Skip to main content
Mapagam

Managing CGI Script Execution

1. Enabling CGI Module

Directive Default Description
ScriptAlias /cgi-bin/ Maps a URL prefix to a directory containing CGI scripts
ScriptAliasMatch None Maps a URL prefix to a directory using a regular expression
Options None Enables or disables specific features for a directory, including ExecCGI

Example: Enabling CGI in a Directory

<Directory "/var/www/cgi-bin">
    Options +ExecCGI
    AllowOverride None
    Require all granted
</Directory>

Example: Setting Up ScriptAlias

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
    Options +ExecCGI
    AllowOverride None
    Require all granted
</Directory>
Note: The ExecCGI option must be set in the directory containing CGI scripts to allow execution.

2. Configuring ScriptAlias Directory

Directive Values Description
ScriptAlias /cgi-bin/ or /scripts/ Maps a URL path to a directory containing CGI scripts
ScriptAliasMatch /cgi-bin/.*\.pl$ Maps URLs matching a regex pattern to a directory

Example: ScriptAlias Configuration

<Directory "/usr/local/cgi-bin">
    AllowOverride None
    Options +ExecCGI
    Require all granted
</Directory>

ScriptAlias /cgi-bin/ /usr/local/cgi-bin/
Note: Ensure the directory has proper permissions to execute scripts and is not accessible via regular web browsing.

3. Setting CGI Directory Location

Directive Default Description
ScriptAlias /cgi-bin/ Maps a URL prefix to a directory on the filesystem where CGI scripts are located
ScriptAliasMatch None Similar to ScriptAlias but uses a regular expression to match URLs

Example: Setting CGI Directory Location

ScriptAlias /cgi-bin/ /usr/local/cgi-bin/
<Directory "/usr/local/cgi-bin">
    AllowOverride None
    Options +ExecCGI
    Require all granted
</Directory>
Note: The Options +ExecCGI directive is required to allow execution of CGI scripts in the specified directory.

4. Using AddHandler for CGI Scripts

Directive Values Description
AddHandler cgi-script Associates a file extension or pattern with the CGI script handler

Example: Configure .cgi files to be executed as CGI scripts

AddHandler cgi-script .cgi

Example: Execute all files with .pl extension as CGI scripts

AddHandler cgi-script .pl
Note: The ScriptAlias directive is often used in conjunction with AddHandler to map URL paths to filesystem directories containing CGI scripts.
Warning: Ensure that the directory containing CGI scripts has proper permissions to allow execution by the web server process. Misconfigured permissions can lead to security vulnerabilities or script failures.

5. Configuring Script Permissions

Directive Description Default Notes
ScriptAlias Maps a URL to a directory of CGI scripts None Must be used with ScriptAlias to define the directory path
ScriptAliasMatch Maps a URL pattern to a directory of CGI scripts using regex None Allows for dynamic mapping based on URL patterns
Options Controls server behavior for a directory None Must include ExecCGI to allow CGI execution
AllowOverride Controls which directives can be overridden in .htaccess files None Must include Options and ExecCGI to allow CGI in .htaccess

Example: ScriptAlias with Permissions

<Directory "/usr/local/cgi-bin">
    Options +ExecCGI
    AllowOverride None
    Require all granted
</Directory>

ScriptAlias /cgi-bin/ /usr/local/cgi-bin/
Note: The Options +ExecCGI directive is essential to enable CGI script execution in the specified directory.
Warning: Ensure that CGI scripts are properly secured and do not expose sensitive system information or allow arbitrary code execution.

6. Setting Script Timeout

Directive Values Description
ScriptTimeout seconds Sets the maximum time (in seconds) that a CGI script is allowed to run before it is terminated.

Example: Setting Script Timeout

<IfModule mod_cgi.c>
    ScriptTimeout 30
</IfModule>
Note: The ScriptTimeout directive is available in Apache 2.4.51 and later versions.

7. Using FastCGI

FastCGI is a protocol that allows web servers to execute scripts written in any language, providing better performance and resource management compared to traditional CGI. It is particularly useful for applications written in languages like Python, Perl, or PHP that need to run efficiently under high load.

Directive Description Default Value Notes
FastCgiConfig Configures default FastCGI settings for all FastCGI scripts. None Can be overridden per-script using FastCgiScript.
FastCgiScript Maps a URL path to a FastCGI script. None Must point to an executable file or a script handler.
FastCgiServer Defines a FastCGI server to which requests are forwarded. None Allows specifying the socket or host/port for FastCGI processes.

Example: Setting up FastCGI with Python

# Define a FastCGI server
FastCgiServer /usr/lib/cgi-bin/myapp.fcgi

# Map a URL to the FastCGI script
ScriptAlias /myapp/ /usr/lib/cgi-bin/myapp.fcgi
Note: FastCGI scripts must be executable and properly configured to handle HTTP requests. Ensure that the server has appropriate permissions to execute these scripts.
Warning: Misconfiguring FastCGI can lead to performance issues or security vulnerabilities. Always validate your configuration and test in a development environment before deploying to production.

