how to set permissions for python scripts in cgi-bin on backtrack 5 r3

[atreyu]

After entering the commands and trying to access localhost/search/search.html

I assume you mean localhost/search/Search.html

 The requested URL /search/cgi-bin/search.py was not found on this server.

Apache/2.2.14 (Ubuntu) Server at localhost Port 80

OKay, so "search.py" needs to be in the CGI dir. Try this:

sudo cp /var/www/search/search.py /usr/lib/cgi-bin

and make it executable:

chmod +x /usr/lib/cgi-bin/search.py

[killa_cam]

Alright, so I executed the commands and that went fine. Then I tried "localhost/search/Search.html" (And yeah I did mean to say "Search.html") and that also worked.

The problems I ran into were when I tried to use the search engine. It looks like "Search.html" submitted the text to "/search/cgi-bin/search.py" even though it say's <form action="/cgi-bin/search.py" method="POST">

When I searched something I got:


Not Found

The requested URL /search/cgi-bin/search.py was not found on this server.

Apache/2.2.14 (Ubuntu) Server at localhost Port 80


Its also weird how "localhost/cgi-bin/" receives:

Forbidden

You don't have permission to access /cgi-bin/ on this server.

Apache/2.2.14 (Ubuntu) Server at localhost Port 80


and localhost/cgi-bin/hello.pl receives:


Hello from /usr/lib/cgi-bin/hello.pl

[atreyu]

The problems I ran into were when I tried to use the search engine. It looks like "Search.html" submitted the text to "/search/cgi-bin/search.py" even though it say's <form action="/cgi-bin/search.py" method="POST">

That is odd. On my Ubuntu box, that same Search.html page sends the form correctly to /cgi-bin/search.py (which is /usr/lib/cgi-bin/search.py). Now the search.py script itself has problems, b/c the browser throws up a 500 Internal Server Error, so the search engine doesn't even work for me, but it does not sound like that is your problem.

Is there anything helpful in the apache log?

Its also weird how "localhost/cgi-bin/" receives:

Forbidden

You don't have permission to access /cgi-bin/ on this server.

Apache/2.2.14 (Ubuntu) Server at localhost Port 80


and localhost/cgi-bin/hello.pl receives:


Hello from /usr/lib/cgi-bin/hello.pl

That is not weird if you are just putting "/cgi-bin/" in the URL bar without specifying an actual CGI script. It is a security method so that people cannot browse your CGI directories at whim.

[killa_cam]

It looks like the Apache2 access log file returned this (below) after requesting localhost/search/cgi-bin/search.py


::1 - - [13/Dec/2012:21:42:36 -0500] "GET /favicon.ico HTTP/1.1" 404 501 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
::1 - - [13/Dec/2012:21:42:38 -0500] "POST /search/cgi-bin/search.py HTTP/1.1" 404 505 "localhost/search/Search.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
::1 - - [13/Dec/2012:21:42:39 -0500] "GET /favicon.ico HTTP/1.1" 404 500 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
::1 - - [13/Dec/2012:21:42:47 -0500] "-" 408 0 "-" "-"
::1 - - [13/Dec/2012:21:46:38 -0500] "POST /search/cgi-bin/search.py HTTP/1.1" 404 506 "localhost/search/Search.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
::1 - - [13/Dec/2012:21:46:38 -0500] "GET /favicon.ico HTTP/1.1" 404 500 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
::1 - - [13/Dec/2012:21:47:10 -0500] "GET /favicon.ico HTTP/1.1" 404 501 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
::1 - - [13/Dec/2012:21:47:13 -0500] "POST /search/cgi-bin/search.py HTTP/1.1" 404 505 "localhost/search/Search.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
::1 - - [13/Dec/2012:21:47:13 -0500] "GET /favicon.ico HTTP/1.1" 404 500 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
::1 - - [13/Dec/2012:21:47:21 -0500] "-" 408 0 "-" "-"
::1 - - [13/Dec/2012:21:50:47 -0500] "POST /search/cgi-bin/search.py HTTP/1.1" 404 506 "localhost/search/Search.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
::1 - - [13/Dec/2012:21:50:47 -0500] "GET /favicon.ico HTTP/1.1" 404 500 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/10.04 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"



Okay I understand the "/cgi-bin/" thing now

[atreyu]

what about the error log? that one might have more helpful info.

[killa_cam]

Yeah forgot to add that one in. Here's what it returned:


[Thu Dec 13 21:42:26 2012] [notice] Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.17 with Suhosin-Patch configured -- resuming normal operations
[Thu Dec 13 21:42:36 2012] [error] [client ::1] File does not exist: /var/www/favicon.ico
[Thu Dec 13 21:42:38 2012] [error] [client ::1] File does not exist: /var/www/search/cgi-bin, referer localhost/search/Search.html
[Thu Dec 13 21:42:39 2012] [error] [client ::1] File does not exist: /var/www/favicon.ico



Maybe i'm wrong but it looks like its searching for the cgi-bin inside the search folder.

[atreyu]

Maybe i'm wrong but it looks like its searching for the cgi-bin inside the search folder.

it certainly does. what does this command return?

grep -i '<form' /var/www/search/Search.html

on my box, it returns:

                <form action="/cgi-bin/search.py" method="POST">

[killa_cam]

Sorry I have not replied in a while, I had some computer problems. I executed the command and received:

<form action="/cgi-bin/search.py" method="POST">