59:12 UTC 2005 by <thomas.erskine@sourceworks.com>.
[