[11117] in bugtraq
Re: Redhat 6.0 cachemgr.cgi lameness
daemon@ATHENA.MIT.EDU (Henrik Nordstrom)
Sun Jul 25 15:19:31 1999
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <379AE239.31CBD584@hem.passagen.se>
Date: Sun, 25 Jul 1999 12:08:57 +0200
Reply-To: hno@HEM.PASSAGEN.SE
From: Henrik Nordstrom <hno@HEM.PASSAGEN.SE>
X-To: daniel@NEWS.GUS.NET
To: BUGTRAQ@SECURITYFOCUS.COM
cachemgr.cgi is the manager interface to Squid web proxy/cache server.
As all manager interface tools access to it SHOULD have restricted
access by default, not open for public access.
If you are not using the box as a Squid www proxy/cache server then
uninstall the package by executing "/etc/rc.d/init.d/squid stop ; rpm -e
squid".
If you are indeed using the Squid proxy server software, then make the
following actions to at least minimally secure access the manager
interface:
mkdir /home/httpd/protected-cgi-bin
mv /home/httpd/cgi-bin/cachemgr.cgi /home/httpd/protected-cgi-bin/
and add the following directives to /etc/httpd/conf/access.conf and
srm.conf
--- start access.conf segment ---
# Protected cgi-bin directory for programs that
# should not have public access
<Directory /home/httpd/protected-cgi-bin>
order deny,allow
deny from all
allow from localhost
#allow from .your_domain.com
AllowOverride None
Options ExecCGI
</Directory>
--- end access.conf segment ---
--- start srm.conf segment ---
ScriptAlias /protected-cgi-bin/ /home/httpd/protected-cgi-bin/
--- end srm.conf segment ---
Then execute "/etc/rc.d/init.d/httpd restart" to reconfigure your Apache
HTTP server to allow localhost access to
http://localhost/protected-cgi-bin/cachemgr.cgi. Change the allow rules
accordingly if you have other stations that need access to the
protected-cgi-bin directory.
You are also recommended to move any other cgi-bin programs not inteded
for public access from /home/httpd/cgi-bin to
/home/httpd/protected-cgi-bin, if you have any.
Disclaimer: Squid does not install cachemgr.cgi in a HTTP accessible
directory by default. It is the administrators responsibility (or in
this case the RedHat package maintainer) to set up proper HTTP access to
it.
--
Henrik Nordstrom
Squid developer & RedHat user
daniel@NEWS.GUS.NET wrote:
>
> Hi... After installing Redhat 6.0, I looked around a bit and I
> noticed something interesting:
> In /home/httpd/cgi-bin there is a CGI program called cachemgr.cgi,
> and it can be accessed by remote users by default.
