Re: [WEB400] AWSTATS Vulnerability!

[Joel Cochran <jrc@xxxxxxxxxx>]

On Tue, 2005-02-08 at 18:14, Jim Franz wrote:
> Joel (and others):
> Is there some source (book, website, or this list) that could point us to 
> what to lock down for a "generic install " of Apache created with the 
> i5 http admin wizard. I bought the Apache 2.0 book recommended in 
> other posts, which is pretty deep.

Apache is pretty locked down in its default state.  You have to actually
allow access to what you want, so it is an inclusive model instead of an
exclusive model.

The problem that I reported earlier in the week was only possible
because I (naturally) allowed my cgi-bin directory to execute scripts. 
One of the scripts installed in that directory had a security hole that
allowed a remote user to execute system commands.  Obviously, that has
since been corrected.

> For an rpg pgmr, what do we need to do (if anything) to a default server
> w/rpg cgi and perhaps net.data? I've run the Orginal server for years
> with no problems, and recently moved to Apache and V5r3. 

I don't think there is anything specific you have to do, just be
cautious in what you intentionally open up to the world.

Joel Cochran