cgi-bin, bash scripts and security

[blastman]

Hi chaps,

I have a website which when you fill in a form, fires a bash script located in the cgi-bin folder to do some stuff.

My question is, how can i lock the script down, so that it can't be run unless your logged into the site?

script location: /var/www/cgi-bin/script
website: /var/www/website1/public_html/

Now, I'm thinking that since the cgi-bin folder is higher up in the folder structure than the site it's self am I right that you couldn't access it via a url anyway?

I'm already doing a check for inappropriate input from the user BEFORE the script is fired in an effort to stop any bash/mysql injection, but I'd like to beef up my security, just in case.

Any thoughts?

thanks in advance

 

[blastman]

thanks for the reply.

I will look into adding the apache user into a new 'web' group, then only allow root and web to excute the file. that should help.

I'll then see if I can query mysql to see when the user who is running the script (username already being passed over) last logged on and if older than 20 minutes, log and fail to run.

I'll have to set all sessions to expire after 15 minutes, but that should cover it.

thanks.