[Fwd: Re: Redhat 6.0 cachemgr.cgi lameness]

And here is my answer to the cachemgr.cgi message on BUGTRAQ.

/Henrik

attached mail follows:

cachemgr.cgi is the manager interface to Squid web proxy/cache server.

As all manager interface tools access to it SHOULD have restricted
access by default, not open for public access.

If you are not using the box as a Squid www proxy/cache server then
uninstall the package by executing "/etc/rc.d/init.d/squid stop ; rpm -e
squid".

If you are indeed using the Squid proxy server software, then make the
following actions to at least minimally secure access the manager
interface:

mkdir /home/httpd/protected-cgi-bin
mv /home/httpd/cgi-bin/cachemgr.cgi /home/httpd/protected-cgi-bin/

and add the following directives to /etc/httpd/conf/access.conf and
srm.conf

--- start access.conf segment ---

# Protected cgi-bin directory for programs that
# should not have public access

<Directory /home/httpd/protected-cgi-bin>
order deny,allow
deny from all
allow from localhost
#allow from .your_domain.com
AllowOverride None
Options ExecCGI
</Directory>

--- end access.conf segment ---

--- start srm.conf segment ---
ScriptAlias /protected-cgi-bin/ /home/httpd/protected-cgi-bin/
--- end srm.conf segment ---

Then execute "/etc/rc.d/init.d/httpd restart" to reconfigure your Apache
HTTP server to allow localhost access to
http://localhost/protected-cgi-bin/cachemgr.cgi. Change the allow rules
accordingly if you have other stations that need access to the
protected-cgi-bin directory.

You are also recommended to move any other cgi-bin programs not inteded
for public access from /home/httpd/cgi-bin to
/home/httpd/protected-cgi-bin, if you have any.

Disclaimer: Squid does not install cachemgr.cgi in a HTTP accessible
directory by default. It is the administrators responsibility (or in
this case the RedHat package maintainer) to set up proper HTTP access to
it.

--
Henrik Nordstrom
Squid developer & RedHat user
daniel@NEWS.GUS.NET wrote:
> 
> Hi... After installing Redhat 6.0, I looked around a bit and I
> noticed something interesting:
> In /home/httpd/cgi-bin there is a CGI program called cachemgr.cgi,
> and it can be accessed by remote users by default.