Prevent cgi/perl scripts to be executed

0
votes

Last week a server was hacked by uploading a perl script. An uploaded .htaccess made it possible to run that perl-script (AddHandler cgi-script and Options +ExecCGI).

Is there a solution that +ExecCGI cannot be set through .htaccess? Options and AddHandlers disabling alltogether is not a solution (used on other sites with other Handlers/Options)

Another thing to solve it: Allow only specific-files (formail.cgi, awstats.pl) to be executed by CGI (specified in httpd.conf) Is this in someway possible?

1
.htaccesscgihttpd.conf

1 Answers

0
votes

If figured it out myself (RTFM!)

This line in http.conf will stop enabling ExecCGI by an .htaccess-file:

AllowOverride AuthConfig FileInfo Indexes Limit Options=FollowSymLinks,Includes,IncludesNOEXEC,Indexes,SymLinksIfOwnerMatch