--On Sunday, December 08, 2002 19:39:59 +0000 jbv <[EMAIL PROTECTED]> wrote:
There is no such thing, I usually put it in the cgi-bin directory with the scripts but it can be anywhere as long as you specify the path in the script. You can rename it if you wish.Pierre,It's, basicaly, two ways you can install mc to have it running behind Apache. 1.- As a simple cgi engine : just drop the mc engine where you want (but not in a directory where any bad guy will expect to find it) and add the right path head your mc-cgi scripts, alike "#!/the path/mc". Verify that the right permissions are ok to let the cgis lauchables by the mc engine and it will be ok.That's what has been done (AFAIK) and it works OK. Although your comments raise a few important questions that I'll have to discuss with the UNIX guy : - what is the best directory to drop the mc engine so that no bad guy finds it ?
- and what can happen if any bad guy finds it ?
Nothing, he never heard of it, only good people know Metacard;-).
No. Usually bad guys don't think of something called mc as something to play with and judging from the logs of the servers I service *all* bad guys look for a directory structure specific to windows NT not Linux.- is there anything specific that can be done (by a bad guy) with MC as a simple cgi engine that can't be done with a php or perl engine ?
- does it have to do with the presence of a "wrapper" (I've seen that word at times in articles / discussions about cgi engines) ? - are there any safety measures to take to prevent that ?
No
Just add .cgi sufix to scripts to avoid changes to Apache config file and make sure scripts are executables.And as for permissions : I know that the right permissions have to be set to mc-cgi scripts and text files used by those scripts, but have the feeling that there must be some specific other permissions to set in the Apache configuration to allow mc-cgi scripts to be triggered by external requests... If yes, can those permissions be set for one domain name only ?
More on this issues, please... Thanks a lot, JB _______________________________________________ metacard mailing list [EMAIL PROTECTED] http://lists.runrev.com/mailman/listinfo/metacard
Regards, Andu Novac _______________________________________________ metacard mailing list [EMAIL PROTECTED] http://lists.runrev.com/mailman/listinfo/metacard
