On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

Question

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory located outside of the DocumentRoot (i.e. /usr/lib/cgi-bin/ etc.)

Is this required for security reasons, or is it safe to simply store and run a script (for example, a Perl script containing DBI credentials) in the original cgi-bin of the DocumentRoot? What would be required for this option to be just as secure?

Answer 1

Those credentials have to be placed somewhere. If you decide to place them at a place like /usr/lib/cgi-bin, you'd have to grant your web user access to that directory structure which would in turn make your system more vulnerable.

It is more common to place them one level above the web root as a compromise between the two. This way you don't open much of your machine to a potential intruder while making it less apparent. Do note that less apparent is relative to the intruder as many would figure it's part of an include right away.