I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory located outside of the DocumentRoot (i.e. /usr/lib/cgi-bin/ etc.)

Is this required for security reasons, or is it safe to simply store and run a script (for example, a Perl script containing DBI credentials) in the original cgi-bin of the DocumentRoot? What would be required for this option to be just as secure?

  • I'd also like some clarification on how to setup permissions so that I can be certain someone cannot view a file inside of the DocumentRoot (in a cgi-bin folder). – Jonathan Jun 29 '16 at 4:05

Those credentials have to be placed somewhere. If you decide to place them at a place like /usr/lib/cgi-bin, you'd have to grant your web user access to that directory structure which would in turn make your system more vulnerable.

It is more common to place them one level above the web root as a compromise between the two. This way you don't open much of your machine to a potential intruder while making it less apparent. Do note that less apparent is relative to the intruder as many would figure it's part of an include right away.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.