8. Configuring CGI Environment Variables

Variable Description Default Value Notes
SERVER_NAME Server's hostname or IP address localhost Used for generating URLs
SERVER_PORT Port number the server listens on 80 Typically 80 or 443 for HTTPS
REQUEST_METHOD HTTP method used (GET, POST, etc.) GET Used to determine how to process the request
QUERY_STRING Query string part of the URL empty Includes the '?' character if present
PATH_INFO Additional path information after the script name empty Used for routing within scripts
SCRIPT_FILENAME Full path to the CGI script being executed not set Set by the server automatically
CONTENT_TYPE Content type of the request body not set Only available for POST requests
CONTENT_LENGTH Length of the request body in bytes 0 Set to 0 if no content

Example: Setting Custom CGI Environment Variables

<IfModule mod_cgi.c>
    SetEnv CGI_CUSTOM_VAR "custom_value"
    SetEnv CGI_USER_ID "12345"
</IfModule>
Note: Environment variables set via SetEnv are passed to all CGI scripts. For more granular control, use SetEnvIf to conditionally set variables based on request properties.
Warning: Be cautious when setting sensitive data in environment variables as they can be exposed through debugging tools or logs.

9. Debugging CGI Scripts

Directive Description Default Notes
ScriptLog Specifies the path to the CGI script error log file. None Used for logging errors from CGI scripts. Requires ScriptLog to be set in the configuration.
ScriptLogFormat Defines the format of entries in the CGI script error log. %t %h %{SCRIPT_FILENAME}e %{REQUEST_URI}e %{QUERY_STRING}e Allows customization of log format for debugging.

Example: Enabling CGI Script Logging

<IfModule mod_cgi.c>
    ScriptLog /var/log/apache2/cgi_error.log
    ScriptLogFormat "%t %h %{SCRIPT_FILENAME}e %{REQUEST_URI}e %{QUERY_STRING}e"
</IfModule>
Note: Ensure that the log file path has appropriate permissions for the Apache user to write to it.

Debugging Steps for CGI Scripts

  1. Enable ScriptLog to capture errors from CGI scripts.
  2. Check the ScriptLog file for error messages related to script execution.
  3. Verify that the CGI script has proper permissions (e.g., chmod +x) to be executed.
  4. Ensure that the script's shebang line (e.g., #!/usr/bin/perl) is correct and executable.
  5. Use ScriptLogFormat to capture more context, such as the script path and query string.

10. Securing CGI Execution

Note: CGI scripts are inherently less secure than server-side includes or modules. Always follow security best practices when executing CGI scripts.
Directive Description Default Notes
ScriptAlias Maps a URL to a directory of CGI scripts None Must be used with ScriptAliasMatch for pattern matching
ScriptAliasMatch Maps a URL pattern to a directory of CGI scripts None Allows regex-based matching for URL paths
Options Enables or disables features for a directory None Must include ExecCGI to allow CGI execution

Example: Securing CGI Execution with ScriptAlias

<Directory "/var/www/cgi-bin">
    Options +ExecCGI
    AllowOverride None
    Require all granted
</Directory>

ScriptAlias /cgi-bin/ /var/www/cgi-bin/

Example: Using ScriptAliasMatch for Pattern Matching

<Directory "/var/www/cgi-bin">
    Options +ExecCGI
    AllowOverride None
    Require all granted
</Directory>

ScriptAliasMatch ^/cgi-bin/(.*\.pl)$ /var/www/cgi-bin/$1
Warning: Never allow CGI execution in directories where users can upload files. This can lead to arbitrary code execution.

Security Best Practices

  • Use ScriptAlias or ScriptAliasMatch to map specific directories for CGI scripts
  • Ensure Options +ExecCGI is set only in directories where CGI scripts are allowed
  • Restrict access to CGI directories using AllowOverride and Require
  • Validate and sanitize all input to CGI scripts
  • Use mod_security or similar modules for additional protection

11. Testing CGI Scripts

Command Description Example
cgi-script Path to the CGI script /var/www/cgi-bin/hello.cgi
httpd -t Test configuration syntax httpd -t
CGI script permissions Must be executable chmod +x /var/www/cgi-bin/hello.cgi

Example: Testing CGI Script

#!/bin/bash
# Test script for CGI execution
echo "Content-Type: text/html"
echo ""
echo "<html><body><h1>Hello from CGI!</h1></body></html>"
Note: Ensure the script has proper shebang line and executable permissions.
Warning: CGI scripts must be placed in a directory with Options +ExecCGI enabled.

12. Troubleshooting CGI Errors

Error Type Description Common Causes Solution
500 Internal Server Error Generic server error, often due to script issues or misconfigurations.
  • Script permissions not set correctly
  • Missing shebang line
  • Script syntax errors
  • Ensure script is executable (chmod +x)
  • Add proper shebang line (e.g., #!/usr/bin/perl)
  • Check script for syntax errors
403 Forbidden Access denied to the CGI script or directory.
  • Directory permissions do not allow execution
  • Script is not in a CGI-enabled directory
  • Set proper permissions on the directory (AllowOverride All)
  • Ensure script resides in /cgi-bin/ or another CGI-enabled path
404 Not Found CGI script not found or path is incorrect.
  • Incorrect path in ScriptAlias
  • Typo in script name
  • Verify ScriptAlias directive matches actual script location
  • Confirm file name and path

Example: Debugging a 500 Error

#!/bin/bash
# Check permissions and shebang line
ls -l /var/www/cgi-bin/my_script.pl
head -n 1 /var/www/cgi-bin/my_script.pl
Note: Enable ErrorLog and LogLevel debug in Apache config to get detailed error logs.
Warning: Never expose sensitive paths or debug information in production environments.

Was this article helpful?

Related Cheat Sheets