Exclude working directory from library path (CVE-2016-1238)

[git.ikiwiki.info.git] / doc / tips / dot_cgi.mdwn

diff --git a/doc/tips/dot_cgi.mdwn b/doc/tips/dot_cgi.mdwn
index dc88d9595ae838a31d2f00ec9e233e07949631f7..8667fed41f76de8242d3d90ead89f88ba4fdd14c 100644 (file)
--- a/doc/tips/dot_cgi.mdwn
+++ b/doc/tips/dot_cgi.mdwn
@@ -1,3 +1,5 @@
+[[!meta date="2009-01-12 20:01:03 -0500"]]
+

 It's common to name the [[cgi]] "ikiwiki.cgi", and put it somewhere
 like `~/public_html/ikiwiki.cgi`, or `/var/www/wiki/ikiwiki.cgi`.
 
 It's common to name the [[cgi]] "ikiwiki.cgi", and put it somewhere
 like `~/public_html/ikiwiki.cgi`, or `/var/www/wiki/ikiwiki.cgi`.
 


@@ -13,9 +15,15 @@ run `.cgi`  programs from anywhere.
 These instructions are for Debian systems, but the basic
 configuration changes should work anywhere.
 
 These instructions are for Debian systems, but the basic
 configuration changes should work anywhere.
 

+[[!toc]]
+

 ## apache 2
 
 ## apache 2
 

-* Edit /etc/apache2/apache2.conf and add a line like this:
+* Make sure the cgi module is loaded. (Ie, `a2enmod cgi`).
+  Note that the cgid module will not work.
+
+* Edit /etc/apache2/apache2.conf (or /etc/apache2/mods-available/mime.conf)
+  and add a line like this:

 
        AddHandler cgi-script .cgi
 
 
        AddHandler cgi-script .cgi
 


@@ -26,8 +34,6 @@ configuration changes should work anywhere.
   Or, if you've put it in a `~/public_html`, edit
   `/etc/apache2/mods-available/userdir.conf`.
 
   Or, if you've put it in a `~/public_html`, edit
   `/etc/apache2/mods-available/userdir.conf`.
 

-  You may also want to install some dependencies to enable CGI in apache2 setup as: `libcgi-formbuilder-perl` and `libcgi-session-perl`.
-

 * If your wiki is in `~/public_html` and does not appear when you enter the URL given by the installer, check that you have 
   the userdir mod enabled (there should be simlinks to userdir.load and userdir.conf in /etc/apache2/modes-enabled).  If not,
   run `a2enmod userdir` and reload apache2.
 * If your wiki is in `~/public_html` and does not appear when you enter the URL given by the installer, check that you have 
   the userdir mod enabled (there should be simlinks to userdir.load and userdir.conf in /etc/apache2/modes-enabled).  If not,
   run `a2enmod userdir` and reload apache2.


@@ -39,6 +45,8 @@ configuration changes should work anywhere.
 
        ErrorDocument 404 /cgi-bin/ikiwiki.cgi
 
 
        ErrorDocument 404 /cgi-bin/ikiwiki.cgi
 

+* On Fedora (and RHEL, CentOS, and derivatives) you may need to change CGI mode from `06755` to `755` as suid/sgid bit is prohibited by `suexec`. ([Bug 1341568](https://bugzilla.redhat.com/show_bug.cgi?id=1341658))
+

 ## lighttpd
 
 Here is how to enable cgi on [lighttpd](http://www.lighttpd.net/) and
 ## lighttpd
 
 Here is how to enable cgi on [lighttpd](http://www.lighttpd.net/) and


@@ -76,6 +84,32 @@ made into a startup script in `init.d`. You may also need to make this file writ
 
     chmod a+w /tmp/fcgi.socket
 
 
     chmod a+w /tmp/fcgi.socket
 

+If you have [systemd](https://en.wikipedia.org/wiki/Systemd), you may use a service file like so:
+
+Edit/create a service file (in Debian it would be: `sudo vim /lib/systemd/system/ikiwiki.service`
+
+Content of `ikiwiki.service`:
+
+    [Unit]
+    Description=Ikiwiki fcgi socket wrap
+    After=network.target
+    
+    [Service]
+    Type=simple
+    User=www-data
+    Group=www-data
+    ExecStart=/usr/bin/spawn-fcgi -s /tmp/fcgi.socket -n -- /usr/sbin/fcgiwrap
+    
+    [Install]
+    WantedBy=multi-user.target
+
+Then run:
+
+    # This enables the service at startup
+    sudo systemctl enable ikiwiki.service
+    # This attempts to start the service
+    sudo systemctl start ikiwiki.service
+

 Then you need an nginx config plugged in that wrapper. Here's an
 example virtual host configuration:
 
 Then you need an nginx config plugged in that wrapper. Here's an
 example virtual host configuration: